Can I Prevent Enumeration of Usernames?

Question

Can I prevent enumeration of usernames on my wordpress site? I can see users at the moment using the WPScan tool.

Answer 1

You can't.

The WPScan tool is an automated utility that takes advantage of WordPress' friendly URLs to determine usernames. It will loop through the first 10 possible IDs for authors and check the Location header on the HTTP response to find a username.

Using http://mysite.url for example ...

WPScan will check http://mysite.url/?author=1. If your site is using pretty permalinks, it will return a 301 redirect with a Location header of http://mysite.url/author/username. If your site isn't using pretty permalinks, it will return a status of 200 (OK) instead, so WPScan will check the feed for the string "posts by username" and extract the username.

What you can do

First of all, just because someone can guess your username, doesn't mean your site is insecure. And there is really no way you can prevent someone from parsing your site in such a way.

However ...

If you are really concerned about this, I would recommend doing two things:

1. Turn off pretty permalinks. This will force WPScan and similar tools to parse the content of your site for usernames rather than relying on the URL.
2. Force users to set a different nickname. In the absence of a username in the URL, scanning tools will search for "posts by username" in the feed/post content instead. If you aren't putting usernames out there, then they can't be nabbed.

Another alternative is to change your author permalink rewrites. There are several ways you can do this, and you can probably find a few on this site as well.

Answer 2

You can use an .htaccess rewrite rule to prevent this disclosure, but you should also be sure to use nicknames to avoid disclosing usernames in parsable content as described by EAMann.

The following blog describes how to do it but has a typo in the rewrite rule: http://www.question-defense.com/2012/03/20/block-wordpress-user-enumeration-secure-wordpress-against-hacking

The correct rule should also remove the query string from the rewritten URL, or else you'll still disclose the username. It should look like this:

# Stop wordpress username enumeration vulnerability
RewriteCond %{REQUEST_URI}  ^/$
RewriteCond %{QUERY_STRING} ^/?author=([0-9]*)
RewriteRule ^(.*)$ http://yoursite.com/somepage/? [L,R=301]

Working well for us.