1 plugin.
Disable direct access to your sites /wp-login.php script, plus user notifications based on actions.