Restrict access to wp-admin
Limit the login page by IP, add a second challenge, or move it out of reach.
Rate limiting already blunts brute force. If your administration happens from a small set of locations, you can go further.
Allow-list by IP
Sites → Security → Restrict wp-admin. Add the office address and any static addresses your team uses. Everyone else gets a 403 before WordPress loads.
Most residential addresses are dynamic. Lock yourself out and you will need a ticket to get back in. Keep a second route open, or use a VPN with a static exit address.
A second challenge
Where fixed addresses are impractical, add HTTP basic authentication in front of the login page. It is one extra prompt for your team, and it stops automated attempts before PHP runs.
Path: /wp-login.php
Method: Basic authentication
Users: managed under Sites → Security → AccessXML-RPC
XML-RPC is disabled by default, because it is mostly used for password attacks. If you use the WordPress mobile app or Jetpack, ask support to allow it with rate limiting rather than opening it completely.