I use Ubuntu 16.04 Nginx environment and SSHguard to prevent Brute Force Attacks (BFAs) on the machine VPS environment itself but I'm not sure how I could prevent BFAs on WordPress without using a plugin.
Unlike Drupal that has an application layer BFA prevention mechanism, WordPress has none.
What is the most minimal way, without a "complex" plugin like WordFence, to prevent BFAs in WordPress admin?
The end state should be that IPs trying to enter more than x times get blocked for at least x time (presumably, the default values).
Edit: Maybe SSHguard could help with that too?