How to secure a WordPress site from Brute Force Attacks

Question

I am managing a WordPress website and want to prevent brute-force attacks targeting the login page. I know that attackers often use automated scripts to guess credentials, but I’m unsure about the best ways to secure my site. Specifically, I need guidance on:

• Limiting login attempts and using CAPTCHA.
• Configuring two-factor authentication (2FA) for admin users.
• Protecting the wp-login.php and xmlrpc.php endpoints.
• Monitoring failed login attempts and blocking suspicious IPs.

What are the best security plugins or server-side configurations to implement these protections?