The WordPress administrator account is the most targeted account on your WordPress because it has full privileges. The WordPress administrator can do anything on a WordPress site (or multisite) such as install and activate themes, disable, enable, upgrade and modify plugins, create and move widgets, edit source code files, create new users, modify existing WordPress user accounts and more.
Therefore when securing a WordPress site, you should also secure the WordPress administrator account and ensure it remains secure. This WordPress security article explains how you can secure your WordPress administrator account and what you can do to ensure it remains secure.
Rename WordPress Administrator Account
A recommended security best practise is to rename the default WordPress administrator account. No need for anything fancy, a mix of alphanumeric characters (numbers and letters) should suffice. It is important to not use any default and common usernames for your WordPress administrator account such as admin, administrator, root, superuser etc.
By renaming your WordPress administrator account you are also protecting your WordPress site from dictionary and brute force attacks as explained in Protect Your WordPress from Brute Force Attacks.
For more information on how to rename a WordPress username, refer to Rename the Default WordPress Administrator account.
Change the WordPress Administrator User ID
Once you rename the default WordPress administrator you should also change the WordPress Administrator user ID. If you do not change the WordPress administrator user ID, anyone can easily find out the username you are using for the built-in default WordPress administrator, therefore renaming it only is not enough.
Hide the WordPress Administrator Username
Now that you have renamed the WordPress administrator account and changed the WordPress administrator user ID, you have made it difficult for the attacker to guess the WordPress administrator username. Therefore it will take him longer hence the chances of you identifying such suspicious behaviour and take evasive actions are much higher. Though it is still not enough since if you are not around to take evasive action, then the attacker might have enough time to guess the WordPress administrator user. In this case we also recommend you to hide the WordPress administrator display name.
Other Tips to Keep Your WordPress Administrator Account Secure
To ensure you keep your WordPress administrator account secure and unreachable from malicious hackers, follow the below tips:
Keeping the WordPress Administrator Account Safe
Similar to WordPress security, or any other form of security, securing the WordPress administrator account and ensuring it remains secure is not just a one time procedure, but a continuous process. Follow the tips in this article to ensure that all the hard work and money you invested to secure your WordPress blogs and websites is not poured down the drain.
This content was originally published here.