If you are not using CloudFlare and tweaking it for content delivery and added site security – you NEED to be doing so. The free version is more than adequate for everything but the big sites. You get 3 free rules with the free account, so set them up for : wp-login.* wp-admin* with a rule set of : I’m under attack and browser security check. With some sites getting 100+ failed login attempts per day, this has reduced the number of failed login attempts to around 1-2 a day per site.