Why are there so many attempts by an anonymous user to access /wp-login.php?
As kiamlaluno said:


  It's just bots scanning for exploits. You don't need to do anything,
  except serving a faster 404 response for those pages, as described in
  drupal.stackexchange.com/a/152732/199.