How do I hide the wp-admin login path?

One of the first places bots go after is /wp-login.php. Swapping that path for a secret one cuts almost all of that noise.

Without relying on external plugins

With a must-use plugin you can serve the login on a secret path, and block direct access to wp-login.php and wp-admin for anyone who isn’t logged in (redirecting them to the home page).

Tip: manage it with a constant in wp-config.php. That way, if something goes wrong, you remove the constant and get access back instantly.

It’s not a silver bullet (keep using strong passwords and, if you can, 2FA), but it hugely reduces the automated attack surface.