Move wp admin?

Changing the Default WordPress Login URL

Use the Wordfence option “Immediately block the IP of users who try to sign in as these usernames” to add any non-existent usernames you find unwanted users trying to access your site with.

Set your block period to a longer period as well (days or a month) instead of just minutes or hours.

Hi laslooo,
I would recommend turning on “Enable login security” in Wordfence with these options enabled: “Lock out after how many login failures“, “Immediately lock out invalid usernames“, and “Immediately block the IP of users who try to sign in as these usernames” that should protect you against brute force attacks.

Also, if you are using a static IP, then you can limit access to wp-login.php to your IP only, you can do that via “.htaccess”, check this guide from the WordPress codex.

P.S. make sure not to block access to wp-admin directory or change its name, because many plugins/themes require admin-ajax.php file which is located in (wp-admin/admin-ajax.php), more information regarding this issue can be found here.

Thanks.