Hi @dannygrio, thanks for getting in touch!
It certainly can be frustrating to see many login attempts, especially if there seems to be no logical reason, but this is actually quite a normal occurrence. You might find the following blog post interesting: https://www.wordfence.com/blog/2018/03/ask-wordfence-why-is-an-insignificant-site-like-mine-being-attacked/
Wordfence, as an endpoint firewall cannot stop a bot or human from trying to visit your website altogether, but rather deal with the visits appropriately when they happen.
My general advice is that Wordfence does all of the important blocking for you automatically so you don’t have to, but if you wish to make your brute force or rate limiting rules a little stricter so that they can’t retry as frequently, you might find the following links useful to learn some more:
https://www.wordfence.com/help/firewall/brute-force/
https://www.wordfence.com/help/firewall/rate-limiting/
To keep yourself fully protected we ask users to set very strong passwords – stored in a password manager if necessary, and to use both 2FA and reCAPTCHA.
Regarding your scan, so I can check the status of plugins that may or may not be included with themes etc. you could send us a diagnostics report to wftest @ wordfence . com? You can find the link to do so at the top of the Wordfence Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.
Note: For the fastest response time, please make sure and add any information or questions directly to this topic and not the email address above unless asked.
Thanks,
Peter.