That is what I hate to. Before 4.0.0 most bots that did try to go to wp-login or wp-admin got redirected to Google.com. That solves 99,999% of the problem. Illigal traffic automatically transferred to some searchengine. Now, they still try. And yes, although still using this plugin and some other captcha they will still try, posing a threat to my site.