Remove Account Hints From WordPress Login Errors

• A failed login message can reveal more than a visitor needs to know. If one message says the username does not exist and another says only the password is incorrect, the difference confirms whether the submitted account name was recognized. Generic Login Errors removes that distinction from supported credential failures. The visitor receives the same message in either case instead of being told which part of the attempted login was accepted.
• For a legitimate user, the instruction remains straightforward: review the credentials and try again. For someone testing potential usernames, the error text no longer provides that particular confirmation. This is a targeted reduction in information disclosure, not a claim that accounts become impossible to discover. The module does not hide names from page markup, comments, or logs, and it does not change the credentials that WordPress accepts when a user signs in successfully.

Keep the Message Helpful Without Identifying the Account

Cover More Than the Standard Login Screen

• A website may expose authentication through WooCommerce My Account as well as the standard WordPress sign-in page. Applying generic errors only to wp-login.php would leave inconsistent feedback if the store login continued distinguishing unknown users from incorrect passwords. WP PowerSuite therefore includes WooCommerce login-error handling and recognizes supported WordPress credential-login requests rather than relying on one visible form alone.
• The same approach extends to XML-RPC, the WP PowerSuite 2FA AJAX login flow, and REST or other forms that invoke the supported authentication path and are recognized by the login-request detector. This is not a promise to rewrite every custom login response produced by any plugin. Learning-management and membership forms can opt into the detector through the supplied developer filter. Custom integrations should therefore be reviewed according to how they authenticate, rather than assumed to be covered solely because they display a username field.

Preserve Lockout, Session and Two-Factor Guidance

• Not every login error is a credential failure, and replacing every message with a generic response would make important situations harder to understand. A temporarily locked account needs lockout guidance. A user whose session has expired needs to know why they are being asked to sign in again. A two-factor challenge is another authentication step, not evidence that the supplied username or password was incorrect.
• Generic Login Errors deliberately leaves those cases separate. Empty-field validation, lockout messages, session-expiration messages, two-factor prompts, social-login failures, and unrelated WordPress errors retain their intended behavior. This lets you reduce account hints without concealing the information users need to complete a legitimate sign-in. The module also leaves success messages alone, keeping its scope focused on ordinary incorrect-credential feedback rather than becoming a general notification-rewriting tool.

Keep Login Wording and Login Rules Consistent