This question already has an answer here:

Recently I've had brute force attack attempts on some of my WordPress sites and the attackers are using actual usernames other than the default admin (which was removed).

How is it possible for them to know the usernames in a site's database without administrator privileges? (assuming they didn't get it from me directly using malware)

What are ways to prevent this from happening?

btw: All of my sites use the current version of WordPress.

Thanks for your help!

marked as duplicate by Milo, TheDeadMedic, Howdy_McGee, Robert hue, s_ha_dum Jun 29 '15 at 5:50

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  1. Many themes echo the post author names associated with posts. Those are in some cases the same as the username.
  2. The author archive links, depending on the permalink can reveal the username as well-- /author/admin

Getting the username is fairly trivial. I am sure there are other ways to manage it.

  • 2
    You forgot the user ID. ~99% people keep first user ID 1 as their super Admin. – Robert hue Jun 12 '15 at 18:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.