Generate unique, randomised user IDs to improve the security of your WordPress site.
This plugin randomizes the ID for the user created during WordPress setup. It will also allow randomizing the ID of any user created afterwards, once an already-proposed patch to WordPress core gets merged.
Why
Attackers always try to take advantage of any information they know about a site. There is something common to all WordPress sites: they are created with an administrator user with ID=1, and the rest of the users are numbered after it: 2, 3, 4, 5…
A good administrator will remove that first user and create a new one with another ID, but the fact that IDs are assigned in a serialized way is something that can be used against us.
While attending WordCamp Madrid 2017 I listened to Tomás Sierra‘s talk on WordPress site security and took note of this problem. That inspired me to build this small plugin, which I started the next day at that WordCamp’s Contributor Day.
How it works
Once activated, the plugin immediately replaces the ID for the default admin user (user ID 1). By default it uses random user IDs between 1 and 4503599627370495, to ensure compatibility with JavaScript code using the user ID. All users created from that moment on receive a random user ID within the defined range.
How to customize the range
You can tune the range of generated IDs with the dfx_random_user_id_max_id and dfx_random_user_id_min_id filters. For example, to keep all your IDs between 1000 and 9999, add these lines to your theme’s functions.php file:
function set_dfx_max_user_id( $default_max_id ) {
return 9999;
}
add_filter( 'dfx_random_user_id_max_id', 'set_dfx_max_user_id' );
function set_dfx_min_user_id( $default_max_id ) {
return 1000;
}
add_filter( 'dfx_random_user_id_min_id', 'set_dfx_min_user_id' );
Code language: PHP (php)You will probably want to add these lines before activating the plugin, so your new main admin user ID also falls within the desired range.