A plugin I have used and can heartily recommend is the WP All in One Security. It's free. The problem with "locking down logins" is that you're using a LOT of machine cycles to identify, log and turn away those attackers. The better solution is to not let the bots even get to your login page! This is something that the All In One Security does well. If you try to hit my WP login page without a particular keyword or cookie you'll get bounced immediately via an .htaccess rule.