To update upon epaps above EDIT and Answer to the similar question Is there any way to rename or hide wp-login.php?, I too have found the .htaccess rules generated by the (now long abandoned) stealth-login plugin to be the least complex yet most effective means of preventing direct access to wp-login.php / wp-admin and protecting against various attacks (particularly brute-forcing).
Other "solutions" I have read require php functions, changes to wp-config.php and .htaccess rewrites. Or the installation of yet another (bulky) plugin! Many of these either only block the /wp-admin/ URI (easily subverted by going straight to wp-login.php), or break commenter/customer logins.
The stealth-login plugin's final version was v1.3 and was compatible with WordPress versions 2.3 to 2.7.1. The last Internet Archive snapshot from Oct 15, 2011 can be found here where stealth-login.1.3.zip can be downloaded. A compatible version of WordPress can be downloaded from the Release Archive - https://wordpress.org/download/release-archive/. Do the famous 5 minute install, unzip the stealth-login plugin to /wp-content/plugins and you can now generate a ruleset for your own use.
Mine is as per below and is working perfectly on WordPress 4.7.4 with WooCommerce 3.0.5. The only change I made was adding the rewrite condition on line 12. It was necessary to prevent WooCommerce /my-account/customer-logout from breaking (it was 302 redirecting without the /wp-login.php URI - meaning the query string on its own would not execute the logout, thus nothing happened. Note the string has been left open to pickup the wpnonce variable.
So as noted earlier, this is THE best solution I have found yet - and it can even be made to work with WooCommerce. So simple, yet so effective - thanks epaps for pointing this out.
RewriteRule ^signout wp-login.php?action=logout&_wpnonce=a3d57642ab&stealth_out_key=ow4hzd5lxudcetbgbfreaox6c1 [L]
RewriteRule ^signin wp-login.php?stealth_in_key=05gvov4wuuruahpuchpohavitl&redirect_to=https://yourwebsite.com/wp-admin/ [R,L]
RewriteRule ^admin wp-admin/?stealth_admin_key=f4ji1q6tpwr55s5a0h65clg0qk [R,L]
RewriteCond %{HTTP_REFERER} !^https://yourwebsite.com/wp-admin
RewriteCond %{HTTP_REFERER} !^https://yourwebsite.com/wp-login\.php
RewriteCond %{HTTP_REFERER} !^https://yourwebsite.com/signin
RewriteCond %{HTTP_REFERER} !^https://yourwebsite.com/admin
RewriteCond %{QUERY_STRING} !^stealth_in_key=05gvov4wuuruahpuchpohavitl
RewriteCond %{QUERY_STRING} !^stealth_out_key=ow4hzd5lxudcetbgbfreaox6c1
RewriteCond %{QUERY_STRING} !^stealth_reg_key=rue2bekyask21pwtegavqbbp5n
RewriteCond %{QUERY_STRING} !^stealth_admin_key=f4ji1q6tpwr55s5a0h65clg0qk
RewriteCond %{QUERY_STRING} !^action=logout&redirect_to=https%3A%2F%2Fyourwebsite.com%2Fmy-account%2F&_wpnonce=
RewriteRule ^wp-login\.php https://yourwebsite.com [L]
RewriteCond %{QUERY_STRING} ^loggedout=true
RewriteRule ^wp-login\.php https://yourwebsite.com [L]