[bigiain]

Can I suggest it might be worth investigating the "Wordfence Security" plugin?

I use it pretty much everywhere that I have anything to do with WordPress - I'd noticed an uptick early this week of random ip addresses from far-flung countries getting locked out after 5 login attempts or multiple lost password attempts.

(One site in particular gets a _lot_ of drive-by login attempts - it's got the word "anonymous" in the domain, which I suspect attracts mostly the wrong sort of traffic... Wordfence is locked down _much_ tighter on that site.)

[krapp]

I was just about mention this ... I'm using Wordfence on a wordpress site right now, already had logins limited.

And the 'live scan' is scary -- constant attempts to login as 'admin'.