Usernames visible

Why it matters

With the username known, an intruder only has to guess the password. With a weak or reused password that is quick. It is one of the first things bots try on a WordPress site.

How Snaglist checks it

This is part of the security check, a separate check next to the crawl, in Studio and Bureau, and only on a site you have verified. Snaglist only looks at what any visitor can see from outside. It never logs in, guesses no passwords and sends no attacks. It asks the public user list of the WordPress REST API and the address ?author=1, the way any visitor can. Found names are shown partly masked.

Common causes

• WordPress opens the user list in the REST API by default
• Author pages that show the login name in the address
• No security plugin that closes this

How to fix it

1. Close the user list in the REST API with a security plugin or a line in the theme.
2. Redirect ?author= to the homepage.
3. Switch on two-step verification for every administrator.
4. Run the security check again to confirm.

How it shows in the report

In the report for your client this appears under the heading "Anyone can see which names are used to log in". When everything is in order, the report says: "The site does not reveal usernames".