$bad_names extended

Thank you.

How was this list compiled? Do you have an original source or reference?

When an attack is detected my included PHP class (not a plugin, because it is executed from wp-config) logs attack internals:

https://github.com/szepeviktor/wordpress-plugin-construction/blob/master/wordpress-fail2ban/block-bad-requests/wp-login-bad-request.inc.php#L305-L314

Once in a botnet attack I’ve grep-ped the usernames tried.

Of course it is a prerequisite that you do not use role-like usernames, only real person names.
So no “dev” or “marketing” but “john” or “cornelius”.

I will add these for the next release. Thanks Viktor!

In the most recent update, I’ve added a few more common usernames using your list and the list here: https://simonfredsted.com/1260

Thank you!
I’ve updated my list also.

https://github.com/szepeviktor/wordpress-plugin-construction/blob/master/wordpress-fail2ban/block-bad-requests/wp-login-bad-request.inc.php#L25-L59