It is always advised to restrict wordpress admin section to specific IP to avoid brutforce attacks, to configure it add the below code in the .htaccess file of your wordpress domain

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^192.168.1.1$
RewriteCond %{REMOTE_ADDR} !^192.168.1.2$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule>