SmartUsername – Change Username, Admin Username Changer & Login Protection
| 开发者 |
digitalpritam
readymadewp |
|---|---|
| 更新时间 | 2026年10月30日 03:09 |
| 捐献地址: | 去捐款 |
| PHP版本: | 7.0 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Exposure check: one card shows every place your login names are visible (REST API users list, ?author=1 lookups, users sitemap, embeds, author URLs, login error messages, display names) with a Hidden or Exposed verdict, and a button for each fix.
- Login name protection: one switch closes those places to visitors. Logged-in authors and editors keep the block editor tools. An optional switch turns off author archives for sites that do not need them.
- Trap usernames: names nobody uses, like admin, and old names you keep after a rename become traps. Login attempts with them are refused and counted on a Dashboard widget, "Login attacks caught". No IP addresses are stored.
- Fix author slugs: one click gives every author whose public URL shows the login a new slug based on the display name.
- Rename any user: pick the account from a list, or use the "Change username" link on the Users screen or next to the Username field on the profile screen.
- Security check: warns on the Dashboard and Users screens when an account uses a username that login attacks guess first (admin, administrator, root, your site name and similar), with a one-click Rename button. The notice can be dismissed and only returns if something new is found.
- Email the user: optionally send the renamed user a short email with the old and new username and the login link.
- Self-service (optional, off by default): let chosen roles change their own username from Profile > Change Username, with a waiting period between changes.
- WP-CLI:
wp smartusername rename,wp smartusername checkandwp smartusername logfor agencies and scripts. - Live validation: as you type, the plugin checks length, allowed characters and whether the name is taken.
- Same rules as WordPress core: at most 60 characters; letters, numbers, spaces and . - _ @ only; names blocked by the
illegal_user_loginsfilter are refused. - Optional new author slug: the new slug comes from the display name, never the login. The old author URL redirects to the new one with a 301.
- Safe sign out: renaming your own account asks you to confirm first. A renamed user's open sessions are ended so they log in again with the new name. Email login keeps working.
- Rename log: the latest 50 changes are listed on the screen, with who made each change (administrator, the user themselves or WP-CLI) and whether the email was sent. You can clear it at any time.
- Clear errors: anything that cannot be saved is reported in an admin notice and nothing is changed.
- Clean admin screen: built from core admin styles, accessible labels and live regions. Works without JavaScript. Styles and scripts load on this screen only.
- Only users with the
manage_optionscapability (manage_network_userson multisite) can rename other users, and only users they are allowed to edit. - Self-service is off until an administrator turns it on and picks the roles.
- Every form and the live check are protected by nonces.
- Input is validated with
sanitize_user()in strict mode andvalidate_username(); output is escaped. - Network super admin usernames are not changed on multisite.
wp_mail() to the renamed user only.
For developers
- Action
smartusername_username_changed( $user_id, $old_username, $new_username, $change )fires after each rename. - Filter
smartusername_log_limitchanges how many log entries are kept (default 50). - Filter
smartusername_notification_emailchanges the email (to, subject, message, headers). - Filter
smartusername_risky_usernameschanges the list used by the security check. - WP-CLI:
wp smartusername rename <user> <new-username> [--slug] [--notify],wp smartusername check <user> <new-username>,wp smartusername exposure,wp smartusername log [--format=<format>].
安装:
- Upload the
smartusernamefolder to/wp-content/plugins/, or install it from Plugins > Add New. - Activate the plugin through the Plugins screen.
- Go to SmartUsername > Change Username in the admin menu.
屏幕截图:
常见问题:
How do I change the admin username in WordPress?
Go to SmartUsername > Change Username, pick the admin account, type the new username and click Change username. You are signed out and log in again with the new name or your email. Posts, password and role stay the same. Tick "Block the old username" so every login that still tries admin is refused.
How do I change a username in WordPress without a plugin?
Only by creating a new user and moving the content over, or by editing the database directly. SmartUsername does it safely in place, checks the new name first and logs every change.
Who can change usernames?
Administrators with the manage_options capability. On multisite, usernames are shared by the whole network, so the manage_network_users capability is required.
Can I change another user's username?
Yes. Choose the user in the list, click "Change username" under their name on the Users screen, or use the button next to the Username field on their profile.
Can users change their own username?
Only if you allow it. Go to SmartUsername > Settings, tick "Allow it", choose the roles and set the number of days between changes. Those users then see Profile > Change Username.
Will the user be told about the change?
Tick "Email the user their new username" and they get a short email from your site with the old and new username and the login link. If your site cannot send email, the screen tells you so.
Why does it warn me about the username admin?
Automated login attacks try usernames like admin first. Renaming that account means an attacker has to guess the username as well as the password. You can dismiss the warning.
Can I change my own username?
Yes. Tick the confirmation box. You are signed out and log in again with the new username or your email address.
What characters are allowed?
The same as WordPress core: up to 60 characters, using letters, numbers, spaces and . - _ @. Anything else is rejected with a message and nothing is changed.
What happens to posts, comments and other data?
