Check http://onexa.nl/wordpress/brute-force-attacks-verder-afweren/ for info on this code

.htaccess

# Place this below the .htaccess code from https://onexa.nl/nieuwsberichten/brute-force-attacks-wp-login-php-verminderen/
<IfModule mod_rewrite.c>
	RewriteEngine on
	RewriteCond %{QUERY_STRING} !(^|&)secure=XXXXXXXXX($|&)
	RewriteCond %{REQUEST_URI} .wp-admin* [OR]
	RewriteCond %{REQUEST_URI} .wp-login\.php*
	
	RewriteCond %{HTTP_REFERER} !.*domain.com.* [OR]
	RewriteCond %{HTTP_USER_AGENT} ^$
	RewriteRule (.*) http://%{REMOTE_ADDR}/ [R=301,L]
</ifModule>