Highly recommend you put code in place to stop the ridiculous default behaviour of WP saying 'the user name is wrong' if you try to guess it, it should just say 'something is wrong', otherwise hacker can know when they guessed user name correct and all they then need to do is try to crack pwd. If you email me I can supply the few lines of code needed.