0

I've got a site in which I developed a self made theme from scratch and with bootstrap. Everything is working nicely but Wordfence report a lot of login attempt from hackers by using the admins username (I'm not using admin as username and I'm not using user ID 1).

How have they descovered the usernames? How can I block them to know the usernames?

I've read that it should not be a great problem because I've used very strong passwords (source wordfence) but I would feel better to have them not knowing the usernames.

Thanks.

Improve this question

1 Answer 1

Reset to default
3

The JSON API will allow for the enumeration of authors (and usernames) for a WordPress site. You can't turn that off.

To protect yourself you should:

Attackers enumerating users and trying to find a way in will always be a thing you have to face. It's a matter of bolstering the strength of your server to keep the attackers at bay.

You can also use tools like the WPScan scanner to see both if your sites have vulnerabilities and exactly how the attackers are enumerating users.

Improve this answer
1
  • Thank you very much for your response. Searching on web I've found this code that should prevent enumeration from software: if (!is_admin()) { // default URL format if (preg_match('/author=([0-9]*)/i', $_SERVER['QUERY_STRING'])) die(); add_filter('redirect_canonical', 'shapeSpace_check_enum', 10, 2); } function shapeSpace_check_enum($redirect, $request) { // permalink URL format if (preg_match('/\?author=([0-9]*)(\/*)/i', $request)) die(); else return $redirect; } You think it can work? In any case thank you very much for your answer.
    – EnricoP
    Commented Oct 28 at 15:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.