Unfortunately this is of limited helpfulness. At my job (small web host), many of the WordPress brute force attacks we see across our shared hosting fleet use

Unfortunately this is of limited helpfulness. At my job (small web host), many of the WordPress brute force attacks we see across our shared hosting fleet use the '?author=\d+' trick in WordPress to find the usernames of admin-like users before starting the actual attack. Totally idiotic of WordPress to reveal usernames this way. We have moderate success in slowing/blocking these attacks using a WAF such as mod_security (after a certain number of HTTP 200 responses on wp-login, aka login failed, block the IP). On the bright side, our load averages went down a non-trivial amount once we introduced these rules (a few customers would get effectively and inadvertently DoS'd by these brute forces LOL)