Woocommerce reveals possible gap in WP?

Hello.
This may be an issue when I use Woocommerce, but the greater issue came up. Let me put it as simplier as I can:

1. I assume WC uses admin-ajax.php for customer authentication.
2. WC logout links’ URL contains wp-login.php
3. WC login links do NOT seem to require wp-login.php. Why?)

In web server level, I would like to prohibit access to WP login page. So far I’ve done it by denying access to wp-admin/, wp-login.php and granted access only to admin-ajax.php.

PLEASE let me know if there is a way to solve this. I want to deny visitors the ability to see my WP login page, but I want WC customers to be able to login/logout.