How to protect the site from password guessing?

Question

Joomla

I have a site on Joomla 3. Error 508 began to appear about exceeding the request limit, in the c panel it was visible that the processor was overloaded. Found out that they probably tried to guess the password -
46.250.11.76 - - [27/Apr/2015:15:58:58 +0300] "POST /index.php HTTP/1.1" 303 - " http://mysite.ru/ " "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.90 Safari/537.36"
94.153.18.69 - - [27/Apr/2015:15:59:04 +0300]" POST /index.php HTTP/1.1" 303 - " http://mysite.ru/ " "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.90 Safari/537.36"
46.250.11.76 - - [27/Apr/2015:15:59:05 +0300] "POST /index.php HTTP/1.1" 303 - " http:" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.90 Safari/537.36"
94.153.18.69 - - [27/Apr/2015:15:59:09 +0300] "POST /index.php HTTP/1.1" 303 - " http://mysite.ru/ " "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.90 Safari/537.36 "
46.63.38.221 - - [27/Apr/2015:15:59:15 +0300] "POST /index.php HTTP/1.1" 303 - " http://mysite.ru/ " "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.90 Safari/537.36
wrote a rule for this user agent in .htaccess, everything stopped. How can I prevent such rebounds in the future? And how to find out about them in advance, as if I hadn’t been working on this site today, I wouldn’t have noticed anything (

Answer 1

add a secret parameter to the admin page, without which the login verification process supposedly goes on, but in fact it is always forbidden. www.site.com/admin.php?sk=sdsfdgdgegegegwgwegrwgbwrg