1

We are about to launch a WordPress site hosted internally. As a standard practice, our IT security team does their check for any vulnerabilities. And sadly, they are able to retrieve the list of WordPress users/accounts.

Is there a way to hide them? I am envisioning this will involve changes to WordPress PHP files.

Improve this question
2
  • How are they getting to the user accounts? Are they touching the database directly? Can they get them through the Wordpress main page?
    – Robert Harvey
    Commented Jul 22, 2014 at 2:37
  • they don't even know the database details. All they have is the URL to the site. They are able to get somehow using their tool. I've done a simple "view page source" and it's not there which is to be expected.
    – mrjayviper
    Commented Jul 22, 2014 at 2:42

2 Answers 2

Reset to default
1

There are lots of previous answers here on WP Dev for that - such as Completely hide user info - and related security (real or imagined) issues.

(Yes, this is a short answer with links, who=ich is frowned upon on Stack Exchange sites.)

See Steps to Take to Hide the Fact a Site is Using WordPress?

and also https://wordpress.stackexchange.com/questions/tagged/security

Improve this answer
0

Why does your IT "team" think user account names are insecure, I can get a pretty massive list of email, Facebook, 'insert service here' account names, does that make those systems insecure?

It doesn't, my user account on WPSE is my name, go to town on it, and tell your IT team to learn about actual security.

Improve this answer
2
  • in all honesty though, I doubt anyone would care if they get access to your WPSE acct.
    – mrjayviper
    Commented Jul 22, 2014 at 4:27
  • 1
    This is besides the point.
    – Wyck
    Commented Jul 22, 2014 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.