When users enter an incorrect username or password, an error message appears telling them which one is wrong. If someone is trying to break into your site by guessing one of these, that error message can help them understand what they got wrong. Block this by adding the following line to your functions.php file. For more security tips, see hardening your WordPress site:
add_filter('login_errors',create_function('$a', "return null;"));