Hide wp-login.php behind a custom login URL and stop brute-force attacks — lockouts, IP allowlist, login history, email alerts. No tracking.