Can I prevent enumeration of usernames on my wordpress site? I can see users at the moment using the WPScan tool.
A simple solution I use in a
It is similar to @jptsetme’s answer, but it works even when the query string is
The WPScan tool is an automated utility that takes advantage of WordPress' friendly URLs to determine usernames. It will loop through the first 10 possible IDs for authors and check the
WPScan will check
What you can do
First of all, just because someone can guess your username, doesn't mean your site is insecure. And there is really no way you can prevent someone from parsing your site in such a way.
If you are really concerned about this, I would recommend doing two things:
Another alternative is to change your author permalink rewrites. There are several ways you can do this, and you can probably find a few on this site as well.
You can use an .htaccess rewrite rule to prevent this disclosure, but you should also be sure to use nicknames to avoid disclosing usernames in parsable content as described by EAMann.
The following blog describes how to do it but has a typo in the rewrite rule: http://www.question-defense.com/2012/03/20/block-wordpress-user-enumeration-secure-wordpress-against-hacking
The correct rule should also remove the query string from the rewritten URL, or else you'll still disclose the username. It should look like this:
Working well for us.
I wanted to add that you can do this on nginx too. Check:
As a side note, I wanted to prevent username enumeration on my site hosted with WP Engine, which limits users' access to low level nginx config files. They do however, have a "Redirect Rules" section in their control panel which allows you to accomplish this. After some time I managed to figure out the best configuration:
Then you need to show the
Et voila, your usernames are safe[r]!
Not tested this out thoroughly, but I think it's preferable to remove underlying resource rather than try to build walls around it on web server level. So in WP terms that would be stopping it from processing author-related query variables.
PS note that this will kill author archives entirely, which might or might not be appropriate paranoia level :)