Cookie based brute force login prevention

Hi!

I just enabled cookie based brute force login prevention, however i am still able to login via mysite.com/wp-admin.

and the url with secret word it is not currently working.

do you know what should I do about it?

Thank you!