Hiding WordPress usernames: author pages, the REST API and login messages

The short answer: WordPress shows, without meaning to, the usernames of those who write on the site: on author pages, in the REST API and even in the login error message. A username is not a password, but it is half of what a bot needs to guess its way in. Hiding these clues is easy and costs nothing.

What the site needs

What What to do
Author pages Opening your-domain.com/?author=1 leads to the author’s page, whose address contains the username. Repeat with 2, 3, 4…
REST API The address /wp-json/wp/v2/users lists authors with posts, including each one’s internal name.
Site map WordPress’s own site map can include a list of users.
Login message When the name does not exist, the notice says so; when the password is wrong, it says something else. That confirms to the bot that it got the name right.
The visible name Each user’s “display name” should differ from the username they log in with.

Getting started

1 Change each user’s display name under Users > Profile: use the real name or a nickname, not the login name.
2 If the administrator logs in as “admin” or with the company name, create another user with a less obvious name and take the powers away from the old one: Changing a username.
3 Switch off author pages if the site has a single author, in the options of an SEO or security plugin.
4 Restrict the REST API user list to people who are logged in (the options of many security plugins include this). Test afterwards: the address should no longer list anyone.
5 Use identical error messages at login (also a common plugin option), and reinforce the entrance: Protecting the WordPress login.
This reduces the clues; it is not the defence. Someone who really wants to find a username can, by other means. The real defence is a strong password, two-step verification and the attempt limit. Hiding the name just takes easy work away from bots. A captcha on the login.
If the site lets people register, the username problem grows: Letting visitors register. Another old door: XML-RPC.

Want help hardening your WordPress login? Open a ticket with the address.

Open a support ticket

SEE ALSO

Protecting the WordPress login: three steps in order of effect

Putting a captcha on the WordPress login

Changing a WordPress username

Letting visitors register on your WordPress site: roles, bots and the risks

XML-RPC in WordPress: what it is and whether to switch it off

RECOMMENDED PRODUCT

WordPress hosting

One-click install, updates handled, and speed that holds up. from $6.59/mo (3-year plan, with coupon)

See plans
  • 0 Users Found This Useful
Was this answer helpful?

Related Articles

How to install WordPress in a few clicks You don't have to download WordPress, create a database and upload files by hand. The installer in cPanel does all of it...
Common WordPress errors: white screen, critical error and how to find the cause The site stopped opening and shows a blank white screen, or the line «There has been a critical error on this website»....
Cannot get into the WordPress dashboard: the six usual causes The site opens, but the admin dashboard does not. Either it asks for the password in an endless loop, or it says the det...
How to remove WordPress from a domain, without leaving anything behind You want WordPress off a domain, because the installation broke, because you are starting over, or because the site is b...
Protecting the WordPress login: three steps in order of effect WordPress’s login address is the same on every site in the world: /wp-admin and /wp-login.php. That means any automated...
Reusable blocks and patterns in WordPress: save a layout once and use it again The short answer: if you repeat the same piece on several pages (a contact block, a notice, a list of benefits), do not...