Cookie based brute force protection

I implemented cookie based brute force protection on several of my sites because I was getting attacked frequently. This changed the login URL of course. The secret word I used is 20 characters and very strong. Within minutes of implementing this strategy I began getting site lockout notification emails for each site. How could that be? If the URL was secure and very strange how could I get site lockout notifications within minutes? It appears that the URL is getting exposed somehow.

https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/