Simple but effective!

I highly recommend this plugin. It takes 30 seconds to setup and it’ll prevent anyone from brute-forcing their way into your WP installation. It can automatically blacklist IPs after a specified number of attempts (I set it to 10) and can also add a delay between login attempts (I set it to 5 seconds). It keeps track of which IPs have been blacklisted and I’m constantly seeing new IPs added to the list, which means it’s doing its job!