DO NOT automatically IP blacklist offenders. I ended up with a .htaccess list of 3,000 banned IPs which took my site down. Use the highly loved, 5 star rated,

DO NOT automatically IP blacklist offenders. I ended up with a .htaccess list of 3,000 banned IPs which took my site down. Use the highly loved, 5 star rated, 5+ million downloaded "iThemes Security Plugin" for Wordpress (formerly Better Wordpress Security). https://wordpress.org/plugins/better-wp-security/ https://wordpress.org/plugins/better-wp-security/ ● Use the "Change Admin" feature to change your admin username to anything other than "admin". ● Hide your backend so that "yoursite.com/wp-admin" doesn't even lead to the login screen ● Use "Away Mode" so the backend is completely disabled during certain days or times of day. (10pm - 8am overnight) ● Enable "Brute Force" protection for logins, after 3 bad password attempts the host should be locked out. ● DO NOT enable "Blacklist Offenders" feature. If you do, this will add the IP address of offenders to your .htaccess file and eventually take your site offline when the list reaches thousands of IPs. It doesn't scale and you can quickly reach thousands of IPs in just a few days depending on the popularity of your blog. ● Use "Immediately ban host who tries to log in as Admin" Personally this is what I've found to work for me and my blog. Some days I get 220 hacking attempts and other days it dies down.