wp-login.php disabled, but wp-login not

I have hide backend enabled, but the wp-login url still works (wp-login.php directs to a not found page, like it should, but if its just https://www.sitename.com/wp-login that takes you to the login page). Is there a fix for this, I still get a lot of login attempts with wrong usernames so clearly hackers know how to navigate to wp-login?