Nothing. They are linked to the user ID, which does not change.
Does the author URL change?
Only if you tick "Also update the author URL slug". The old author URL then redirects to the new one with a 301. If you leave it unticked, public URLs stay exactly as they were.
Is the display name changed?
No. Edit the display name on the user's profile if needed.
Can users still log in with their email address?
Yes. WordPress accepts the email address on the login screen, and renaming does not change it.
Does it work on multisite?
Yes, for users who are not network super admins. Activate it on each site where you need it, or network activate it.
The outside checker says Partly hidden. Why?
Your theme probably links to author pages, so author slugs are public. After "Fix author slugs" they are based on display names, not logins, which is why the plugin says Hidden. To keep author slugs out of public pages too, turn off author archives, if your site does not need author pages.
Will hiding login names break my site?
Visitors can no longer read the REST API users list, and ?author=1 lookups go to the home page. Logged-in users who can write posts still get the users list, so the block editor works as before. If another plugin needs the public users list, leave the switch off.
How do trap usernames work?
Nobody can log in with a name that no account uses, so every attempt with admin (when no admin account exists) or with an old name you kept is a bot. The plugin refuses it with the normal error and adds it to the "Login attacks caught" widget. If you later create a real account with that name, the trap stops applying to it.
What is removed when I delete the plugin?
The rename log, the settings, the trap names and counts, the stored old author slugs used for redirects and the small per-user markers for self-service and dismissed notices.
更新日志:
- New: plugin name, tags and description now say what it does: change a username, including the admin username.
- New: SmartUsername now has its own admin menu (it used to sit under Users). Old Users > Change Username links redirect to it.
- New: a redesigned, simpler screen in the same style as SmartUsername Pro: a sidebar with Rename, Protection, History and Settings.
- New: the Rename section is one form: user, new name with a live check, one button. Options are folded away.
- New: the Protection section shows how many places reveal login names, with a one-click "Hide login names now" and a fix button next to each problem.
- New: the longer explanations moved to the screen's Help tab.
- Changed: the optional Pro add-on is now listed in the sidebar with a short description of each feature. It can be hidden with one click, and no free feature is locked or limited.
- New: one quiet line asking for a review after a successful rename, on this plugin's own screen only. One click hides it for good.
- No features, settings or data changed. Existing settings carry over as they are.
- New: refreshed Change Username screen in the SmartUsername brand style, with clearer cards and buttons.
- New: loading feedback on every button while a rename or setting is saved.
- New: Docs link in the Plugins list, and an optional, dismissible card about the SmartUsername Pro add-on on this plugin's own screen only. No features were moved or limited.
- New: Exposure check card with a Hidden or Exposed verdict and a fix for each item.
- New: Login name protection switch (REST users list, ?author=N lookups, users sitemap, oEmbed author, one login error message).
- New: optional switch to turn off author archives.
- New: trap usernames and a "Login attacks caught" Dashboard widget. Rename form option to keep the old username as a trap.
- New: "Fix author slugs" button for authors whose public URL shows the login.
- New: link to the free Username Exposure Checker on digitalpritam.in (opens only when clicked).
- New:
wp smartusername exposurecommand. - Changed: a new author slug now comes from the display name, never from the login.
- New: security check warns about usernames that login attacks guess first (admin, administrator, root, site name and more), with one-click Rename and a dismiss button.
- New: "Change username" button next to the Username field on Profile and Edit User screens.
- New: optional email to the renamed user with their new username and login link.
- New: optional self-service renames for chosen roles, with a waiting period. Off by default.
- New: WP-CLI commands
wp smartusername rename,checkandlog. - New: the log shows whether a change was made by an administrator, the user or WP-CLI, and whether the email was sent.
- New: filters
smartusername_notification_emailandsmartusername_risky_usernames. - Uninstall also removes the settings and per-user markers.
- New: rename any user, not only your own account. Pick the user from a list or use the new "Change username" link on the Users screen.
- New: live availability and validation check while typing (nonce protected).
- New: optional author slug (user_nicename) update, with a 301 redirect from the old author URL.
- New: confirmation step before you rename your own account and get signed out.
- New: log of the latest 50 renames, with a Clear log button. Removed on uninstall.
- New: login screen message after renaming your own account; email login keeps working.
- New: redesigned, accessible admin screen. Assets load on this screen only and the form works without JavaScript.
- New:
smartusername_username_changedaction andsmartusername_log_limitfilter. - Fix: usernames longer than 60 characters are rejected with a clear error. Before, the change failed silently while a success message was shown.
- Fix: input that is empty after sanitizing (for example only HTML tags) is rejected instead of saving an empty username.
- Fix: characters WordPress core does not allow (such as ! and #) are rejected, using strict sanitize_user and validate_username.
- Fix: success message and sign out only happen when the database row was actually updated.
- Fix: errors are shown as admin notices instead of a blank error page.
- Security: capability checks in every handler; multisite requires manage_network_users.
- Removed unused files.
- Requires WordPress 5.3 or later. Tested up to WordPress 7.1.
- Initial release.