To avoid direct access to wp-admin and wp-login.php, you’ll need to enable Hide Admin option and set Login Query & Login Key (in General settings tab) – https://www.screencast.com/t/j1w9VWaYb
We recommend you to apply “medium privacy more compatibility” settings scheme from HMWP start tab and save the settings. The new login url will be /wp-login.php?hide_my_wp=1234
To rename wp-login.php, you’ll need to set “Change Login URL” field in Permalinks & Urls tab.
To rename wp-admin, you’ll need to set “New wp-admin Path” field, and follow the on-screen instructions very carefully.