Some time ago I installed the Limit Login Attempts Reloaded plugin and it's working fine.
However because I was getting SO many unauthorized login attempts I also implemented an .htaccess password on the wp-login.php file itself, and that does work - when I go to either /wp-login.php or /wp-admin (assuming I'm not already logged in), I get my first level .htaccess password required dialog and have to enter the correct username and password (which FWIW is completely different from any of our WP usernames/passwords).
Once I enter the correct credentials into the dialog box, then and only then do I get the wp-login.php page to login with my WP username and password.
I have a few other (non-admin) users to whom I've given this higher-level login info. Both the username and password required by .htaccess are extremely long and strong, and highly unlikely to be 'guessed' by anyone so I would expect to see ONLY authorized user logins.
BUT I'm still getting repeated unauthorized attempts on my wp-login page - not as many, but it does still occur according to the LLAR plugin......In the logs it shows the attempts as coming in via wp-login, not XMLRPC (which I've disabled).
So my question is: Is there anyway someone/bot could by bypassing the .htaccess directive on wp-login.php? Or is the ONLY possible answer that the first-level login credentials have been discovered somehow? (Lack of user security?).
If the ONLY way is via a discovered first-level login, I can change that and advise my users, but if there is some other way that I am missing, then doing that won't be effective.