1

I use ceber security plugin which protects my site again malicious attacks etc.

I checked today and there were over 20 lock outs. I checked ip addresses and there were no constituencies, they were from all over the world.

The one thing that they had in common was the user name that they entered ie, one of my admin usernames.

I was wondering A) how they got it... im assuming from page updated etc they have some way of finding from inspecting source?

B)how to prevent admin usernames from being public knowledge?

Also is there any way to separate front end from back end so if they do get logged in, they can't access the back end and make changes?

Any help would be amazing :-)

2

Here's an easy way to enumerate user names (using standard WP install): just use a URL like this: https://www.example.com/?user=1 . (Added Note: you might need to use an actual page/post URL, as in https://www.example.com/a-real-page?user=1 .) You'll get back info about that user account (the first user account, which will be the admin-level user), and then you can start brute-forcing access. (In a WP install, the first user created is an admin-level user. So it is likely that the above URL will give you the admin's user name.

And if you use xmlrpc.prg , which allows multiple requests on the same request, you can do it even faster.

Here's how you prevent the user enumeration:

function redirect_to_home_if_author_parameter() {
      $is_author_set = get_query_var( 'author', '' );
      if ( $is_author_set != '' && !is_admin()) {
            wp_redirect( home_url(), 301 );
            exit;
      }
}
add_action( 'template_redirect', 'redirect_to_home_if_author_parameter' );

That will redirect any user enumeration requests (the URL I mentioned) unless you are already logged in as admin.

And, another precaution is to disable xmlrpc.prg. And to not have a user named 'admin' (or if you do, change it to a non-admin level).

Disable xmlrpc.prg (which has lots of opportunities for hacking your site) with this:

add_filter('xmlrpc_enabled', '__return_false');

Place both code fragments in your functions.php (preferably in your Child Theme). Or you can create a simple plugin with the above code.

More about the user enumeration problem in my blog here.

  • Well... To be precise... It's not exactly username. It's a slug/nicename. But yes - very often it's the same as username. – Krzysiek Dróżdż Nov 25 '18 at 9:26
  • Thanks for your answer Rick. I typed in mywebsite.com/?user=1 and got redirected to my homepage. I inspected the element and could not find anything related to my username. would that suggest that your above fix has already been done? I have searched the HTML on different pages and found that in the product pages there are at least 4 references to my username. some appear in code which is imported from external such as the stripe payment gateway. would your fix work for this also? – Paulmcf1987 Nov 25 '18 at 12:05
  • See the added note to my answer. – Rick Hellewell Nov 25 '18 at 19:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.