My question is similar to this one, except that the automatted login attempts are using not nonsensical user names, but real ones that were used in the past on this site. It became infected with a malicious redirect and I reinstalled it. It's a Wordpress site, and I now use the Cerber security plugin for protection, which blocks IP-addresses (entire subnet) from logins with these old user names, which I blacklisted, plus some common ones like admin, administrator etc. These login attempts are slowly increasing in number, and I'm wondering if it's any more dangerous than for the other question that I cited and if there's anything more I could/should do about it.
These are 2 methods I use. There may be other better ones but these are 2 quick ones that I've used successfully.
You could enable 2 Factor Authentication.
This is a quick solution for such instances when you're under brute force attacks. Right now I know of 2 options to do this:
If you're already using Jetpack, you can enable this option from Jetpack > Settings > scroll to the bottom. You can see a few more details at Jetpack.com. Using this option you'll have to login using your Wordpress.com account. This is the one I use.
Alternatively, you can check the suggested plugins at the bottom of this page Wordpress.org - Two Factor Authetication. I haven't used this method.
I'm not sure of the drawbacks to this method. Probably it being more difficult to log in, having to depend on your phone, and going for the easy way rather than understanding how to protect your website at a deeper level.
The second is via "Basic Authentication", where you add an extra layer of security on /wp-admin. It's a prompt requiring another user/password.
I believe that setting this up depends on how you're serving your website - apache, nginx, apache+cpanel, etc.
I don't know your set up. To find how to easily set this up, you can google something like
htpasswd wordpress apache,
htpasswd wordpress nginx,
htpasswd wordpress cpanel, etc.