What step would mitigate the risk of the specific type of the web attack that produced the web server logs presented below?

Switching to HTTPS encrypts the connection in transit but does not prevent an attacker from interacting with the login endpoint directly and observing different error messages in the response body.

Disabling root account web access is a privilege hardening control that is unrelated to the enumeration vector created by inconsistent error message wording.

Prohibiting shared passwords is a credential hygiene measure that does not prevent an attacker from probing the login form to identify which usernames exist in the system.

When a login form returns distinct messages such as 'invalid username' versus 'invalid password,' an attacker can probe the endpoint and observe which response is returned to enumerate valid accounts. Returning a single generic message - for example, 'invalid credentials' - regardless of whether the username or password is incorrect removes the distinguishing signal and mitigates enumeration. This directly addresses the specific attack pattern visible in the logs.

Enforcing stronger password complexity mitigates brute-force attacks against already-known accounts but does not stop an attacker from enumerating valid usernames through error message differences.