# Stop Author URLs From Revealing Login Names

> Gives new users an author URL slug based on their user ID instead of their login name, and adds a one-click fix under Users for existing accounts whose author URL shows their username.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: user-enumeration, authors, users
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/sec-hide-logins-in-author-urls/

## Code

```php
$wpide_safe_slug = function ( $user ) {
    $slug = sanitize_title( $user->display_name );

    if ( ! $slug || $slug === sanitize_title( $user->user_login ) ) {
        $slug = 'author';
    }

    return $slug . '-' . $user->ID;
};

add_action( 'user_register', function ( $user_id ) use ( $wpide_safe_slug ) {
    $user = get_userdata( $user_id );

    if ( $user && $user->user_nicename === sanitize_title( $user->user_login ) ) {
        wp_update_user( array( 'ID' => $user_id, 'user_nicename' => $wpide_safe_slug( $user ) ) );
    }
}, 20 );

add_action( 'admin_notices', function () use ( $wpide_safe_slug ) {
    global $wpdb;

    $screen = get_current_screen();

    if ( ! $screen || 'users' !== $screen->id || ! current_user_can( 'edit_users' ) ) {
        return;
    }

    if ( isset( $_POST['wpide_fix_slugs'] ) && check_admin_referer( 'wpide_fix_slugs' ) ) {
        $fixed = 0;
        foreach ( $wpdb->get_col( "SELECT ID FROM {$wpdb->users} WHERE user_nicename = user_login LIMIT 500" ) as $id ) {
            $user = get_userdata( (int) $id );
            if ( $user && ! is_wp_error( wp_update_user( array( 'ID' => $user->ID, 'user_nicename' => $wpide_safe_slug( $user ) ) ) ) ) {
                $fixed++;
            }
        }
        printf( '<div class="notice notice-success"><p>%s</p></div>', esc_html( sprintf( 'Updated the author URL of %d user(s).', $fixed ) ) );
        return;
    }

    $count = (int) $wpdb->get_var( "SELECT COUNT(*) FROM {$wpdb->users} WHERE user_nicename = user_login" );

    if ( $count ) {
        echo '<div class="notice notice-warning"><form method="post"><p>' . esc_html( sprintf( '%d user(s) have an author URL that shows their login name.', $count ) ) . ' ';
        wp_nonce_field( 'wpide_fix_slugs' );
        echo '<button class="button" name="wpide_fix_slugs" value="1">Hide login names in author URLs</button></p></form></div>';
    }
} );
```

## Notes

Changing a slug changes that author's archive URL, so old author links will no longer work.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Stop Author URLs From Revealing Login Names" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/