Exercise 3: Why "admin" as a Username Is a Real Weakness — Possible Solution ==================================================================== WHAT AN AUTOMATED ATTACK AGAINST A WORDPRESS LOGIN ACTUALLY DOES ------------------------------ A common form of attack against any login page is a brute-force or credential-guessing attempt - repeatedly trying username/password combinations against the login form, usually via an automated script rather than a human typing each attempt by hand. Logging into WordPress requires guessing (or already knowing) two separate pieces of information: the username and the password. WHY "admin" REMOVES HALF OF WHAT NEEDS TO BE GUESSED ------------------------------ Per this chapter, a non-obvious admin username matters "because [admin] is the first guess in any automated attack." If the username is literally "admin," an attacker's automated script doesn't need to guess it at all - it can safely assume that username on the very first attempt and focus its entire effort on guessing the password alone. This effectively cuts the attacker's real problem in half: instead of needing to guess two unknowns together, they only need to guess one. WHY A NON-OBVIOUS USERNAME RESTORES THAT DIFFICULTY ------------------------------ If the username is something unpredictable instead, an automated attack now has to correctly guess both the username and the password together, which is a meaningfully larger combined search space than guessing the password alone against an already-known username. This doesn't make the account unbreakable, but it removes the free head start "admin" hands to essentially every automated attack aimed at WordPress sites specifically, since "admin" is disproportionately common as a default or assumed username across many WordPress installations. WHY THIS IS A CHEAP, GENUINE IMPROVEMENT ------------------------------ Per this chapter's own framing, this is grouped alongside a strong password as one of the highest-value, lowest-effort security steps available at install time - it costs nothing extra to choose a different username during the five-minute install wizard, and it removes a real, well-known, exploitable assumption baked into a large share of automated attack tooling. WHY THIS WORKS AS AN ANSWER ------------------------------ It explains concretely how a brute-force/credential-guessing attack actually operates, shows precisely how "admin" as a username removes one of the two unknowns an attacker needs to guess, and explains why a non-obvious username restores that removed difficulty rather than just asserting that "admin" is "insecure" without a mechanism.