For the vast majority of sites, there's a much faster and simpler approach compared to plugins: just restrict access to wp-login.php by IP address or CIDR range. If only a handful of people with a handful of IP addresses log in to a site, just allow those and deny everything else. Even an attacker with your credentials can't gain access unless he can figure out one of the allowed IP's.