Automated brute-force attacks ("bots") typically start by getting a list of valid usernames ("user enumeration").

By blocking the enumeration and matching with the hard filters, the attacker has no opportunity to try anything else.

Useful links

• Documentation: WP_FAIL2BAN_BLOCKED_USERS