Recently it has come to light that automated bots are attacking WordPress sites, in particular those where the person starting the site chose to retain the default admin username. Matt Mullenweg has recommended that WP site owners utilizing the admin username ensure that they have a strong password. If the password is not strong then change it to a strong one. In the video posted below I show you how to do that. As you’ll see it’s a very simple process.
In the video I mention that you can’t change the user name for the admin user but what you can do is to create a different user, assign that user administrator rights, then delete the admin user as described here. This approach requires the new admin user to have a different email address than the original admin user and it also requires that during the process of deleting the original admin user you attribute all links and posts to the new user that you created. Given the potential for losing everything on your site if you have been posting as the original admin user I say proceed with great caution when utilizing this approach.
Beyond not choosing the username admin for the first user when creating future WordPress sites, it’s probably also a good idea to create a separate user for posting content to the site. This means you’ll need multiple email addresses (since two users can’t have the same email address) but these days most people I know have several emails anyway. You can still log in as the administrative user and post content but when authoring you would just change the author as seen in the image below. (Click on the Screen Options tab in the top right of the Edit Post screen and select the Author check box to expose the appropriate section.)
Changing the author from one WordPress user to another.
Filed under: Web Development
