I have checked the knowledgebase without success. Today one of my sites has been attacked from several countries. Wordfence is telling me that:
"This email was sent from your website "XXXXXXX.com" by the Wordfence plugin at Saturday 14th of June 2014 at 02:28:24 PM
The Wordfence administrative URL for this site is: http://XXXXXXX.com/wp-admin/admin.php?page=Wordfence
A user with IP address aaa.bbb.ccc.ddd has been locked out from the signing in or using the password recovery form for the following reason: Exceeded the maximum number of login failures which is: N. The last username they tried to sign in with was: 'YYYYYYYYYYY'
User IP: aaa.bbb.ccc.ddd
User hostname: 180-177-134-238.dynamic.kbronet.com.tw" "
I have had several emails like this and in each case, the username YYYYYYYYYYY is correct. Given that usernames and passwords have many characters and are not obvious - indeed I created a new user precisely because I thought I'd left the username public.
As I write, I've just had four more similar emails each using different, correct usernames. I have very long passwords for all the accounts and have reduced the number of login attempts allowed and increased the lockout period.
(1) Any recommendations about how to ensure that this guy does not get in while I am getting the answer to (2) and (3)
(2) How did he (or she) find out the usernames and
(3) How can I conceal them from him (or her) ?
Thanks
James