I agree with @Ron

For most of my sites I build a custom login form into the homepage (or other page) so the default wp-login is only seen occasionally by users – who don’t need to register. A majority of the time, someone going to the login page and then trying to sign up is going to be a spammer.