Don't use "admin" ??

I *always* keep the account named “admin” even with the internal ID of zero. But on first login, I create my real admin account, log out of the original, log in to the new, and change the original admin account to have no role at all on the site, and give it a 45-character randomly-generated password (which I do not bother to save anywhere, because it is not needed).

What I would like is a plugin that immediately puts the IP address of ANY attempt to login as “admin” into my .htaccess deny list. Preferably keeping the deny list sorted, so that it’s easy to spot when several attacks are coming from the same IP group, and just block them all (to prevent the deny list from getting so long that it impacts site performance).

https://wordpress.org/plugins/monkey-trapped-login/