Why this matters
By default WordPress exposes the usernames of users who have published content on a site. If you haven’t yet trained your client to use an editor role for their content work, this provides a potential hacker with easy access to one piece of information required to brute force a login.
With enough time, and common / stolen password lists, automated tools are out there trying their hardest. But there is no reason to make it easy for them. 2FA should always be enabled on all admin accounts (this is not included in ToggleWP) as part of a defence in depth strategy.
For those with good web application firewalls, and 2FA enabled, you can’t forget the human factor. Clients easily forget what their username is. However, how often do they forget their main email address? Hopefully not that often.
What it does
Force logins attempts to use an email addresses instead of a username. To gently remind users there is a small notice shown on the login screen (for them to ignore the first time round).
How to set it up
- Go to ToggleWP > Manage. Enable the “Security & Authentication” option in the Security panel.
- Swap to the “Security & Auth” tab at the top.
- Enable the “Email-Only Login” option.
- Click save at the bottom of the screen.