Skip to content

How to fix the exposed "admin" author in WordPress

Security1 min readFixes check wp-admin-author-slug

/?author=1 reveals the first user's login name. Rename the default admin account and disable author enumeration.

Step by step, with screenshots: The "admin" user: renaming it and hiding author archives →

Check your own site

Runs this check and the other 186, free, in about 45 seconds.

What a passing site looks like

  • No default admin author exposedwarning · −1.5 ptseffort S

The default "admin" author is public

Why it matters. /?author=1 redirects to /author/admin/, which confirms a login name called "admin" exists. Brute-force scripts try that name first.

How to fix it.
  1. Create a new administrator with a unique username, log in as it, delete "admin" and attribute its content to the new user.
  2. Optionally disable author archives or the ?author= redirect in your security plugin.

Filed under WordPress & WooCommerce. Copy is generated from the same catalogue that scores every report, so what you read here is what the report says.