User enumeration on login page

Hi, user enumeration is still happening on the login page with its native error messages. There are two cases: When you enter an incorrect username, the error message confirms, that there is no such username on the site. When you enter a correct username with an incorrect password, the native error message confirms, that the username is actually exists, but the password is incorrect. This type of enumeration can be easily fixed with the change of the error message, so it will use instead this error message in every case: <strong>Error:</strong> Invalid username, email address or incorrect password. This string is part of WordPress, so it is already translated for hundreds of languages. Here is the code to change the original error message: // Unified login error message for security add_filter( 'authenticate', function( $user, $username, $password ) { // If it's already a WP_Error, replace the message if ( is_wp_error( $user ) ) { $user->errors = array(); $user->error_data = array(); $user->add( 'invalid_credentials', __( '<strong>Error:</strong> Invalid username, email address or incorrect password.' ) ); } return $user; }, 30, 3 ); // Also filter the login errors filter as a backup add_filter( 'login_errors', function() { return __( '<strong>Error:</strong> Invalid username, email address or incorrect password.' ); } ); I’m using it to change the error message on my sites beside your plugin. But if you add this option also to the plugin, it will make my and 50,000+ websites’ owners life easier.