I Locked Myself Out Testing My Own Brute-Force Protection
I hid my login error messages for security, which also hid my login limiter’s warnings. The only way to know if it still worked was to attack my own site.
hardening
Your WordPress Is Publishing Its Admin Username in Five Places
WordPress leaks your admin login through the REST API, author archives, and your own theme’s byline. Here is how to find all five and close them.