Add protection for Bad bots and security log to see what is happening.
Like most security plugins has! Like Blackhole Pro | Plugin Planet or a more smooth dashboard like WF:
https://ps.w.org/wordfence/assets/screenshot-7.png
log following and filter by bots etc:
– user agent
– Request method
–...
Would be good to add recaptcha on login page.
Preferably v2 or use another framework than googles. V3 adds a badge on the site and need that bt it adds 200-600ms on loading times and v2 do the job!