In response to my post about brute force attacks against the admin username in WordPress yesterday many users have contacted me asking how to remove the admin user from their installations. In this video I demonstrate how to remove the user completely and attribute all its posts with a new administrator account.
Step by Step
Log in as admin
Change email address
Create new administrator account
Log out and log in as new administrator
Delete admin account
Associate all admin account posts with new administrator
Even in version 3.6 "admin" is still the default username in WordPress
UPDATE: Chris Rudzki filed ticket #24078 in Track on April 13th to get the suggested username removed. There is some contention in the comments but overall it looks like this may be implemented.
WordPress is under attack by brute force hackers. The target: WordPress installs with the username “admin” and other common test users (“Admin”, “test”, “Administrator” etc). While this is disturbing the more disturbing fact is that as it stands WordPress is encouraging new users to set up an admin account with the username “admin” thereby perpetuating the situation. This cannot continue.
If you are running a WordPress site there is a good chance you will become the subject of a brute force attack aiming to get login access to your site through the default admin account. For the layman this means a computer goes to the login page on your site with the username “admin” and tries every password under the sun to see if it can get in. In the last few days two major hosting companies – HostGator and CloudFlare – have released reports that tens of thousands of sites are under attack from a “well organized” individual or group.
Others have written extensively on the subject (here, here, here, here, here, etc) so I won’t reiterate what they have said better than me. Instead I will point out an obvious flaw in WordPress itself that is amplifying the problem and that can be easily fixed:
Problem: “admin” is still the default user name
Even in version 3.6 “admin” is still the default username in WordPress
If you’ve been around for a while you know that in the past the first user created when WordPress was installed was always called “admin”. This lead to a barrage of brute force attacks on WordPress sites and was deemed to be enough of a vulnerability that by version 2.9 the user was prompted to set the admin user name manually.
So why are there so many sites that still have an admin user with the username “admin” even with the vulnerabilities and the ability to set the name manually? Simple: Like you can see in the image above, the suggested admin user name is still “admin” and will be used unless the user explicitly changes it to something else. And while seasoned WordPress users are aware of this and avoid using the name “admin”, new users are given no indication that using “admin” as the username is a bad idea.
In fact I would argue the current setup in which the username is automatically filled out with “admin” encourages new users to use the name thereby making them more vulnerable.
Solution: “admin” shouldn’t be an option
Considering the history of the “admin” user name and the fact that people still use it (because it is still the default and WordPress suggests they do) two things should be done:
Force the user to set a username herself by not providing one in the field
Add a filter that prevents “admin” from being used as a username
None of these are technically complex, and similar filters are used by other services and applications to avoid this exact issue.
As WordPress takes over a larger and larger share of the new site market it is more important than ever to ensure that new users are not led down a dangerous path. Suggesting “admin” as the username for the first user is precisely the type of path the new user should never be led down. I rest my case.
