WP User name exposed

**MMM** · 20 March 2015, 6:56 am

Hi,

I noticed that since few days ago, someone trying to access my WP site using my custom User - before the attempts where with the regular admin, site url and such...

I've created a new user and disabled the previous one, but my question is how someone discovered it? (it doesn't appear as the author in posts).

Thank you

**wonderpunter** · 20 March 2015, 7:54 am

YOAST SEO Plugin has a way to hide it, but if you have ever made a post via that user then its easy for someone to find.. The easiest option is to use a Strong password.. When I say stron I mean long, with symbols, characters..

**vardan** · 20 March 2015, 11:27 am

Well, from the wonderpunter's post you already know how it is possible to find the wp user name. Also I guess you know some security plugins existent on the net, so I'll mention only one very usefull tool from "all in one wp security" plugin; Brute Force - Rename Login Page Feature. By this feature you can change the login URL, for example www. xxxx.com/wp-login to www. xxxx.com/choosewhatyouwant.

Regards.

**MMM** · 20 March 2015, 12:08 pm

Is it so easy? even if it's not used as the nick name or as author name?

**Scampi** · 20 March 2015, 12:23 pm

Is it so easy? even if it's not used as the nick name or as author name?

I've had it happen a few times, usually from IPs in Russia, China or the Ukraine.

**vardan** · 20 March 2015, 12:46 pm

Originally Posted by MMM

Is it so easy? even if it's not used as the nick name or as author name?

Yes, it's very easy, even if it's not used as the nick or author name. Try to find my site's login page (it was the doman name + /wp-login.php), it will redirect you to another page of the site.

**allfreechips** · 20 March 2015, 12:59 pm

I think he was saying they had the username of the admin, not the login page location..

If so make sure your login name is not used for any aff accounts / email ext...

**sweetbet** · 20 March 2015, 5:32 pm

I wouldn't even make the wp-login.php file available in order to minimize the number of hack attempts.

**WagerPod** · 20 March 2015, 5:49 pm

You can also rename the WP login page too, I did this for my site but it can still be accessed, just another precaution.

Could they of guessed it? Is it added to your email? it depends how obvious it is.

**sweetbet** · 20 March 2015, 8:19 pm

You can also password protect the /wp-admin/ folder.

**MMM** · 21 March 2015, 12:48 am

Originally Posted by sweetbet

You can also password protect the /wp-admin/ folder.

Yep, considering to do that.

Originally Posted by WagerPod

Could they of guessed it? Is it added to your email? it depends how obvious it is.

no, not obvious at all

Thread: WP User name exposed

LinkBack

Thread Tools

Search Thread

Display

WP User name exposed

The Following User Says Thank You to wonderpunter For This Useful Post:

Posting Permissions