About changing the login page URL

I run a WordPress site.
I changed the login URL with using a plugin.
But the hacker can identify login URL
How do they identify?
I don't think it makes sense to change the login page.
I don't want to reveal the login URL.Is there any good way?

My login page used to get bombarded by bots, my login page used to be the most visited page (according to server stats). Then I finally installed "WPS Hide Login" plugin and no problem now.

PS: I don't know, maybe there are better ways but this worked for me.