Islam, Sufism & the Questions of Our Time

Security, WordPress

Don’t Give Your Admin User Name Away

During the last month, my personal website had 67,068 brute force attacks blocked. A brute force attack is when some hacker is making guesses at your username and password so they can bet access to your site. This is one of the reasons why WordPress tells you NOT to use the default “Admin” for your username. That makes one less thing for the hacker to figure out.

But out of the box, WordPress has the REST API enabled and, unless you turn if off, hackers can easily request a list of user ids from your WordPress site, revealing the Admin user name. How do you tell if your WordPress installation is opening revealing the admin account?

Append “/wp-json/wp/v2/users” to your website address.

IE: www.yoursite.com/wp-json/wp/v2/users.

For example, if a hacker tries going to www.davidriewe.com/wp-json/wp/v2/users they will get

{“code”:”rest_cannot_access”,”message”:”DRA: Only authenticated users can access the REST API.”,”data”:{“status”:401}}

Which is ok, non authenticated users do not need to access the rest API on my website. They shouldn’t be allowed access on your site either.

Blocking REST API

This can be done with a plugin. I used “Disable REST API” by Dave McHale

David Riewe

I’m David Riewe, a writer and Dervish exploring Islam, Sufism, spirituality, religious history, and the place of Muslims in American society. I was raised deeply within Lutheran Christianity, attending a private Lutheran grade school followed by a Roman Catholic high school, and later spent years exploring several branches of Tibetan Buddhism and Eastern Orthodoxy before eventually finding my way to Islam and the Sufi path. That history left me deeply interested in how religions develop, how people interpret scripture and tradition, and how belief gets tangled up with culture and politics. I write about Islamic thought, contemplative practice, religious history, and the misinformation and fearmongering that often surround Muslims in America.

Affiliate Disclosure

Some links on this website may be affiliate links. This means I may earn a small commission if you make a purchase through one of those links, at no additional cost to you. I only link to products, books, services, or resources that I believe may be useful or relevant to readers. Any opinions expressed on this site are my own, and compensation does not determine what I choose to recommend or write about.

As an Amazon Associate I earn from qualifying purchases.