A lot of the current answers are way over complicated
Just install... Loginizer for WordPress. It is used by millions of sites and by installing it, it will automatically ban bad users by IP address for a few hours, a day, weeks, months or even years.