Title: WordPress Security
Last modified: December 14, 2021

---

# WordPress Security

 *  [flamec](https://wordpress.org/support/users/flamec/)
 * (@flamec)
 * [4 years, 8 months ago](https://wordpress.org/support/topic/wordpress-security-16/)
 * Hi there,
 * I would like to know how to improve wordpress security.
 * 1) I am at the lost password password, I could just enumerate the username and
   it shows that the username doesn’t exist. Is there a way to show “If the username
   is correct” we will send you an email? Owasp mention this is a vulnerabilities.
   `
   https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/
   03-Identity_Management_Testing/04-Testing_for_Account_Enumeration_and_Guessable_User_Account`
 * 2) How do I disable xmlrpc.php
    3) And disable the following /wp-json/wp/v2/users”
   4) What are some of the most common wordpress security flaws?
    -  This topic was modified 4 years, 8 months ago by [Jan Dembowski](https://wordpress.org/support/users/jdembowski/).
    -  This topic was modified 4 years, 8 months ago by [Jan Dembowski](https://wordpress.org/support/users/jdembowski/).
      Reason: Moved to Fixing WordPress, this is not an Everything else WordPress
      topic

Viewing 3 replies - 1 through 3 (of 3 total)

 *  Moderator [Steven Stern (sterndata)](https://wordpress.org/support/users/sterndata/)
 * (@sterndata)
 * Volunteer Forum Moderator
 * [4 years, 8 months ago](https://wordpress.org/support/topic/wordpress-security-16/#post-15162518)
 * The plugin Wordfence will let you do (2) and (3) and is a long way to protecting
   your site. There’s also an option that lets you block most user enumerations.
 *  Moderator [Jan Dembowski](https://wordpress.org/support/users/jdembowski/)
 * (@jdembowski)
 * Forum Moderator and Brute Squad
 * [4 years, 8 months ago](https://wordpress.org/support/topic/wordpress-security-16/#post-15162526)
 * Moved to Fixing WordPress, this is not an Everything else WordPress topic.
 * > I would like to know how to improve wordpress security.
 * That’s good. Start by giving this a good read and implementing those.
 * [https://wordpress.org/support/article/hardening-wordpress/](https://wordpress.org/support/article/hardening-wordpress/)
 * > I could just enumerate the username and it shows that the username doesn’t 
   > exist.
 * So what? Usernames are the part you can never keep from being known. It’s pointless
   to even try. Almost all systems will accept your email address as well as your
   user ID and you give out your email address everyday.
 * If you are concerned then use strong passwords like these.
 *     ```
       yfk8AJZ.gze7tpe*rmp
       nqm2qed_ytf0UEG7vme
       zxp!xtj1wxd2ZAY6axa
       ```
   
 * Don’t actually use those but you get the idea. WordPress supports up to 4096 
   character long passwords.
 * Or implement 2FA via hardware tokens or a time based generated password.
 * [https://wordpress.org/plugins/search/two+factor/](https://wordpress.org/plugins/search/two+factor/)
 * I personally use this. It works with Yubikey and time generated passwords.
 * [https://wordpress.org/plugins/two-factor/](https://wordpress.org/plugins/two-factor/)
 * > 2) How do I disable xmlrpc.php
 * Try one of these.
 * [https://wordpress.org/plugins/search/disable+xmlrpc/](https://wordpress.org/plugins/search/disable+xmlrpc/)
 * > 3) And disable the following /wp-json/wp/v2/users”
 * Try this one. I have a feeling there’s an option now in core WordPress but this
   looks like it will do it.
 * [https://wordpress.org/plugins/disable-json-api/](https://wordpress.org/plugins/disable-json-api/)
 * > 4) What are some of the most common wordpress security flaws?
 * Users who use weak `Password123` passwords and do not maintain both their WordPress
   code, plugins and themes and run on web hosts who do not maintain the OS code
   and packages outside of WordPress.
 * The best maintained WordPress installation on a shared server is only as secure
   as the host and the other people running insecure code on the same server.
    -  This reply was modified 4 years, 8 months ago by [Jan Dembowski](https://wordpress.org/support/users/jdembowski/).
      Reason: Grammar and word fix
 *  [Alan Fuller](https://wordpress.org/support/users/alanfuller/)
 * (@alanfuller)
 * [4 years, 8 months ago](https://wordpress.org/support/topic/wordpress-security-16/#post-15163694)
 * Other plugins exist too that deal with user enumeration
 * [https://en-gb.wordpress.org/plugins/search/user+enumeration/](https://en-gb.wordpress.org/plugins/search/user+enumeration/)

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘WordPress Security’ is closed to new replies.

 * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
 * 3 replies
 * 4 participants
 * Last reply from: [Alan Fuller](https://wordpress.org/support/users/alanfuller/)
 * Last activity: [4 years, 8 months ago](https://wordpress.org/support/topic/wordpress-security-16/#post-15163694)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics