We are about to launch a WordPress site hosted internally. As a standard practice, our IT security team does their check for any vulnerabilities. And sadly, they are able to retrieve the list of WordPress users/accounts.

Is there a way to hide them? I am envisioning this will involve changes to WordPress PHP files.

  • How are they getting to the user accounts? Are they touching the database directly? Can they get them through the Wordpress main page? – Robert Harvey Jul 22 '14 at 2:37
  • they don't even know the database details. All they have is the URL to the site. They are able to get somehow using their tool. I've done a simple "view page source" and it's not there which is to be expected. – mrjayviper Jul 22 '14 at 2:42

There are lots of previous answers here on WP Dev for that - such as Completely hide user info - and related security (real or imagined) issues.

(Yes, this is a short answer with links, who=ich is frowned upon on Stack Exchange sites.)

See Steps to Take to Hide the Fact a Site is Using WordPress?

and also https://wordpress.stackexchange.com/questions/tagged/security

| improve this answer | |

Why does your IT "team" think user account names are insecure, I can get a pretty massive list of email, Facebook, 'insert service here' account names, does that make those systems insecure?

It doesn't, my user account on WPSE is my name, go to town on it, and tell your IT team to learn about actual security.

| improve this answer | |
  • in all honesty though, I doubt anyone would care if they get access to your WPSE acct. – mrjayviper Jul 22 '14 at 4:27
  • This is besides the point. – Wyck Jul 22 '14 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.