Send an email notification to users each time someone logs in from a new IP. This helps users figure out if someone accessed their accounts without their knowledge.

Hide wp-login.php login page and close wp-admin access to avoid hacker attacks and brute force.