This question already has an answer here:
Recently I've had brute force attack attempts on some of my WordPress sites and the attackers are using actual usernames other than the default admin (which was removed).
How is it possible for them to know the usernames in a site's database without administrator privileges? (assuming they didn't get it from me directly using malware)
What are ways to prevent this from happening?
btw: All of my sites use the current version of WordPress.
Thanks for your help!