Issues when blocking access to wp-login.php

Did some searching in this forum. Found nothing specific like this.

I configured my htaccess to only allow access to wp-login.php if you are coming from a block of IP addresses.

<Files wp-login.php>
order deny,allow
Deny from all
# whitelist my IP address
allow from nnn.nnn.
</Files>

According to WordFence, someone tried to login tonight.

“A user with IP address 111.22.333.444 has been locked out from the signing in or using the password recovery form for the following reason: Used an invalid username ‘username’ to try to sign in.”

I have tested that htaccess method by changing the whitelisted address to something different. It blocked me.

Is there a back door I do not know about, that would cause wordfence to report a login attempt?

Thank you in advance for tips/answers.

Richard