Can I prevent enumeration of usernames on my wordpress site? I can see users at the moment using the WPScan tool.
The WPScan tool is an automated utility that takes advantage of WordPress' friendly URLs to determine usernames. It will loop through the first 10 possible IDs for authors and check the
WPScan will check
What you can do
First of all, just because someone can guess your username, doesn't mean your site is insecure. And there is really no way you can prevent someone from parsing your site in such a way.
If you are really concerned about this, I would recommend doing two things:
Another alternative is to change your author permalink rewrites. There are several ways you can do this, and you can probably find a few on this site as well.
You can use an .htaccess rewrite rule to prevent this disclosure, but you should also be sure to use nicknames to avoid disclosing usernames in parsable content as described by EAMann.
The following blog describes how to do it but has a typo in the rewrite rule: http://www.question-defense.com/2012/03/20/block-wordpress-user-enumeration-secure-wordpress-against-hacking
The correct rule should also remove the query string from the rewritten URL, or else you'll still disclose the username. It should look like this:
Working well for us.
I wanted to add that you can do this on nginx too. Check:
As a side note, I wanted to prevent username enumeration on my site hosted with WP Engine, which limits users' access to low level nginx config files. They do however, have a "Redirect Rules" section in their control panel which allows you to accomplish this. After some time I managed to figure out the best configuration:
Then you need to show the
Et voila, your usernames are safe[r]!