Your wordpress based website may be vulnerable or you can’t update extensions,wp core regularly.Also you have too much brute force attacks to your wordpress admin.In every case,the solution for your wordpress security may be restriction  wp admin by ip address.