Support

There is really not a lot you can do.

WordPress, unlike Joomla, always uses a single login for both the public frontend and administrator backend (wp-admin). While you can protect the wp-admin folder with a password, it will only prevent someone from accessing the administrator backend, not their attempt to log into your site.

You can use Admin Tools' Web Application Firewall feature to rename the login page. This means that visitors can no longer access /wp-login.php or /wp-admin directly; they have to go through your custom URL slug first. The URL slug is visible in the frontend wherever you have a login widget or login page. Yet, it is still very effective since the vast majority of bots try /wp-login.php directly, without trying to scrape your page for a custom login URL first.