Always setup your admin user name with a 2 digit suffix like this: admin33. Hackers always assume it is admin so most times this alone will keep you safe. Then of course you will need a good strong password.

Another thing I have just started using is a plugin called ecstatic. it is a stats plugin but does other things also such as login security. If you get a certain number of login hits per so many seconds then it will block any further attempts from that IP for 15 minutes. I have no affiliation with ecstatic, I just like it.