Anton Aleksandrov

Every failed login is counted and if configurable threshold is hit, plugin will block access to wp-login.php in .htaccess, so 
that hijackers won’t be able to try anymore and at the same time – won’t use server resources.
If the same IP keeps trying after first block has expired, it is possible to block it from accessing website completely.
Blocking visitor in .htaccess is the most simple and most resource friendly way of stopping webpage abuse and wasting server resources.
Since v0.6 plugin should also log and stop XML-RPC abusers.

.htaccess Login block

Simple plugin to block login hijackers using apache and .htaccess. Simple and resource efficient way to protect your blog. Works with Apache from 1.

Takashi Kitajima

MW IP Denied allows you to set access restrictions by IP address for each article. When access is restricted and there is template-access-denied.php, MW IP Denied load it.
You can also use short code for controlling the access on a part of the article.
Only the IP address that you specify can access. 
[mw-ip-allow allow=”IPAddress,…”]text[/mw-ip-allow]
Only the IP address that you specify can not access. 
[mw-ip-deny deny=”IPAddress,…”]text[/mw-ip-deny]

MW IP Denied

MW IP Denied allows you to set access restrictions by IP address for each article.

.htaccess Login block vs MW IP Denied