Still receive login attempts after activiting plugin

I have downloaded and activated the plugin.
I went to settings general and changed the login url (I used a very random string for the login address)

Sucuri (plugin to monitor login attempts) tells me that someone is still trying brute force on my site. I was hoping the wps hide would help with this brute force attempts.

Is this some kind of cookie trick?
Or, is there another wordpress page that links to the login code?
Thanks for any help.

FYI I also have:
root .htaccess
<Files wp-login.php>
order deny,allow
Deny from all
allow from xx.xx.xx.xx (my ip)
</Files>

wp-admin .htaccess
AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName “WordPress Admin Access Control”
AuthType Basic
<LIMIT GET>
order deny,allow
deny from all
allow from xx.xx.xx.xx (my ip)
</LIMIT>