How to Change Your WordPress Admin Username (Safely)

If your WordPress admin username is still admin, you have given every bot on the internet a head start. Changing it takes about ten minutes, but there is one catch that trips people up: WordPress will not let you do it from the profile screen.

This guide shows you how to change your WordPress admin username three different ways, which one to pick, and what to double-check afterwards so the old name does not leak back out through the side door.

Why "admin" Is a Gift to Bots

A sign-in has two parts: a username and a password. An attacker needs both. If your username is admin, they already have half the answer before they start, and they did not even have to look for it.

Bots know this. A typical automated guessing run tries admin first, then a few other obvious names like administrator or the site's own name. They are not clever, they are patient, and they never get bored. If a real account called admin exists, every guess is a guess at the password only.

Picture a front door with a brass plate reading "Master Bedroom Key Under Mat". You would not say it makes burglary certain, but you have saved the burglar a lot of effort.

There is a second reason. Many sites that still use admin were set up years ago, in a hurry, by someone who meant to tidy up later. Those same sites often have old passwords and no two-factor either. The username is a symptom of a site whose sign-in has not been looked at in a while.

Changing the username will not make you unhackable. It removes a freebie and forces attackers to do real work, which is exactly what you want.

Why WordPress Will Not Let You Edit a Username

Open Users and edit your profile. The username field is there, but it is greyed out with a note saying usernames cannot be changed.

That is deliberate. In the database, the username is stored as user_login, and WordPress uses it in places like author archive URLs, some plugin settings and older integrations. Letting people rename it casually could break links and confuse code that assumed it stays put.

What WordPress does let you change is the nickname and the display name (what shows publicly on posts). Those are separate fields. The username itself is locked from the screen, but it is not locked in the database, which is why the workarounds below work.

Before you start, take a backup. You are changing how you sign in, and if something goes wrong halfway you want a clean way back. If you use Stack Guard, a manual backup takes a minute and is verified before it counts. If you are not sure how to do it properly, our guide on how to back up a WordPress site walks through it.

Three Ways to Change Your WordPress Admin Username

Pick the method that matches your comfort level. They all end in the same place: a username that is not admin.

Method 1: Create a New Administrator and Delete the Old One

This is the safest route because you never touch the database. It works on every host.

1. Go to Users, Add New.
2. Pick a new username that is not guessable. Avoid your site name, your first name alone, or anything that appears on your public pages.
3. Use a different email address from the old account. WordPress insists that each user has a unique email. If you only have one address, add a plus tag such as you+admin@example.com (most email providers deliver it to the same inbox), or change the old account's email first.
4. Set the role to Administrator and use a long, unique password.
5. Sign out, then sign back in as the new user.
6. Go to Users, hover over the old admin account and click Delete.
7. WordPress asks what to do with the posts and pages the old user owns. Choose Attribute all content to and pick your new account.
8. Confirm the deletion.

That reassign step is the one people skip. If you do not choose it, WordPress deletes everything that user wrote. Read the screen before you click.

This method changes the user ID too, because the new account is a new row. If any plugin stored the old user ID (some membership, page builder and shop setups do), check it still works afterwards.

Method 2: Edit the Username in phpMyAdmin

This keeps your user ID, your content and your settings exactly as they are. It is quick if you are comfortable in a database tool, and a bad idea if you are not.

phpMyAdmin is a web screen your host provides for looking at and editing your database. You usually find it in your hosting control panel.

1. Back up your database first.
2. Open phpMyAdmin and select your WordPress database.
3. Open the users table. It ends in users, usually wp_users, though your prefix may differ.
4. Find your row and click Edit.
5. Change the user_login value to your new username.
6. Optionally change user_nicename too, since that is what WordPress uses in author archive addresses. If you skip it, the old name will still appear in the author URL.
7. Click Go to save.

Then sign in with the new username and your existing password. Nothing else changes.

Two warnings. First, if you edit the wrong row or mistype the field, you can lock yourself out, so work slowly. Second, on a site with a custom prefix, make sure you are editing the right table. If you are unsure, use Method 1 instead.

Method 3: Use WP-CLI or a Plugin

WP-CLI is a command line tool for running WordPress tasks on the server. Many hosts offer it. If you have it, you can do Method 1 in two commands and avoid clicking around.

The WP-CLI user commands include creating, updating and deleting users, and the documentation shows how to delete a user and reassign their posts in one step. A rough outline:

# Create the new administrator
wp user create newname you+admin@example.com --role=administrator --user_pass='a-long-unique-passphrase'

# Delete the old one and hand their content to the new account
wp user delete admin --reassign=newname

You can read the full list of options in the WP-CLI user command documentation. The wp user update command handles fields like display name and email, but its documented options do not include the login name, so creating a new user is the dependable route.

