I had a client who had a security plugin installed and they were getting constant alert notifications about hack attempts. Thousands of login retries, even though there was brute-force protection. The attempts would come from a whole botnet of IP addresses to disguise that they were part of one attack.
On top of the security plugin, I added an .htaccess rule to only allow access to the admin login and the entire wp-admin subfolder from within their office. They have a static IP and were OK with only having access from within the office so this worked well for them. This pretty much ended all of the attacks. I probably wouldn't rely on this as the only protection, but it definitely has been a great piece of their overall security plan. The code to do that is here: