WordPress Brute Force Prevention

Rather than blacklist logins, why not whitelist your own IP (example 12.345.67.891 below; or a range) for wp-login.php and in wp-admin for logins and administration? (No plugin needed).

A whitelist will block everyone else except you from login. See http://httpd.apache.org/docs/2.4/howto/access.html

in the .htaccess in the wp-admin folder:

Options All -Indexes

order deny,allow
deny from all
allow from 12.345.67.891
allow from 12.345.89.0/24  //example CIDR range; see http://www.ipaddressguide.com/cidr#range

deny from all

in the .htaccess in web root:

<Files wp-login.php>
order deny,allow
deny from all
allow from 12.345.67.891
allow from 12.345.89.0/24  //example CIDR range
deny from all
</Files>

And then check your logs afterward.