In addition to the above server level things, within WordPress you can: change the default admin username, giving admin much less permissions, password protect wp-login.php, limit access to wp-admin by IP address, deny no-referrer requests, consider blocklists - and many, many more. It pays to learn about securing WordPress, and use more than one single solution to protect yourself.