If you are not using CloudFlare and tweaking it for content delivery and added site security – you NEED to be doing so. The free version is more than adequate for everything but the big sites.

You get 3 free rules with the free account, so set them up for :

wp-login.*

wp-admin*

with a rule set of : I’m under attack and browser security check.

With some sites getting 100+ failed login attempts per day, this has reduced the number of failed login attempts to around 1-2 a day per site.