Locking out users with username that contains the domain name

Replies: 0

Hi,

What does WordFence consider to be an ‘invalid’ user name?

I’m seeing users being locked out that attempt to log in with valid user name in the form of an email that contains the domain name, e.g. for domain bar.org -> foo@bar.org.

The log then show entries like this:
…attempted a failed login using an invalid username “foo@bar.org”. https://edor.org/wp-admin/admin-ajax.php

Thanks.