0

Recently I've had brute force attack attempts on some of my WordPress sites and the attackers are using actual usernames other than the default admin (which was removed).

How is it possible for them to know the usernames in a site's database without administrator privileges? (assuming they didn't get it from me directly using malware)

What are ways to prevent this from happening?

btw: All of my sites use the current version of WordPress.

Thanks for your help!

Improve this question
0

1 Answer 1

Reset to default
0
  1. Many themes echo the post author names associated with posts. Those are in some cases the same as the username.
  2. The author archive links, depending on the permalink can reveal the username as well-- /author/admin

Getting the username is fairly trivial. I am sure there are other ways to manage it.

Improve this answer
1
  • 2
    You forgot the user ID. ~99% people keep first user ID 1 as their super Admin.
    – Robert hue
    Commented Jun 12, 2015 at 18:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.