How to fix the exposed "admin" author in WordPress

Security1 min readFixes 2 checks wp-admin-author-slug, wp-user-enumeration

/?author=1 reveals the first user's login name. Rename the default admin account and disable author enumeration.

Step by step, with screenshots: xmlrpc.php in WordPress: what it is, how it is attacked and how to disable it safely →

Check your own site

Runs these 2 checks and the other 191, free, in about 45 seconds.

Or run only this check with the free WordPress health check.

What it is

WordPress user enumeration is the way anyone can find the login names of a site's users, for example by opening /?author=1, which redirects to /author/admin/ if the first user is called admin. The REST API at /wp-json/wp/v2/users can list authors too.

WordPress does not treat usernames as secret, but a public account named "admin" is exactly what brute-force scripts try first, so they only have to guess the password. It is the default name on many older installs and one-click installers.

OK looks like this: no administrator account is named admin, author archives show a display name rather than the login, and your security plugin limits login attempts. getReport follows /?author=1 and warns when it reveals an admin author.

What a passing site looks like

No default admin author exposedwarning · −1.5 ptseffort S
The site does not list its userswarning · −1 ptseffort S

1. The default "admin" author is public

Why it matters. /?author=1 redirects to /author/admin/, which confirms a login name called "admin" exists. Brute-force scripts try that name first.

How to fix it.

Create a new administrator with a unique username, log in as it, delete "admin" and attribute its content to the new user.
Optionally disable author archives or the ?author= redirect in your security plugin.

2. The site lists its users to anyone

Why it matters. WordPress's REST API lists every user who has published a post, with the login-style slug. That hands password-guessing scripts half of what they need.

How to fix it.

Restrict the users endpoint to logged-in users with your security plugin's REST API setting, or a small snippet that removes the /wp/v2/users routes for visitors.
Set a display name different from the login under Users → Profile, so the public name is not the username.

In a report the technical detail reads: /wp-json/wp/v2/users answers a list of users. The names are shown only to the verified owner.

Questions people ask

What is WordPress user enumeration?

It is any method of listing a WordPress site's usernames from outside, most often by requesting /?author=1, 2, 3 and reading the author archive URL, or by querying the REST API's users endpoint. Attackers use the names to focus password-guessing attacks on real accounts.

How do you stop user enumeration in WordPress?

Use a security plugin that blocks ?author= scans and restricts the REST API users endpoint to logged-in users; most well-known security plugins have both options. Also make sure no login is called admin, and set a display name different from the login under Users → Profile.

How do you change the WordPress admin username?

WordPress does not let you edit a username directly. Create a new administrator with a unique username, log out, log in as the new user, then delete the old admin account and choose to attribute all its content to the new user. Update any stored passwords afterwards.

Is user enumeration a vulnerability in WordPress?

WordPress considers usernames public information, so it is not treated as a security bug. It still helps attackers by removing half of the guesswork from a login attack. Combine a non-obvious username with strong passwords, two-factor authentication and login rate limiting.