I am trying to figure out if wordpress exposes the user e-mail or any other user information to crawlers/bots?

I have a couple of security plugins that have been blocking these bots IPs on the third failed login attempt. When I go through the log you can see that some bots are guessing your typical usernames (eg. "admin"). But there are some bots that actually guesses username's e-mail addresses (sometimes without the "@" or without the "." from .com). Which makes me wonder if this information is exposed by wordpress, or if somehow these bots are connecting the dot with other websites to gather this information?

  • How are your users created? If they register themselves via email address, and usernames are created dynamically, then it is possible that the bots are using User Enumeration. User Enumeration is possible by querying the author parameter and cycling through user id's /?author=1 – czerspalace Oct 30 '15 at 18:57
  • Typically users are created in the admin only. No frontend registration form on my sites. – gdaniel Oct 30 '15 at 19:02
  • So the email and usernames are different? And the guesses do not match the usernames, but are pretty similar to the emails? – czerspalace Oct 30 '15 at 19:24
  • I have some guesses matching the usernames (same as e-mails) and some guesses matching usernames have been removed a while ago. I guess they queried my usernames a while ago and have been using a list saved somewhere else. Thanks for your input. It actually makes sense now. – gdaniel Oct 30 '15 at 19:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.