Hi @wordhab, thanks for reaching out to us with your queries.
We delete database rows older than the value set for email frequency, so the failed logins statistics in your case should cover the week since your last email arrived.
There is a possibility that a small mistyping of credentials, for those who enter them manually, could record some legitimate users with their legitimate username getting failed logins. However there’s also a good chance failed logins are also bots/humans with malicious intent trying to gain access to an account hoping that it has a weak or commonly known password.
Whilst it seems alarming to see usernames that may not be obviously discoverable being tried, especially if there seems to be no logical reason, this is actually quite a normal occurrence. You might find the following blog post interesting: https://www.wordfence.com/blog/2018/03/ask-wordfence-why-is-an-insignificant-site-like-mine-being-attacked/
An email address or even legitimate WordPress username being exposed isn’t generally considered a security issue, even by WordPress themselves: https://make.www.ads-software.com/core/handbook/testing/reporting-security-vulnerabilities/#why-are-disclosures-of-usernames-or-user-ids-not-a-security-issue
To best protect yourself, make sure all admin accounts and those with high level access (e.g. with publisher access) use a very strong password. WordPress can auto generate a very strong password for you on an account page.
We recommend using a password manager to store and/or generate your complex passwords that are exceedingly difficult to remember.
Set our recommended brute force protection rules. Instructions are in the link below. You can quickly find these options in the Brute Force Protection section on the All Options page:
https://www.wordfence.com/help/firewall/brute-force/
Note that the option “Prevent discovery of usernames through /?author=N scans, the oEmbed API, the WordPress REST API, and WordPress XML Sitemaps” won’t help in all cases. Some themes leak admin usernames and there isn’t anything we can do to prevent this.
Enable two-factor authentication for administrators and those with high level access. This feature is on the Login Security page. Instructions are in the link below:
https://www.wordfence.com/help/tools/two-factor-authentication/
If there are a large amount of login attempts for the same username coming from a large pool of IP addresses then you can also enable the Google reCAPTCHA feature found on the Login Security > Settings page.
I hope this helps you out and provides a level of comfort should this information be obtained and attempted without a clear reason how or why.
Thanks,
Peter.
