A login has two halves: username and password. Everyone protects the password. But on most WordPress sites, the username half is simply public, and attackers harvest it before they start guessing.

The two classic leaks

  • Author archives. Visiting yourdomain.com/?author=1 redirects to something like /author/johnsmith/. That last part is a real login username. Counting upward through ?author=2, ?author=3 lists every account on the site.
  • The REST API. yourdomain.com/wp-json/wp/v2/users returns a machine-readable list of users on many sites, no login required. It exists so themes can show author info, but by default it hands out the full roster.

Why it matters

With a confirmed username, a brute force attack becomes twice as easy: the attacker only guesses one half. Combine that with xmlrpc.php amplification and a leaked-password list from some unrelated breach, and quiet, targeted login attempts start within minutes of your site being indexed. This is not a theoretical risk; it is the standard playbook of automated WordPress attacks.

How to close it

  • Block the /wp-json/wp/v2/users endpoint for anonymous visitors. A small PHP snippet (via the Code Snippets plugin) or an edge WAF rule both work.
  • Stop author-id redirects, or make author archives not reveal the login name. Several hardening snippets do this in a few lines.
  • Never use admin as a username, and make your display name different from your login name so posts do not print it.
  • Whatever else you do, enable two-factor authentication for administrator accounts. Even a known username plus a correct password then fails.

Check your site in one minute

Open /?author=1 and /wp-json/wp/v2/users on your own domain and see what comes back. Or run a free AuditMerlin scan: it performs exactly these public checks, flags what leaks, and shows the fix for each finding.