If you would rather not use a terminal, there are username changer plugins. They are fine for a one-off, but treat them like any plugin: install, use, delete. Do not leave a plugin installed for a task you only needed once, because every extra plugin is extra code to keep updated. Our article on WordPress plugin vulnerabilities explains why that matters.

What to Watch For After You Change It

Changing the name is the easy part. The traps come afterwards.

Display Name vs Username

Your display name is what visitors see on your posts. Your username is what you type to sign in. They are different fields, and they should be different values.

A surprising number of sites set the display name to the same string as the username. The result is that every post proudly prints the sign-in name for everyone to read. Open your profile, find Display name publicly as and pick your real name or a nickname instead.

Author Archives Can Leak Usernames

WordPress creates an author archive for every user who has written something, at an address like yoursite.com/author/yourname/. By default that address is built from the user_nicename, which usually matches the username.

There is an even older trick: visiting yoursite.com/?author=1 on an unprotected site redirects to the archive for user ID 1, and the address in the browser bar shows the name. Run through IDs 1, 2, 3 and a bot has a list of your usernames in seconds.

This is called user enumeration: asking a site to confirm which accounts exist. It undermines everything you just did, because the new username is public again within moments. Our user enumeration guide covers the different ways it happens and how to close each.

The REST API Can Tell Tales Too

WordPress also exposes a list of users through its REST API at /wp-json/wp/v2/users. Depending on your version and setup, that can show the slug of users who have published content. It is the same problem through a different door, and our guide to WordPress REST API security shows how to close it.

The quick test: visit yoursite.com/?author=1 and yoursite.com/wp-json/wp/v2/users in a private browser window. If either one shows your username, you still have a leak to close.

Error Messages That Confirm a Username Exists

Try signing in with a username that definitely does not exist. Then try one that does, with the wrong password. On a default WordPress site, the two errors can be different, so a bot can tell which usernames are real. One vague message for both closes that gap.

What Stack Guard Does About This

Stack Guard cannot rename your user for you, so do that with one of the methods above. What it does is shrink the number of ways an attacker can find or guess whatever you chose.

On Free, these help directly:

• Block user enumeration (in Hardening) stops the ?author= trick and similar probes from revealing names.
• One generic error for wrong usernames and wrong passwords, so nobody can confirm an account exists.
• A custom sign-in address that moves wp-login.php somewhere only your team knows. Bots that hit the old address get a 404, your home page or a page you pick. The hide wp-login guide explains how to set it up.
• Per-address lockouts after repeated failures, covered in Brute Force Protection.

On Pro, there is one feature that is specific to this topic. The brute force settings include an option to automatically lock out the "admin" username: any address that tries admin is locked out straight away, because robots try it first. The plugin docs warn about one thing worth repeating: only switch it on once no real account on your site is called admin, or that person will be locked out even with the right password.

That makes the order of operations simple. Change the username first, confirm you can sign in with the new one, then turn the trap on. After that, admin is not just a missing account, it is a tripwire. If you want to log or react when it fires, the plugin has a hook for it, smg_admin_username_blocked, listed in the developer reference.

The Pro "admin" lockout, per-username lockouts and flexible lockout windows are covered in the brute-force docs. The login protection overview lists what is on each plan.

Checklist After You Change the WordPress Admin Username

Run through this once and you are done:

1. Sign in with the new username, in a private window, to confirm it works.
2. Check that no account called admin still exists under Users.
3. Set the display name to something other than the username.
4. Visit ?author=1 and the REST users address while signed out, and confirm neither reveals a name.
5. Update any saved logins in your password manager.
6. Check plugins that depend on the old user: your SMTP settings, backup tools, API connections and any scheduled jobs that ran as that user.
7. Turn on two-factor for the new administrator. A hidden username helps, but a second step is what actually stops a stolen password. See the two-factor guide.

If you manage client sites, repeat this on each one and write down which sites you have done. It is the kind of job that is easy to do on nine out of ten sites and forget on the tenth.

Is Hiding the Username Enough?

No, and it is worth being honest about that. A username is not a secret in the way a password is. It appears in author pages, in emails, in comment threads and sometimes in plugin screens. Treat it as a small speed bump, not a lock.

The things that actually protect you are the boring ones: a strong, unique password, two-factor sign-in, lockouts that stop endless guessing, sessions that do not stay open for weeks (see WordPress auto logout), and software that is up to date. The username change is the cheap first step that removes the most obvious freebie.

If you want to see where your site stands overall, the free security check looks at your site from the outside and tells you what stands out. For the full list of things worth fixing, the hardening checklist is a good next read.