Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Can I prevent enumeration of usernames on my wordpress site? I can see users at the moment using the WPScan tool.

share|improve this question
    
I created a plugin to fill this hole find it on Wordpress Plugins here: wordpress.org/plugins/stop-user-enumeration –  user2412827 Aug 20 '13 at 9:32
    
The answer you selected is either outdated or no longer holds true. You might consider selecting another answer which corresponds to your setup (Apache or nginx). –  cfx Nov 3 '13 at 22:31
add comment

5 Answers

up vote 5 down vote accepted

A simple solution I use in a .htaccess:

RewriteCond %{QUERY_STRING} author=\d
RewriteRule ^ /? [L,R=301]

It is similar to @jptsetme’s answer, but it works even when the query string is /?dummy&author=5, and the search pattern for RewriteRule is very fast.

share|improve this answer
add comment

Not tested this out thoroughly, but I think it's preferable to remove underlying resource rather than try to build walls around it on web server level. So in WP terms that would be stopping it from processing author-related query variables.

if ( ! is_admin() ) {
    add_filter(
        'query_vars',
        function ( $public_query_vars ) {

            foreach ( array( 'author', 'author_name' ) as $var ) {
                $key = array_search( $var, $public_query_vars );
                if ( false !== $key ) {
                    unset( $public_query_vars[$key] );
                }
            }

            return $public_query_vars;
        }
    );
}

PS note that this will kill author archives entirely, which might or might not be appropriate paranoia level :)

share|improve this answer
add comment

I wanted to add that you can do this on nginx too. Check:
» Blocking WordPress User Enumeration on nginx - www.edwidget.name

As a side note, I wanted to prevent username enumeration on my site hosted with WP Engine, which limits users' access to low level nginx config files. They do however, have a "Redirect Rules" section in their control panel which allows you to accomplish this. After some time I managed to figure out the best configuration:

Redirect Name: // choose a description for the rewrite
Domain: // you *must* select a domain; "All Domains" will *not* work here!
Source: ^/$
Destination: /?

Then you need to show the Advanced Settings panel...

Match args: author=([0-9]*)
Rewrite type: 301 Permanent

Et voila, your usernames are safe[r]!

share|improve this answer
add comment

You can use an .htaccess rewrite rule to prevent this disclosure, but you should also be sure to use nicknames to avoid disclosing usernames in parsable content as described by EAMann.

The following blog describes how to do it but has a typo in the rewrite rule: http://www.question-defense.com/2012/03/20/block-wordpress-user-enumeration-secure-wordpress-against-hacking

The correct rule should also remove the query string from the rewritten URL, or else you'll still disclose the username. It should look like this:

# Stop wordpress username enumeration vulnerability
RewriteCond %{REQUEST_URI}  ^/$
RewriteCond %{QUERY_STRING} ^/?author=([0-9]*)
RewriteRule ^(.*)$ http://yoursite.com/somepage/? [L,R=301]

Working well for us.

share|improve this answer
1  
Works very well for me, thank you! –  cfx Nov 3 '13 at 16:06
add comment

You can't.

The WPScan tool is an automated utility that takes advantage of WordPress' friendly URLs to determine usernames. It will loop through the first 10 possible IDs for authors and check the Location header on the HTTP response to find a username.

Using http://mysite.url for example ...

WPScan will check http://mysite.url/?author=1. If your site is using pretty permalinks, it will return a 301 redirect with a Location header of http://mysite.url/author/username. If your site isn't using pretty permalinks, it will return a status of 200 (OK) instead, so WPScan will check the feed for the string "posts by username" and extract the username.

What you can do

First of all, just because someone can guess your username, doesn't mean your site is insecure. And there is really no way you can prevent someone from parsing your site in such a way.

However ...

If you are really concerned about this, I would recommend doing two things:

  1. Turn off pretty permalinks. This will force WPScan and similar tools to parse the content of your site for usernames rather than relying on the URL.
  2. Force users to set a different nickname. In the absence of a username in the URL, scanning tools will search for "posts by username" in the feed/post content instead. If you aren't putting usernames out there, then they can't be nabbed.

Another alternative is to change your author permalink rewrites. There are several ways you can do this, and you can probably find a few on this site as well.

share|improve this answer
    
Excellent explanation thanks! –  drtanz Mar 22 '12 at 15:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.