A reminder of how I stopped someone trying to brute force a client site

.htacess

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
# Added to stop us serving content to internal dummy connections
RewriteCond %{HTTP_USER_AGENT} ^.*internal\ dummy\ connection.*$ [NC]
RewriteRule .* - [F,L]
#End of added
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

<Files xmlrpc.php>
Order allow,deny
Deny from all
</Files>

# END WordPress