Hi @wfadam
Thank you very much for your response. This definitely helped.
One quick clarification please…
Since someone had a successful hit to my wp-admin/xxx does that mean they had gained access to the site ?
(I tried to recreate the issue by hitting the same url, and is only seeing blank page.)
When in Protection mode, Wordfence blocked this request, which is great.
Those successful hit to /wp-admin/xxx was during learning mode.
Thanks!