WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We've had Limit Login Attempts installed for some weeks now, and the number of brute force attempts occurring on wp-admin/wp-login is pretty amazing. At first the attempts were all with the username "Admin," which doesn't exist on our site, so I considered it an annoyance but not much of a threat. However, now we're seeing lockouts occurring with other named admin user accounts and I'm completely at a loss of understanding for how the attackers are deducing the usernames of these accounts.

No content on our site is authored by anyone in particular and I can't find any other location on our site where these usernames are publicly published.

Any idea as to how usernames might be discoverable?

share|improve this question
up vote 9 down vote accepted

If you have pretty permalinks enabled WordPress will redirect all calls to /?author=1 to the author archive with the user name, eg.: /author/bob/. And then the visitor will know the author name.

Use Login Lockdown, that plugin does not reset accounts, it will block IP addresses.

share|improve this answer
"Limit Login Attempts blocks an Internet address from making further attempts after a specified limit on retries is reached... " I am not affiliated with the plugin but do use it and that is exactly what it appears to do. The IP address associated with a failed login is logged and the address is blocked if a configurable maximum attempt limit is reached. Also, "Login Lockdown" hasn't been updated in two years. – s_ha_dum Feb 2 '13 at 1:08

Clever buggers. I think I am just going to redirect requests to /?author=. Sound reasonable? Something like:

add_action( 'template_redirect', 'my_author_redirect' );
function my_author_redirect() {
    if ( is_author() ) {
        wp_redirect( get_bloginfo( 'url' ), 301 );
share|improve this answer
That would be Security by Obscurity. It is better to configure your site so that it doesn't matter if a visitor knows your user name. The LLA plugins is breaking this essential rule; don't go the same way. – toscho Sep 25 '12 at 16:36
@toscho can you elaborate? I don't think the LLA plugin does completely break this rule. It works by initiating an IP lockout after x failed login attempts. It does work even when an attacker knows the user name. What else can be done? Password protect wp-admin...whitelist only certain ip's with .htaccess...make sure all users have strong passwords...? Regardless of any/all of the above, I still like the above redirect option for belt-and-suspenders protection. – user20814 Sep 25 '12 at 17:14
Maybe I remember this wrong. I had the impression that a certain user will be locked out after some failed log-in attempts. – toscho Sep 25 '12 at 18:33
Actually, crap you're right. I misspoke. The lockout is based on user. – user20814 Sep 25 '12 at 20:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.