This is par for the course. All domains get bots trying to brute force. It just means your site is more popular than the average. Really, xmlrpc.php and wp-log

This is par for the course. All domains get bots trying to brute force. It just means your site is more popular than the average. Really, xmlrpc.php and wp-login.php should not be accessible at all. You can rename wp-login.php, or you can make it available to specific IP address(es), or you can ssh -L to access it via ssh. It might be helpful to do a histogram of the IPs that try to access those files and sort it so you can see if many attempts are coming from IPs on the same networks. If so, you can report the most egregious ones to their ISPs, and/or you can outright block whole networks. I've done this with large parts of HiNet in China because they allow any kind of abuse and don't take any actions whatsoever. It has cut my logs significantly.