WordPress white screen of death — how to debug without admin access

In a 2 hour 45 minute window, one site recorded 77 failed login attempts from 11 distinct IPs. Per-IP rate limiting did nothing — no individual address attempted enough to trip the limiter. The signal was elsewhere: 10 of the 11 IPs all produced the same hashed username.

The integration hashes usernames before shipping, with a per-tenant HMAC key. That means the same target account viewed from multiple sources is recognizable as the same target, while the username itself never leaves the site in cleartext. Identical hashes across distributed IPs is the diagnostic. The attacker did not live anywhere in particular — they were renting addresses by the hour and pointing all of them at the same account.

The operator locked the active IPs at the CDN, added a per-account lockout policy (so a brute force against one account hits a wall even when the source addresses keep rotating), and assumed the target username was now publicly known — rotated the password and enabled 2FA.