Recently I noticed various login attempts being blocked by security plug-in this is pretty much ordinary when the attempt is about non-existent users or default/common user names like the website name, or the classic
Since the last week the login attempts (blocked after defined failed logins) were of real users, and the strange thing is that in some cases the users are not exposed in articles/pages as authors. Also consider that user iteration is suppressed, accessing
?author=1 gives no results but a 404 page.
it seems that they have found a different way to iterate users, do you know of any possible exploit that can be used and how to secure the websites?