Are my admin and login pages exposed?

Most websites have an admin or login page at a predictable address - /wp-admin for WordPress, /administrator for Joomla - and attackers scan for those addresses constantly. Reducing what is reachable there cuts the constant pressure:

• The risk - a login page open to the whole internet faces endless automated password guessing, and any weak or reused password eventually gives way.
• Lock the door, not just the lock - enable two-factor authentication, use strong unique passwords, and rate-limit or lock out repeated failed attempts.
• Reduce the surface - restrict admin access to known networks where you can, and keep the platform and plugins patched so a known flaw cannot be used to walk in.

Assume the address is known and attacked daily - two-factor authentication on every admin account is the single highest-value lock.