Limit Login Attempts continues to be an awesome Plugin.

I've noticed an uptick in brute-force attempts in the past couple months, too. I'm thinking about lengthening the lockout period, but otherwise I'm not worried.

As I've said in the past, I intentionally keep the "admin" username around. It only has "subscriber" privileges, so 1) it's there, so the script kiddies keep trying to brute-force it, rather than attempt a legit username; and 2) even if they manage to brute-force it, they can't do anything when they do.