How WordPress Admin Usernames can be Exploited by Hackers

Unless things have changed since the last time I set up a new self-hosted WordPress site, WordPress used to present you with the username “admin” as the default. Even if they’ve stopped doing this, it was the standard since the inception of WordPress back in 2003. This long-standing practice has contributed to how WordPress admin usernames can be exploited by hackers.

Here’s an interesting fact. According to Kinsta, out of all the websites in existence, WordPress.org powers up just over 40% of them. It powers 65% of all websites built on a content management system. Over 38% of the world’s top websites are on WordPress.org.

Hackers just love the sheer volume of WordPress sites. Do you know what else they love? Users that don’t create a unique username for themselves.

Why Using “Admin” is Unsafe on WordPress

You might be thinking it’s no big deal. You’re nobody. Who’s going to try to hack your site?

Well, if most hacking attempts on your site were made by a single person targeting one site, your lack of concern might—maybe—be justified. However, that’s not what’s really happening. Most attacks come from bots launching brute-force attacks on thousands of sites at once.

As covered in how WordPress admin usernames can be exploited, these bots often rely on common usernames like “admin” and weak passwords like “123456.” Some use dictionary attacks, running through every word in the dictionary to match against your login credentials. So yes, “admin” is a terrible choice—but so is any easily recognizable word. Always jumble your usernames and passwords with letters and numbers.

If you’re using a security plugin that notifies you of blocked login attempts, you’ve probably seen that most of those attempts use “admin” as the username, highlighting the WordPress admin username security risk that makes your site an easy target for hackers.

So, now that we’re clear about not using admin as your username, what kind of measures can you take to secure your site?

WordPress Security Measures

Since I love factoids, here’s another one. According to a cybersecurity report published two years ago, organizations increased their online security budgets by 50%.

What does that tell you? Other than the fact that a lot of people probably didn’t get a raise that year? This shows that none of us — big or small — can afford to be lax about online security. Even if you’re just running a hobby site, you still become a target, which leads us to how WordPress admin usernames can be exploited.

Use a VPN

My first recommendation is to download a VPN. There are some free options available, but with limited functionality. VPN is an acronym that stands for Virtual Private Network and using one is a great step toward securing your site. As long as you access your site via the service, all data flowing in or out is encrypted and your local IP address is hidden. If you’re looking for a good VPN for your needs, check out this article on the best VPN by VPNpro.

Security Plugins

Install a security plugin. You have a choice of a free option here as well, and any number of plugins to choose from. Some plugins are more feature rich than others, and some are more complex and may require more setup, so choose one that works for your specific situation.

Disallow File Editing

Turn off the file editing feature. The WordPress codex recommends taking this step, you can do it by either manually editing a few lines of code in the wp-config.php file or by installing a plugin that will do it for you. If you’re making the change manually, simply add the following to your wp-config.php file:

define(‘DISALLOW_FILE_EDIT’, true);

Hide Sensitive Files

Speaking of your wp-config.php file, you should also hide it along with your .htaccess files. If you don’t know what you’re doing, I don’t recommend manually editing any of the WordPress core files. However, if you feel confident, take a backup of these files before making any changes. Strengthening file security adds another layer of protection—especially important when combined with addressing the WordPress admin username security risk that many attackers exploit.

After you’ve backed up your files, add the following to your wp-config.php file:

<Files wp-config.php>

order allow,deny

deny from all

</Files>

Once you’ve done that, move on to your .htaccess file and add:

<Files .htaccess>

order allow,deny

deny from all

</Files>

Limit Login Attempts

Next, you should consider limiting login attempts to your site. Let’s assume a user has forgotten his password—WordPress will allow endless tries to log in. But that user could actually be a hacker. Once a hacker knows your username, this is how WordPress admin usernames can be exploited, all they need is the password, making unlimited attempts extremely dangerous. By limiting login attempts, you add a critical layer of protection.

You can typically implement this with a plugin. Depending on your settings, you can temporarily block users—helpful for legitimate users who mistype—or permanently block an IP. Of course, hackers often rotate IPs, so it can feel like playing whack-a-mole. Still, limiting login attempts is a crucial defense against brute-force attacks, especially when combined with addressing the WordPress admin username security risk that makes these attacks easier.

You can also do it without a plugin, but since it’s a bit complex, I suggest sticking with the plugin approach.

Conclusion

So there you have it. Start by changing the default username when you set up a WordPress site. If any of your older sites still use the “admin” username, change them right away. “How WordPress Admin Usernames can be Exploited by Hackers” clearly explains how using common usernames puts your site at risk—so follow the steps above to secure it properly.