'hide_login_errors', 'title' => 'Hide login error hints', 'desc' => 'Show one generic message for any failed login', 'icon' => 'eye', 'risk' => 'safe', 'level' => 'beginner', 'audience' => 'everyone', 'priority' => 1, 'benefit' => 'By default WordPress says whether the username exists or the password was wrong, which tells an attacker which usernames are real. A generic message gives nothing away.', 'help' => 'Replaces every error shown on the login page with "Error: Invalid login credentials." This also applies to other login-page errors, such as on the lost-password form, so people get less detail about what went wrong. If "Limit login attempts" is on, its lockout and attempts-left messages still show.', 'before' => '"The username admin is not registered on this site."', 'after' => '"Error: Invalid login credentials."', 'callback' => function () { // Priority 10 — replaces core error text with generic // Other filters at 99+ can still append to this. add_filter( 'login_errors', function () { return 'Error: Invalid login credentials.'; }, 10 ); }, );