Hide login errors

WordPress is helpful when a login fails, and that is the problem. Enter a username that does not exist and it says the username is unknown. Enter a real username with the wrong password and it says the password is incorrect. The difference between those two messages tells you which usernames are real.

This feature replaces both with a single message: “Incorrect username or password. Please try again.” The same message appears whichever part was wrong.

Everything else about the login flow is unchanged. Genuine users see one slightly less specific message and carry on.

An attacker who can distinguish “no such user” from “wrong password” can test usernames cheaply and build a confirmed list before attempting a single password. That turns one large guessing problem into two much smaller ones, and the second is far more likely to succeed.

A generic message removes that signal. An attacker who has to guess both the username and the password simultaneously is facing a search space large enough that automated attacks stop being worthwhile – which is exactly the outcome you want, and it costs your real users almost nothing.

Vectro filters the error text shown on the WordPress login screen and substitutes a single generic message, whatever error was raised. The authentication logic itself is untouched – the account check, the password comparison and the resulting success or failure are all unchanged.

The replacement covers every error shown on the login screen. That includes errors on the lost password form and the lockout notice from the login attempt limiter, which a locked-out visitor will also see as the generic message.