Disable direct access to your WordPress sites /wp-login.php script, plus user notifications based on actions.