Limit Login Attempts with IP blocking, brute force protection, Google recaptcha on login as well as registration from spam protection, rename login url, XMLRPC etc.