I constantly forget drupal login url, (by default, unless you have built custom aliases) /admin will simply shows a 403 (access denied) and /login returns a 404 (page not found), which is great from the security perspective.
The following are its login urls:
/user
/?q=user
/?q=user/login
For personal blogs and small company sites, a good security practice is to grant access to a group of whitelisted users and deny the rest. In case you don't know, you can easily achieve this task in drupal, administer-> user management -> access rules. Below is my access rules, I only allow myself and blocks anyone else, which is represented as a percentage sign (%).
