Can I prevent enumeration of usernames on my wordpress site? I can see users at the moment using the WPScan tool.
A simple solution I use in a
It is similar to @jptsetme’s answer, but it works even when the query string is
The WPScan tool is an automated utility that takes advantage of WordPress' friendly URLs to determine usernames. It will loop through the first 10 possible IDs for authors and check the
WPScan will check
What you can do
First of all, just because someone can guess your username, doesn't mean your site is insecure. And there is really no way you can prevent someone from parsing your site in such a way.
If you are really concerned about this, I would recommend doing two things:
Another alternative is to change your author permalink rewrites. There are several ways you can do this, and you can probably find a few on this site as well.
You can use an .htaccess rewrite rule to prevent this disclosure, but you should also be sure to use nicknames to avoid disclosing usernames in parsable content as described by EAMann.
The following blog describes how to do it but has a typo in the rewrite rule: http://www.question-defense.com/2012/03/20/block-wordpress-user-enumeration-secure-wordpress-against-hacking
The correct rule should also remove the query string from the rewritten URL, or else you'll still disclose the username. It should look like this:
Working well for us.
I wanted to add that you can do this on nginx too. Check:
As a side note, I wanted to prevent username enumeration on my site hosted with WP Engine, which limits users' access to low level nginx config files. They do however, have a "Redirect Rules" section in their control panel which allows you to accomplish this. After some time I managed to figure out the best configuration:
Then you need to show the
Et voila, your usernames are safe[r]!
Not tested this out thoroughly, but I think it's preferable to remove underlying resource rather than try to build walls around it on web server level. So in WP terms that would be stopping it from processing author-related query variables.
PS note that this will kill author archives entirely, which might or might not be appropriate paranoia level :)
I have completely blocked user enumeration from WPScan by adding the following in htaccess
My professional opinion as a penetration tester for a gov't agency... it is ALWAYS worth making it harder to enumerate information about your website. Few of you will have a website that rises above the google, script kiddie hackers. We are talking about layered security and with each layer, you add time and complexity to a penetration attempt. Each layer also adds to the skillset required of the hacker. There are a few really good application firewalls available on WP. Look for those that can block IP addresses that have repeated user login attempts or 404. The idea is for your firewall to automatically block IP's that scan your website for pages that don't exist or attempt to repeatedly sign onto your site. A good feature also includes XSS and SQL Injection blocking capabilities. Consider using, All In One WP Security from Tips and Tricks HQ, Peter, Ruhul, Ivy. It has a decent interface and capability set for the novice and expert alike.
protected by toscho♦ Aug 14 at 22:19
Thank you for your interest in this question.
Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.
Would you like to answer one of these unanswered questions instead?