Hacker News new | ask | show | jobs
by ck2 4814 days ago
If you still have user id #1 and/or the user "admin" on your wordpress install, you just haven't been using wordpress long enough to know what bad ideas those are.
1 comments

I've not heard of the problem of a user with id #1 before, can you explain please? What's the issue with a user id #1 when the username is not admin?
if user #1 is still an admin but with a different name you can just go to wpurl/?author=1 and if url rewriting is enabled you'll be redirected to wpurl/author/nicename and nicename is usually equal to the username
I don't think this adds the layer of security you think it does, merely a minor bit of obscurity. In context of the specific vector you reference, author={$user_id}, it probably doesn't do anything at all to protect you.

Not that there is anything wrong with adding a bit of obscurity, not using 'admin' as a username and using a non-privileged author for posts can go a long way.

However, if you are worried about someone getting your username from "author={$user_id}," using a user_id of 2,3,4,5, ect, probably isn't going to protect you. I think you are incorrectly assuming that the person that would use this method to get a username is going to stop if they get a 404 at #1(or even after just a single attempt.)

Thanks for the reply.