WPMazic WPMazic

Hide Author Slugs

Product: Admin Framework Pro

The Hide Author Slugs module protects WordPress usernames by replacing visible author slugs in URLs with encrypted hashes. This prevents attackers from discovering valid usernames through author archives or the REST API, enhancing privacy and site security with no extra configuration.

How to use

To enable the Hide Author Slugs Module:

  1. Click on the “Users” category
  2. Search or scroll to locate the Hide Author Slugs Module
  3. Click on the switch to enable

What’s next?

This module enhances your WordPress site’s security by encrypting author slugs in URLs and REST API responses, making it harder for attackers to enumerate users.

1. How It Works

The module replaces visible usernames in author URLs with encrypted hashes:

  • Original: example.com/author/username/
  • Encrypted: example.com/author/a1b2c3d4e5f6/

2. Key Features

  • URL Encryption: Converts author slugs to encrypted hashes
  • REST API Protection: Secures user endpoints in the REST API
  • Automatic Redirection: Maintains existing links by redirecting old author URLs
  • No Configuration Required: Works immediately after activation

3. Security Benefits

  • Prevents username enumeration attacks
  • Makes it harder to discover valid usernames
  • Protects against automated scanning tools
  • Secures both frontend and REST API endpoints

4. Important Notes

  • Incompatibility: This module conflicts with the User Enumeration module. If both are enabled, you’ll see a warning in the admin area.
  • Existing Links: Old author links will automatically redirect to the new encrypted URLs
  • Performance Impact: Minimal performance impact as encryption only occurs during URL generation

5. Developer Information

The module uses 3DES encryption with a server-specific key based on:

  • Server IP address
  • Plugin installation path

6. Troubleshooting

  • Broken Author Links: If you notice broken author links, try:
    1. Clearing your WordPress cache
    2. Saving your permalink settings again (Settings > Permalinks > Save Changes)
    3. Deactivating and reactivating the module
  • Conflict with Caching Plugins: If you’re using a caching plugin, you may need to:
    1. Clear your cache after enabling/disabling this module
    2. Add author pages to your cache exclusion list if needed

7. Best Practices

  • Enable this module on new sites before launch
  • After enabling, update any hardcoded author links in your theme or content
  • Regularly test author links after major WordPress or theme updates