Title: sftp username in source code
Last modified: December 27, 2017

---

# sftp username in source code

 *  [cschultzie3](https://wordpress.org/support/users/cschultzie3/)
 * (@cschultzie3)
 * [8 years, 4 months ago](https://wordpress.org/support/topic/sftp-username-in-source-code/)
 * Was looking at the source code of a page I have on a website i’m starting, and
   it appears my sftp username is in the login parameter of this bit of code
    /*
   <![CDATA[ */ var walkMeUserData
 * That can’t be good, right? how do I fix that?

Viewing 11 replies - 1 through 11 (of 11 total)

 *  Moderator [Steven Stern (sterndata)](https://wordpress.org/support/users/sterndata/)
 * (@sterndata)
 * Volunteer Forum Moderator
 * [8 years, 4 months ago](https://wordpress.org/support/topic/sftp-username-in-source-code/#post-9813878)
 * Is it part of a file path?
 *  Thread Starter [cschultzie3](https://wordpress.org/support/users/cschultzie3/)
 * (@cschultzie3)
 * [8 years, 4 months ago](https://wordpress.org/support/topic/sftp-username-in-source-code/#post-9816405)
 * No, at least I don’t think so. I saw it when I viewed the source code of a page.
   in the code, after the var walkMeUserData part a little bit in it has login=MyLoginNameForSFTP
 *  Moderator [Steven Stern (sterndata)](https://wordpress.org/support/users/sterndata/)
 * (@sterndata)
 * Volunteer Forum Moderator
 * [8 years, 4 months ago](https://wordpress.org/support/topic/sftp-username-in-source-code/#post-9816506)
 * Install plugins, install “Health Check”: [https://wordpress.org/plugins/health-check/](https://wordpress.org/plugins/health-check/)
   On the troubleshooting tab, you can click the button to disable all plugins and
   change the theme for you, while you’re still logged in, **without affecting normal
   visitors to your site**.
 * If the line(s) go away, turn on the plugins one at a time until you identify 
   the source.
 *  Thread Starter [cschultzie3](https://wordpress.org/support/users/cschultzie3/)
 * (@cschultzie3)
 * [8 years, 4 months ago](https://wordpress.org/support/topic/sftp-username-in-source-code/#post-9817715)
 * Thanks [@sterndata](https://wordpress.org/support/users/sterndata/) I will give
   that a try today and post back what I discovered. really appreciate the help 
   on this.
 * Maybe this will also help me in regards to figuring out what plugins I actually
   need and don’t need. it appears my hosting service took the liberty of adding
   a bunch in or maybe one of the themes I tried did, I know i didn’t manually install
   them. but I’d like to get rid of the ones that won’t break the website, just 
   not sure how to tell.
 *  Thread Starter [cschultzie3](https://wordpress.org/support/users/cschultzie3/)
 * (@cschultzie3)
 * [8 years, 4 months ago](https://wordpress.org/support/topic/sftp-username-in-source-code/#post-9817804)
 * [@sterndata](https://wordpress.org/support/users/sterndata/)
 * well I went through and disabled all the plugins except the ones “required” by
   my theme and the couple I know I’m actually using, so I guess it must be one 
   of them.
 * Also something I didn’t notice before, is before that WalkMeUserData part where
   in it it has my login username for SFTP, I has this line, can only assume they
   are related but not sure if it’s due to my hosting service and how they do DNS
   or something the theme did, as obviously I have no idea who walkme is haha. Maybe
   this will make more sense to you than me so wanted to include it.
    <link rel=”
   dns-prefetch” href=”//cdn.walkme.com” />
 *  Moderator [Steven Stern (sterndata)](https://wordpress.org/support/users/sterndata/)
 * (@sterndata)
 * Volunteer Forum Moderator
 * [8 years, 4 months ago](https://wordpress.org/support/topic/sftp-username-in-source-code/#post-9817912)
 * That sounds like you’re using a CDN — something provided by your host or a plugin.
 *  Thread Starter [cschultzie3](https://wordpress.org/support/users/cschultzie3/)
 * (@cschultzie3)
 * [8 years, 4 months ago](https://wordpress.org/support/topic/sftp-username-in-source-code/#post-9818364)
 * I’m not sure which is providing it, but I guess at least it’s starting to make
   more sense now. Knowing that though, is there a way to kill the login from the
   source code or mask it or something, seems like a real big security hole just
   having a login name in plain text in the source code, isn’t it?
 *  Moderator [Steven Stern (sterndata)](https://wordpress.org/support/users/sterndata/)
 * (@sterndata)
 * Volunteer Forum Moderator
 * [8 years, 4 months ago](https://wordpress.org/support/topic/sftp-username-in-source-code/#post-9818372)
 * If you have a solid password, it’s not a security risk.
 * If you want it gone, you’re going to have to track down which plugin adds it.
   Use the health check plugin for that as it lets you mess with plugins without
   affecting other users.
 *  Thread Starter [cschultzie3](https://wordpress.org/support/users/cschultzie3/)
 * (@cschultzie3)
 * [8 years, 4 months ago](https://wordpress.org/support/topic/sftp-username-in-source-code/#post-9818781)
 * OK, I guess as long as the password is good it’s not a security risk. Is there
   a way to auto block people who try to login with my password so they can’t keep
   trying and brute force it?
 * So basically I just disable a plugin, see if that code disappears, then activate
   it again, then keep doing that till i see that bit of code disappear right? What
   happens if I disable all of them and it’s still there, does that mean it’s my
   hosting service injecting it into code or does it not work that way?
 *  Moderator [Steven Stern (sterndata)](https://wordpress.org/support/users/sterndata/)
 * (@sterndata)
 * Volunteer Forum Moderator
 * [8 years, 4 months ago](https://wordpress.org/support/topic/sftp-username-in-source-code/#post-9818792)
 * SFTP is outside of WordPress.
 * > What happens if I disable all of them and it’s still there
 * Yes, it means it’s from your hosting, maybe, probably. I just checked all of 
   my sites and don’t see anything related to SFTP in the source.
 *  Thread Starter [cschultzie3](https://wordpress.org/support/users/cschultzie3/)
 * (@cschultzie3)
 * [8 years, 4 months ago](https://wordpress.org/support/topic/sftp-username-in-source-code/#post-9818799)
 * Alright, well I’ll try disabling the couple “required” for my theme ones and 
   see if that makes it disappear. Thanks for all the help, and hanging in there
   with me with what were probably a lot of stupid questions. I’m not even sure 
   why if that’s my SFTP name why it would be used with CDN but maybe I have to 
   do more reading on how that all works.

Viewing 11 replies - 1 through 11 (of 11 total)

The topic ‘sftp username in source code’ is closed to new replies.

## Tags

 * [sftp](https://wordpress.org/support/topic-tag/sftp/)

 * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
 * 11 replies
 * 2 participants
 * Last reply from: [cschultzie3](https://wordpress.org/support/users/cschultzie3/)
 * Last activity: [8 years, 4 months ago](https://wordpress.org/support/topic/sftp-username-in-source-code/#post-9818799)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics