Hi @nanny7
I hope you are doing well today.
If you have enabled “Firewall – Notification” in Defender -> Notifications you will get email notifications when a user or IP is locked out for trying to access your login area.
Please review your settings in Defender -> Firewall -> Login Protection:
Threshold and Duration. With the correct setup, you can block for a longer time before the next attempt. With Duration, you can set up a Permanent ban so fewer emails should appear in case the same IP is trying to access your site.
Also review your Defender -> Tools -> Mask Login Area and if this option is enabled. It will for sure help to hide the default /wp-admin slug.
Kind Regards,
Kris