By default, WordPress exposes author archives using URLs such as:
https://example.com/author/john-doe/
This means that usernames associated with published content can become publicly visible.
While this alone is not a security vulnerability, it does provide attackers with information about valid user accounts on the website.
A Simple Approach
Instead of publishing content using an Administrator account, create a separate account with the Contributor role.
The workflow becomes:
- Contributor creates the content.
- Contributor submits the content for review.
- Administrator reviews and publishes the content.
- Administrator does not create or publish posts directly.
As a result, publicly visible author information belongs to a low-privilege account rather than a highly privileged Administrator account.
Why This Helps
If an attacker discovers a Contributor username, the potential impact is limited because the account has very restricted permissions.
A Contributor cannot:
- Install plugins
- Modify themes
- Manage users
- Change site settings
- Publish content
The Administrator account remains dedicated to site management and is less likely to be exposed through public content.
Additional Benefit: Principle of Least Privilege
This approach also follows a well-known security principle called “least privilege.”
Each account should have only the permissions required to perform its job.
- Contributors create content.
- Editors or Administrators review content.
- Administrators manage the website.
Separating responsibilities in this way reduces the impact of a compromised account and creates a cleaner content publishing workflow.
Final Thoughts
This technique should not be viewed as a complete solution to username enumeration. Usernames may still be exposed through other parts of WordPress, plugins, or APIs.
However, keeping Administrator accounts away from public-facing content is a simple practice that can reduce unnecessary exposure of highly privileged accounts while encouraging a more secure publishing workflow.