I have noticed a lot of XML-RPC authentication failures to my blog site. This can be normal and idiots attempting to crack a wordpress site but what is worrying is that the username being shown in the log is actually my admin username (I'm not using admin and I actually have a username that no one should be able to guess).

What's going on?

1 Answer 1


user names in wordpress in general are not considered as being a secret and there are all kinds of ways to get or guess them. Passwords are a secret, always use a strong one

  • Really ? So if my administrative username was let's say unguessableadmin then someone can find that out just like that ?
    – Junaid
    Oct 19, 2016 at 9:33
  • this is security 201. user names are for authorization, password for authentication. your user name is easy to guess based on the DB stolen from yahoo and other DBs from which a statistical analysis can give common user names, or when someone shoulder surfing you when you login to the site. The guesses can be checked by the responses you get from wordpress when trying and failing to login, or maybe there is some other information on your side that expose it. Only password is an actual secret that no one else should know and be able to guess Oct 19, 2016 at 10:35
  • ..... or in other words you should always assume that your user name is known. and wordpress do not believe in hiding them. Oct 19, 2016 at 10:41
  • Alright thanks for the helpful answer. I think it might have been an update to Wordpress as i have noticed it comes up with a message to say update your database. Even though I am not sure if at that stage it does actually show the username. Thanks once again.
    – Junaid
    Oct 19, 2016 at 11:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.