Holographic

Holographic Login Shield helps protect the WordPress login area from repeated failed logins, automated abuse and common account-discovery behaviour.
The plugin is designed to stay focused. It adds practical login hardening without replacing the WordPress admin area, adding unnecessary front-end assets or sending free-plugin security logs to an external service.
Free features include configurable failed-login lockouts, an automatic permanent IP block threshold, local allowed and blocked IP address lists, Cloudflare-aware visitor IP detection, a paginated recent activity log, CSV log export, log retention cleanup, generic login errors, XML-RPC control, Application Password control, optional author archive blocking, a hidden bot trap and optional throttled failed-login email alerts.
Allowed IP addresses can be added manually or with the Add My IP button. Blocked IP addresses can be added manually and are also populated automatically when the permanent blocking threshold is reached. Both lists remain local to your WordPress site.

Holographic Login Shield

Lightweight login protection, brute-force defence and safer admin access controls for WordPress.

munyagu

This plugin enhances the WordPress security. 
Effective such as the brute force attack. 
Includes the following specific functions.
1.Google reCaptcha v3 protect login screen from bot attacks.
2.Change the URL of the login screen, to avoid attacks on the login screen. 
 You can ward off tying for try to login for cracking, such as Brute-force attack. 
 Adding parameter to login URL so that default login url will hidden.
3.Block the display of author archive page 
 WordPress leaks your login id because of redirect author archive page by author id to login id. 
 (If you enter “your-site-url/?author=1”, you can try it.) 
 Simply hideing author archive page so that block to leak login id.
4.To limiting the part of the XML-RCP feature prevents the attack. 
 Block DDOS attacks against other sites with yor WordPress site, pingback enabled. 
 Block login via XML-RPC.
5.Disable the REST API function and reduce the risk of receiving external attacks. 
 You can disable all REST APIs and you can partially disable them. 
 (This feature will be removed in version 2.1.)
These features will be able to choose whether or not to enable.
This plug-in does not change the .htaccess 
You can use with confidence. 
Also it works in both Apache and nginx.
(photo by Keoni Cabral https://www.flickr.com/photos/keoni101/)

Barbwire Security

This plugin enhances the WordPress security.

Holographic Login Shield vs Barbwire Security