WordPress
wp-admin
wp-admin is the logged-in control panel at /wp-admin/ where you manage content, plugins, users, and settings. It is also the folder of PHP files that powers that interface.
How it is measured
Visiting /wp-admin/ while logged out redirects to /wp-login.php. After sign-in, the menu is built from the current user's capabilities, so an Editor sees fewer items than an Administrator. The file admin-ajax.php in this folder handles AJAX calls from both the dashboard and the public front end, and admin-post.php handles form posts.
Count real login activity from the access log with grep 'wp-login.php' access.log | grep POST | wc -l. Users with an active session can be listed with wp user session list <id>.
Worked example
A shop's access log for one night shows 11,600 POSTs to wp-login.php from 340 IP addresses, trying names such as admin, editor, and the site name. None succeed, but PHP-FPM workers are busy handling them and page loads slow to 3 seconds.
The owner adds two-factor login, renames the administrator account, and rate-limits wp-login.php at the CDN to 5 attempts per minute per IP. The night's POST count drops to about 400.
How it differs
wp-admin is the management area of a WordPress site, not the whole of it. The public site, the theme, and the database exist without it. wp-admin also differs from XML-RPC, a separate remote entry point that authenticates without the login screen, so protecting wp-login.php alone leaves xmlrpc.php open.
Common errors
Using admin as a username. Giving every contributor the Administrator role. Leaving file editing on in the dashboard, so one stolen account can edit PHP. Blocking admin-ajax.php and breaking front-end features. Forgetting that wp-admin shares a session cookie with the front end.
In practice
Check the user list for stale Administrator accounts, turn on two-factor, and add define( 'DISALLOW_FILE_EDIT', true ) to wp-config.php. Rate-limit wp-login.php at the server or CDN, but leave admin-ajax.php reachable.