XML-RPC

xmlrpc.php has one call — system.multicall — that lets a single HTTP request carry hundreds of password attempts. That is how guessing is actually done at scale, and it goes straight past anything counting sign-in attempts the ordinary way.

Three choices, and the middle one is the default:

• Block the bulk guessing, leave the rest. system.multicall is removed and each wp.getUsersBlogs attempt is counted like any other. Jetpack and the WordPress mobile app carry on working;
• Switch it off entirely. Nothing can use XML-RPC. Clean, and it breaks Jetpack on the sites that have it;
• Leave it exactly as WordPress has it. For a site with something unusual hanging off it.