Join Jeff Starr for an in-depth discussion in this video Stop user enumeration, part of WordPress: Developing Secure Sites .
- [Narrator] User enumeration refers…to a technique that enables an attacker…to get the usernames that are registered at your site.…Once an attacker identifies a username,…they can use it to focus a brute force attack…against your login page and try to gain access…to the admin area.…This video shows you a quick way to prevent this…by disabling user enumeration on your site.…To see an example of how user enumeration works…let's visit the home page of our demo site.…In the address bar we can enter /?author=1…When this URL is requested, WordPress displays…the associated author archive page,…which displays all posts from the author…whose ID is one.…
This is how an attacker can get your username.…It shows right here in the address bar…and also in some themes right here…in the archive page itself.…Returning to the admin area,…we can check out the user profile screen…which shows that the display name is WordPress User.…This is the same name that we just…saw displayed on the author archive page…and this is the administrator's login username,…
- Backing up and restoring your site
- Setting up strong passwords
- Understanding users and roles
- Choosing trusted plugins and themes
- Changing and recovering passwords
- Configuring authentication keys
- Securing the login page
- Fighting spam in the comments
- Blocking access and detecting hacks
- Building a firewall for WordPress
- Detecting and blocking bots
- Auditing your WordPress security
Skill Level Intermediate
1. Getting Started
2. Security Essentials
3. Hardening WordPress
4. Improving Security with Plugins
5. Advanced Tips and Tricks
6. Applying Best Practices
Next steps2m 9s
- Mark as unwatched
- Mark all as unwatched
Are you sure you want to mark all the videos in this course as unwatched?
Take notes with your new membership!
Type in the entry box, then click Enter to save your note.
1:30Press on any video thumbnail to jump immediately to the timecode shown.