A lot of the current answers are way over complicated

Just install... Loginizer for WordPress. It is used by millions of sites and by installing it, it will automatically ban bad users by IP address for a few hours, a day, weeks, months or even years.

I wrote an article a couple of years back and it's worth a read, especially the section about "Creating a Strong Complex Password"

10 ways to stop Brute Force attacks in WordPress

Many WP plugins will stop brute force hackers in their tracks however because most plugins work on banning IP addresses after X attempts they may not stop determined password crackers using multiple IP blocks in the thousands.

Most plugins lift bans after X minutes meaning with enough IP addresses you become pretty much immune to these bans unless you opt to use an extremely long duration on those bans. Administrators generally do not use long duration bans because they don’t want to get locked out themselves.

A lot of the current answers are way over complicated

Normally I would suggest fail2ban or hiding wp-login.php but 50 attacks is nothing! with a decent password it would take them many decades. Personally I would keep things simple and just install... Loginizer for WordPress. 

It is used by millions of sites and by installing it, it will automatically ban bad users by IP address for a few hours, a day, weeks, months or even years. Also, it will show you how many attacks it has blocked.