![\"WordPress](\"https:\/\/assets.hongkiat.com\/uploads\/wordpress-uuid-author-url-security-guide\/cover.jpg\")
<\/figure>\nWe\u2019ll be looking at two approaches: The hard way<\/a>, where we write the code ourselves, and the easy way<\/a>, where we use a plugin.<\/p>\n So, without further ado, let\u2019s see how it works.<\/p>\n To begin, create a new PHP file, for example \u2026and the logic required to implement UUID-based author URLs. In this case, we will provide a simple input in the user profile editor to add the UUID.<\/p>\n For security reasons, this input will only be active and editable for users with the Next, we need to modify the author URL to use the UUID instead of the author\u2019s username. This can be achieved by implementing the This implementation will update the generated URL for the author, affecting both the front-end theme and the admin interface.<\/p>\n Since we\u2019ve modified the URL structure for author archive URLs, we also need to handle the corresponding queries. Without this, WordPress would return a 404 Not Found<\/strong> error because it wouldn\u2019t recognize how to query authors by their To implement this functionality, we can utilize the The code above verifies whether the permalink structure is set to something other than the default \u201cPlain\u201d setting. We exclude handling queries for the \u201cPlain\u201d permalink structure because WordPress uses the author ID ( The user\u2019s username is also exposed in the With this implementation, the author URL will now utilize the UUID instead of the username. Any attempts to access the author URL using the original username will result in a 404 not found error.<\/p>\n While this solution works effectively for smaller sites or those with limited users, it can become cumbersome to manage when dealing with a large number of users. In such cases, implementing UUIDs manually for each user would be time-consuming and impractical.<\/p>\n Therefore, let\u2019s explore an alternative approach that offers a more streamlined solution.<\/p>\n For a simpler solution, we\u2019ll utilize a plugin called Feature Flipper<\/a>. This plugin provides several security features, including the ability to obfuscate usernames using UUIDs.<\/p>\n You can install the plugin directly from the Plugins<\/strong> section in your WordPress dashboard. After installation and activation, navigate to Settings > Feature > Security<\/strong> and enable the Obfuscate Usernames<\/strong> option.<\/p>\n Once you\u2019ve saved the settings, the plugin will automatically generate UUIDs for all existing users on your site. Additionally, it will assign UUIDs to any new users upon registration.<\/p>\n Implementing UUIDs for author URLs is an effective security measure that helps protect your WordPress site by concealing author usernames. This approach significantly reduces the risk of brute-force attacks and unauthorized access attempts.<\/p>\n Throughout this tutorial, we\u2019ve explored two implementation methods. For those who prefer a custom solution, the complete source code is available in our GitHub repository<\/a>. Alternatively, the Feature Flipper<\/a> plugin offers a more straightforward approach for users seeking a ready-made solution.<\/p>","protected":false},"excerpt":{"rendered":" In WordPress, you can register multiple authors, and each author will have their own URL. The problem is that this author URL shows the author\u2019s username, which poses a security risk for your WordPress site. Since the author username is exposed, attackers could use it to attempt to log in or brute-force their way into…<\/p>\n","protected":false},"author":113,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[49],"tags":[],"topic":[],"class_list":["entry-content","is-maxi"],"acf":[],"yoast_head":"\n
\nThe Hard Way<\/h2>\n
uuid-slug.php<\/code>, inside either the \/wp-content\/plugin<\/code> directory or the \/wp-content\/mu-plugins\/<\/code> directory, to load it as a must-use plugin<\/a>. This file will contain the plugin headers\u2026<\/p>\n\r\n\/**\r\n * Plugin bootstrap file.\r\n *\r\n * This file is read by WordPress to display the plugin's information in the admin area.\r\n *\r\n * @wordpress-plugin\r\n * Plugin Name: Author UUID Slug\r\n * Plugin URI: https:\/\/github.com\/hongkiat\/wp-author-uuid-slug\r\n * Description: Use UUID for the author URL.\r\n * Version: 1.0.0\r\n * Requires at least: 6.0\r\n * Requires PHP: 7.4\r\n * Author: Thoriq Firdaus\r\n * Author URI: https:\/\/github.com\/tfirdaus\r\n *\/\r\n<\/pre>\n
