Free tool
Is your WordPress admin username public?
Type a site address and we check the five public places where WordPress can give away author slugs. It takes a few seconds, never logs in, and never shows or keeps the names it sees.
Check a site
Why a public slug matters: WordPress builds the public author slug from the login name unless someone changed it, so a public slug is often the login itself. We can only see the slug, so a result here means “worth checking”, not “confirmed login”. We never show or store the names.
If a slug is public, what next?
Free: PressBot Site Check
The free PressBot plugin looks from inside your site. It finds these same leaks, shows which of them are real logins, and has a Hide usernames switch (off until you turn it on) and a safe Change my username.
Pro: Shield
Shield shows which usernames bots are actually trying, tells you when a real login is under attack, and adds lockouts after repeated failed attempts.
Want the story behind this tool? Your WordPress admin username is probably public. Ours was.
What this checks, and what it never does
The five public places
- The REST API users list. /wp-json/wp/v2/users can list authors and their slugs.
- Author URL redirects. Visiting /?author=1 can redirect to /author/<slug>/.
- The WordPress users sitemap. It can list one URL per author.
- The Yoast author sitemap. Only on sites that use Yoast SEO.
- oEmbed responses. They can carry the author’s name and URL.
What it never does
- It never logs in and never tries a password.
- It never touches wp-login.php or xmlrpc.php.
- It only reads public pages that any visitor can open.
- It does not keep the names it sees, and it does not show them to you either.
- It is rate limited, so it cannot be used to hammer a site.
To keep automated abuse out, the form uses Cloudflare Turnstile, a privacy-friendly challenge that usually runs without any click.
Questions
Why does a public WordPress username matter?
A username is half of a login. Bots try common and leaked passwords against logins they can find, and a public author slug saves them the guessing. A public slug does not let anyone in on its own, but it gives them a real name to attack. A strong, unique password and two-factor login are still what keep that attack from working.
Is a public author slug always my login name?
No. WordPress builds the public author slug from the login name when the account is created, so the two are often identical, but someone may have changed the slug or the display name since. This checker can only see the public slug. The free PressBot Site Check looks from inside the site and tells you which public slugs are real logins.
Is it safe to check a site I do not own?
Yes. The checker only reads pages that any visitor can open, such as the REST API users list, the users sitemap and an author URL. It never logs in, never tries passwords and never touches wp-login.php or xmlrpc.php. It also shows only how many places leak a slug, not the names, and it keeps no names. Checks are rate limited per visitor.
Why does a check say it could not check?
The site may be blocking automated requests, may have answered with an error or a timeout, or may have switched that feature off in a way that looks the same from outside. A could-not-check row is not a pass. It means we did not get a clear answer, so run Site Check from inside the site if you want a firm one.
How do I hide my WordPress username?
Install the free PressBot plugin and run Site Check. It shows which leaks are real logins. The Hide usernames switch (free, off by default) closes the common public places for visitors, and Change my username safely renames your own login. With Pro, Shield also shows which usernames bots are trying and adds lockouts after repeated failures.
Does hiding the username replace a strong password or two-factor login?
No. Hiding the username removes an easy hint, it does not remove the login page. Keep a long, unique password and add two-factor login, and keep WordPress, themes and plugins updated. PressBot works alongside your firewall and security plugin and does not replace them.
More on how PressBot protects the login: Shield and the security page.