I use this on every WP site I make.

This simple measure eliminates the overwhelming majority of brute-force bot attacks. Decent usernames and passwords mop up the remainder of the issue, but this is easily 98% of the solution.

I always put a subtle link to this login on my landing page for admins and editors, easy to click but not obvious to the normal visitors.