The Admin Account Called Admin

Half the credential

Getting in requires a username and a password, and the effort of guessing depends on both being unknown.

A default username removes half of that entirely.

Software attempting logins does not have to discover who the administrators are, because it can assume, and the assumption is right often enough to be worth making everywhere.

Which turns the problem from guessing two things into guessing one, and changes the arithmetic considerably.

The names that get tried

• The platform default, whatever it is.
• The domain name without its ending.
• The business name.
• The owner's first name.
• Anything published on the site as an author.

The last is worth knowing. Many platforms display the account name publicly alongside published posts, so an author name on your blog may be the login name, handed over deliberately.

Check what yours is exposing

A two-minute check that most people have never done.

Look at any published post and see what name appears as the author, and whether it links to a page showing that name in the address.

On several platforms the display name and the login name are separate fields and default to the same thing, which is where the exposure comes from.

Set the display name to whatever you want shown publicly, and make sure the login name is different and not guessable.

Those are two settings, in two places, and changing one without the other achieves nothing.

Changing it properly

Since most platforms will not let you rename an account directly.

Create a new administrator account with an unpredictable name and a strong password.

Log in as the new account and confirm it works before touching anything else.

Delete the old account, and when asked, reassign its content to the new one rather than deleting it, which is the step people get wrong and which removes every post.

Check afterwards that the content is still there and attributed correctly.

Then set the display name separately so the new login name never appears publicly.

A worked example

A business site was receiving several thousand login attempts a month, all against the default username, which they discovered only when a plugin started reporting them.

The account existed, was an administrator, and had a password chosen in 2017.

They created a new administrator with an unguessable name, moved the content across, deleted the old account, and added rate limiting on the login page.

Attempts continued at the same volume for a fortnight, all against a username that no longer existed, and then declined.

Nothing had ever succeeded, and the exposure had been a single weak password away from succeeding for five years.

Rate limiting matters more than the name

Worth being clear about the relative weight of these measures.

Changing the username raises the cost of guessing. Limiting attempts makes guessing impractical regardless of what the username is.

Most platforms have a plugin or a host-level feature that blocks an address after a handful of failed attempts.

That is the single most effective thing available here, and it takes about five minutes to enable.

Do both, and if you only do one, do the rate limiting.

Two-step verification on administrator accounts is stronger still and is worth the small inconvenience on the accounts that matter.

Moving the login page

A commonly suggested measure with a more limited benefit.

Changing the address of the login page stops the simplest automated attempts, which try only the default location.

It does not stop anything that looks properly, and it is best understood as reducing noise rather than as security.

It also introduces a practical risk, since a login page at an address nobody remembers is a problem when the person who set it up is unavailable.

Where you do it, record the address somewhere the business can find it, alongside the other access details.

Treat it as a way to cut down the log entries rather than as a defence.

The other accounts

Since attention goes to the main one and the risk is spread across all of them.

Look at every account with access and check what level each has, since people are frequently given administrator rights for a task and never reduced afterwards.

Remove accounts belonging to former staff, former developers, and anybody who did a piece of work two years ago.

Reduce anybody who does not need administrator access to something lower.

A single unused administrator account with a weak password undoes everything else on this list, and it is usually the one nobody remembers exists.

Watch the attempts rather than ignoring them

A small habit that turns a nuisance log into useful information.

Failed login attempts are constant background noise and most people either never see them or stop looking after the first week.

What is worth noticing is a change: attempts against a username that is not the default, which means somebody has looked at your site rather than scanned it, or a sudden increase after a period of quiet.

Those are the two patterns that justify attention, and they are invisible unless something is reporting.

Set whatever notification your plugin or host offers to weekly rather than per attempt, which is frequent enough to notice a change and infrequent enough that you keep reading it.

The counter-case

The username is not the main risk.

A strong unique password makes the username largely irrelevant, since guessing remains impractical either way.

There is also a tendency to treat obscurity measures as security, and a site with a hidden login page and a weak password is worse off than the reverse.

And the practical cost of an unrecoverable login is real, particularly for a business where one person set everything up.

Change the name, enable rate limiting, use strong distinct passwords, turn on two-step verification, and audit who has access.

What to do

1. Check what name your posts display.
2. Create a new administrator with an odd name.
3. Reassign content, then delete the old account.
4. Set the display name separately.
5. Enable rate limiting on the login page.
6. Turn on two-step verification.
7. Audit every account and its level.

Step five does more than the rest combined and takes five minutes, which is an unusually good ratio for anything in this subject.

Managing the passwords behind all of this is covered in passwords for a business with three people.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.