How WordPress Exposes Your Admin Username & How to Fix It!
Home | What’s New | Start Here | Contact
Create a Website Blog
I received an alarming DM from one of my e-buddies, Darren of Small Biz Geek. This is what he said:
Say whaaaaaaaaat?
Now, I’m aware of the common practices like never using "admin" as your username and being mindful of nickname issues. But I had already changed my nickname, so I wasn’t aware of other vulnerabilities.
Well, there’s another one, and it’s a biggy!
Darren figured out the login username for my new site without any fancy hacking—he simply hovered over a link in my author byline. You might be facing the same issue on your WordPress site, but there’s an easy fix.
If you have "By [Name]" in your byline (usually displayed under your WordPress title), it could expose your admin username. For example:
Hover over that name in your byline. (Not all themes show the byline.) You will notice it goes to
http://yoursite.com/author/[name]
Whatever you see in "[name]" is your login username.
It’s crazy that WordPress hasn’t addressed this yet! This is another security vulnerability on top of existing issues. Since many users log in using their Admin accounts, this poses a serious risk. You’re essentially telling hackers your WordPress admin login username right there. They can easily run scripts to guess your password. And if it’s simple, they’ll crack it in no time.
Hackers use automated scripts that try different combinations at a rate of millions per second. So even though the process seems tedious, it happens incredibly fast. Using "admin" as a username and a simple password makes your site incredibly vulnerable.
Here’s how to hide your username in the byline:
This might seem daunting, but it’s easy and should take only 3-5 minutes. Darren created a video explaining this process and providing step-by-step instructions below. Always backup your database before making changes!
Text Instructions:
- Login to your cpanel or hosting account control panel.
- Navigate to PHPMyAdmin (or whatever database software your host uses). It might be listed as "Databases."
- You’ll see your WordPress database(s) and any others you’ve created.
Continue reading for the rest of the instructions…