I need to change the information given on Wordpress' Login page and the Lost password page so that hackers cannot easily see if a username or email is associated with an existing account.
At the moment Wordpress gives away way too much useful information. On the Login page it tells you if the username is wrong or if the password is wrong. I need this to just say something like 'Login failed' - this will not provide the hacker with valuable information about whether they have an existing username or email. Then on the Lost Password, I just want it to say somethink like 'Please check your email, if the username or email exists we will send you a link' - or something like that!
Thanks in advance for any help!