Forums

Semi-Critical Security Improvement Suggestion/Help (1 post)

  1. andrewmta
    Member
    Posted 4 years ago #

    I've recently setup a WordPress install with multiple authors. I created user accounts for all of my authors and made them more complex then a simple username, I used "mTAndrew916" for example instead of "Andrew".

    The idea was to make strong usernames AND strong passwords to add another layer of security and protect my wp-admin page from successful brute force login attempts.

    Users created a much simpler nickname for themselves and used that to tag their posts instead of their username. The problem is that it seems that by default, the Author Archive url inserts the users actual username instead of the nickname they're using.

    ie.

    http://www.website.com/blog/index.php/author/mTAndrew916/

    Instead of the much safer:

    http://www.website.com/blog/index.php/author/Andrew/

    I understand why, there could be more than one user with the nickname Andrew and usernames are used because they're unique. However, wouldn't using the user's ID number instead be safer? ie:

    http://www.website.com/blog/index.php/author/6/

    Is there a way to do this under the current 2.3.2? Is this something we can add by default or as an option?

    As it is now WordPress is giving away a vital piece of login information that doesn't have to be revealed.

Topic Closed

This topic has been closed to new replies.

About this Topic

Tags

No tags yet.