You can get your reverse proxy to hide /wp-admin/ from the outside world but still allow access from your trusted IPs or whatever. That will close off a few po

You can get your reverse proxy to hide /wp-admin/ from the outside world but still allow access from your trusted IPs or whatever. That will close off a few potential snags. You might also consider a full web application firewall (WAF) - there are plenty including WP internal solutions, commercial and open source. Me? I slap HA Proxy on the front. As you imply, I wouldn't bother fiddling with domain names - that is not a security solution and will bugger up the "message".