On a related note, the number of HTTP 404 errors I see to /wp-login.php on my static website is ridiculous. (But absolutely not security risk.)
It may not seem like much, but I spent a year or two adminning a >1 million reqs / day cluster, and it does add up. Auto-banning this type of obvious offender (with fail2ban, as it happens) did result in a noticeable improvement for us.