Holographic

Holographic Login Shield helps protect the WordPress login area from repeated failed logins, automated abuse and common account-discovery behaviour.
The plugin is designed to stay focused. It adds practical login hardening without replacing the WordPress admin area, adding unnecessary front-end assets or sending free-plugin security logs to an external service.
Free features include configurable failed-login lockouts, an automatic permanent IP block threshold, local allowed and blocked IP address lists, Cloudflare-aware visitor IP detection, a paginated recent activity log, CSV log export, log retention cleanup, generic login errors, XML-RPC control, Application Password control, optional author archive blocking, a hidden bot trap and optional throttled failed-login email alerts.
Allowed IP addresses can be added manually or with the Add My IP button. Blocked IP addresses can be added manually and are also populated automatically when the permanent blocking threshold is reached. Both lists remain local to your WordPress site.

Holographic Login Shield

Lightweight login protection, brute-force defence and safer admin access controls for WordPress.

yehudah

multipie ways to help block xmlrpc attacks.
This plugin have this options:
First Option: 
Log errors and access – to debug plugin errors and access to the xmlrpc file.
The protection options:
<ul>
<li>Disable xmlrpc – disable the file complete with wordpress built in option.</li>
<li>Block login errors ip’s in htaccess – every WRONG login attempt will be blocked inside the htaccess file.</li>
<li>Enable xmlrpc for a specific user – give permission to access the file to pre define user you will choose.</li>
<li>Disable xmlrpc built in functions – xmlrpc have many options and actions to query on your wordpress site, with this option you can choose which option to disable and wich to keep enabled.</li>
</ul>

xmlrpc attacks blocker

multipie ways to help block xmlrpc attacks.

Holographic Login Shield vs xmlrpc attacks blocker