I usually change the 'admin' username to something different, so the dumb bots that try to bruteforce their way in would give up altogether. I'm not sure about

I usually change the 'admin' username to something different, so the dumb bots that try to bruteforce their way in would give up altogether. I'm not sure about WordPress revealing whether it's the username or password that's incorrect though. It's a compromise between security and UX that should be left to the admin (of course, there are plugins to remedy this).