Login attempts limit
There are several config settings which should help...


maxInvalidLogins - The number of invalid login attempts Craft will allow within the specified duration before the account gets locked.
invalidLoginWindowDuration - The amount of time to track invalid login attempts for a user, for determining if Craft should lock an account.
cooldownDuration - The amount of time a user must wait before re-attempting to log in after their account is locked due to too many failed login attempts.


In addition, you may also want to change your cpTrigger from the default.

Lastly, there is a feature request to strengthen password requirements, where Brandon Kelly posted a link on how to enforce your own stricter password requirements.