Username Hygiene

Last verified: 2026-07-08

Attackers often guess common WordPress usernames before guessing passwords. Awthy's username hygiene panel helps administrators find risky names such as admin, administrator, test, or other easy targets and rename them safely.

Why default usernames matter

A predictable username removes half of the login puzzle. It makes password guessing, credential stuffing, and phishing more efficient. Changing a risky username does not replace two-factor authentication, but it reduces avoidable exposure.

Safe rename flow

Use the Username hygiene panel to review risky accounts, check whether the replacement username is available, and confirm the rename. Awthy sends the affected user a notification so the change is not silent.

Rename one account at a time. Confirm the user has current recovery material and knows the new username before making broad policy changes.

Session and cache expectations

A username rename can invalidate sessions or cached account references depending on site configuration and connected plugins. Awthy's rename flow coordinates the WordPress update, notification, and session cleanup, but operators should still expect users to sign in again after a rename.

Clear application or page caches if a site displays usernames publicly.

Account-change notifications

Username changes are security-sensitive. They should appear in account-change notifications and audit history without exposing private support notes or unrelated customer data.

If a user says they did not request a rename, review recent administrator activity and consider forced logout, password reset, and second-factor review.

Boundaries

Username hygiene is not supported on multisite in v1.
Do not rename service or integration accounts without checking what depends on them.
Do not publish old/new username pairs in public support threads.
Do not treat username changes as a substitute for passkeys, 2FA, brute-force protection, or recovery readiness.