\r\nadd_action('show_user_profile', 'add_uuid_field_to_profile');\r\nadd_action('edit_user_profile', 'add_uuid_field_to_profile');\r\n\r\nfunction add_uuid_field_to_profile($user)\r\n{\r\n $uuid = get_user_meta($user->ID, '_uuid', true);\r\n ?>\r\n <table class=\"form-table\">\n <tr>\n <th><label for=\"user_uuid\"><?php esc_html_e('UUID', 'hongkiat'); ?><\/label><\/th>\n <td>\n <input \n type=\"text\" \n name=\"user_uuid\" \n id=\"user_uuid\" \n value=\"<?php echo esc_attr($uuid); ?>\" \n class=\"regular-text\" \n <?php echo !current_user_can('manage_options') ? 'readonly' : ''; ?>\n \/>\n <p class=\"description\">\n <?php \n if (current_user_can('manage_options')) {\n esc_html_e('Enter or update the UUID for this user.', 'hongkiat');\n } else {\n esc_html_e('This UUID is read-only for non-administrators.', 'hongkiat');\n }\n ?>\n <\/p>\n <\/td>\n <\/tr>\n <\/table>\r\n <?php\r\n}\r\n\r\nadd_action('personal_options_update', 'save_uuid_field');\r\nadd_action('edit_user_profile_update', 'save_uuid_field');\r\n\r\nfunction save_uuid_field($user_id)\r\n{\r\n if (!current_user_can('manage_options', $user_id)) {\r\n return false;\r\n }\r\n\r\n $new_uuid = isset($_POST['user_uuid']) ? sanitize_text_field($_POST['user_uuid']) : '';\r\n\r\n if (!empty($new_uuid) && is_uuid($new_uuid)) {\r\n update_user_meta($user_id, '_uuid', $new_uuid);\r\n } else {\r\n delete_user_meta($user_id, '_uuid');\r\n }\r\n}\r\n\r\nfunction is_uuid($value)\r\n{\r\n $pattern = '\/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$\/i'; \/\/ UUID pattern.\r\n\r\n return (bool) preg_match($pattern, $value);\r\n}\r\n<\/pre>\nmanage_options<\/code> permission, so only administrators will be able to add or update the UUID for users. Users without the proper permissions will see the input as read-only.<\/p>\nChange the Author URL<\/h3>\n
author_link<\/code> filter, as shown below:<\/p>\n\r\nadd_filter('author_link', 'change_author_url', 10, 3);\r\n\r\nfunction change_author_url($link, $author_id, $author_nicename)\r\n{\r\n $uuid = get_user_meta($author_id, '_uuid', true);\r\n\r\n if (is_string($uuid)) {\r\n return str_replace('\/' . $authorSlug, '\/' . $uuid, $link);\r\n }\r\n\r\n return $link;\r\n}\r\n<\/pre>\n![\"WordPress](\"https:\/\/assets.hongkiat.com\/uploads\/wordpress-uuid-author-url-security-guide\/author-uuid-view-url.jpg\")
<\/figure>\nHandling Queries for Author Archives<\/h3>\n
_uuid<\/code> metadata.<\/p>\npre_get_posts<\/code> hook as shown below:<\/p>\n\r\nadd_action('pre_get_posts', 'author_uuid_query');\r\n\r\nfunction author_uuid_query($query) {\r\n \/**\r\n * If the permalink structure is set to plain, the author should be queried\r\n * by the user ID.\r\n *\/\r\n if ((bool) get_option('permalink_structure') === false) {\r\n return;\r\n }\r\n\r\n $author_name = $query->query_vars['author_name'] ?? '';\r\n\r\n if (! is_string($author_name) || ! is_uuid($author_name)) {\r\n $query->is_404 = true;\r\n $query->is_author = false;\r\n $query->is_archive = false;\r\n\r\n return;\r\n }\r\n\r\n $users = get_users([\r\n 'meta_key' => '_uuid',\r\n 'meta_value' => $author_name,\r\n ]);\r\n\r\n if (count($users) <= 0) {\r\n $query->is_404 = true;\r\n $query->is_author = false;\r\n $query->is_archive = false;\r\n\r\n return;\r\n }\r\n\r\n $user = $users[0];\r\n\r\n if (! $user instanceof WP_User) {\r\n $query->is_404 = true;\r\n $query->is_author = false;\r\n $query->is_archive = false;\r\n\r\n return;\r\n }\r\n\r\n $query->set('author_name', $user->user_nicename);\r\n}\r\n<\/pre>\n?author=<id><\/code>) rather than the author_name<\/code> in this case.<\/p>\nChanging the Author Slug in REST API<\/h3>\n
\/wp-json\/wp\/v2\/users<\/code> REST API endpoint. To enhance security, we\u2019ll modify this by replacing the username with the UUID. This can be accomplished by implementing the rest_prepare_user<\/code> hook as demonstrated below:<\/p>\n\r\nadd_filter('rest_prepare_user', 'change_user_slug_in_rest_api', 10, 2);\r\n\r\nfunction change_user_slug_in_rest_api($response, $user)\r\n{\r\n $data = $response->get_data();\r\n\r\n if (is_array($data)) {\r\n $uuid = get_user_meta($author_id, '_uuid', true);\r\n\r\n if (is_string($uuid)) {\r\n $data['slug'] = $uuid;\r\n }\r\n }\r\n\r\n $response->set_data($data);\r\n\r\n return $response;\r\n}\r\n<\/pre>\n
\nThe Easy Way<\/h2>\n
![\"WordPress](\"https:\/\/assets.hongkiat.com\/uploads\/wordpress-uuid-author-url-security-guide\/wp-obfuscate-usernames.jpg\")
<\/figure>\n
\nConclusion<\/h2>\n