WordPress Security- Preventing vulnerabilities and hacking

Hi,

I am using Wordfence for two WordPress websites, and I notice with one of my sites, that I receive daily Wordfence emails that note numerous attempts to sign in by another user, and the user has been locked out from the signing in or using the password recovery form for the following reason: Exceeded the maximum number of login failures which is: 20. Is this very common, or I am receiving an unusual number of people attempting to break into my site? I’m concerned. Is there anything else I can do to strengthen my site security?

https://wordpress.org/plugins/wordfence/