WordPress does not let you edit a username after an account is created. SmartUsername adds a screen under Users > Change Username that renames an existing account in place, so posts, comments, roles, passwords and user meta stay attached to the same user. Features Exposure check : one card shows eve
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 5.3 and PHP 7.0.
SourceWordPress plugins · Oct 20, 2026
01 / Source details
About this tool.
WordPress does not let you edit a username after an account is created. SmartUsername adds a screen under Users > Change Username that renames an existing account in place, so posts, comments, roles, passwords and user meta stay attached to the same user.
Features
Exposure check : one card shows every place your login names are visible (REST API users list, ?author=1 lookups, users sitemap, embeds, author URLs, login error messages, display names) with a Hidden or Exposed verdict, and a button for each fix.
Login name protection : one switch closes those places to visitors. Logged-in authors and editors keep the block editor tools. An optional switch turns off author archives for sites that do not need them.
Trap usernames : names nobody uses, like admin, and old names you keep after a rename become traps. Login attempts with them are refused and counted on a Dashboard widget, “Login attacks caught”. No IP addresses are stored.
Fix author slugs : one click gives every author whose public URL shows the login a new slug based on the display name.
Rename any user : pick the account from a list, or use the “Change username” link on the Users screen or next to the Username field on the profile screen.
Security check : warns on the Dashboard and Users screens when an account uses a username that login attacks guess first (admin, administrator, root, your site name and similar), with a one-click Rename button. The notice can be dismissed and only returns if something new is found.
Email the user : optionally send the renamed user a short email with the old and new username and the login link.
Self-service (optional, off by default) : let chosen roles change their own username from Profile > Change Username, with a waiting period between changes.
WP-CLI : wp smartusername rename , wp smartusername check and wp smartusername log for agencies and scripts.
Live validation : as you type, the plugin checks length, allowed characters and whether the name is taken.
Same rules as WordPress core : at most 60 characters; letters, numbers, spaces and . – _ @ only; names blocked by the illegal_user_logins filter are refused.
Optional new author slug : the new slug comes from the display name, never the login. The old author URL redirects to the new one with a 301.
Safe sign out : renaming your own account asks you to confirm first. A renamed user’s open sessions are ended so they log in again with the new name. Email login keeps working.
Rename log : the latest 50 changes are listed on the screen, with who made each change (administrator, the user themselves or WP-CLI) and whether the email was sent. You can clear it at any time.
Clear errors : anything that cannot be saved is reported in an admin notice and nothing is changed.
Clean admin screen : built from core admin styles, accessible labels and live regions. Works without JavaScript. Styles and scripts load on this screen only.
Security
Only users with the manage_options capability ( manage_network_users on multisite) can rename other users, and only users they are allowed to edit.
Self-service is off until an administrator turns it on and picks the roles.
Every form and the live check are protected by nonces.
Input is validated with sanitize_user() in strict mode and validate_username() ; output is escaped.
Network super admin usernames are not changed on multisite.
External services
The Exposure check card has a link, “Check from outside with the free Username Exposure Checker”. It opens a free tool on digitalpritam.in in a new tab with your site address filled in. Nothing is sent until you click the link. The tool then reads only public pages of your site (such as the REST API users list and author URLs) and shows what it found. The plugin itself never contacts this service. Tool: https://www.digitalpritam.in/tools/wordpress-username-checker/ Privacy policy: https://www.digitalpritam.in/privacy-policy/
Privacy
SmartUsername does not send any data off your site and does not track anything. The rename log (old and new usernames, author slugs, user IDs and the time) is stored in your own database and is removed when you delete the plugin. The optional notification email is sent by your own site through wp_mail() to the renamed user only.
For developers
Action smartusername_username_changed( $user_id, $old_username, $new_username, $change ) fires after each rename.
Filter smartusername_log_limit changes how many log entries are kept (default 50).
Filter smartusername_notification_email changes the email (to, subject, message, headers).
Filter smartusername_risky_usernames changes the list used by the security check.
Rename a user with the live check and keep the old name as a trap. The Exposure check shows where login names leak, with a fix for each.Login name protection switched on: every check is green and the verdict is Hidden.The "Login attacks caught" Dashboard widget and the security check notice.The rename log and self-service settings.
02 / Source details
Getting started.
01Upload the smartusername folder to /wp-content/plugins/ , or install it from Plugins > Add New.
02Activate the plugin through the Plugins screen.
03Go to Users > Change Username.
03 / Source details
Frequently asked questions.
Who can change usernames?
Administrators with the manage_options capability. On multisite, usernames are shared by the whole network, so the manage_network_users capability is required.
Can I change another user’s username?
Yes. Choose the user in the list, click “Change username” under their name on the Users screen, or use the button next to the Username field on their profile.
Can users change their own username?
Only if you allow it. Go to Users > Change Username, tick “Allow users to change their own username” in Self-service renames, choose the roles and set the number of days between changes. Those users then see Profile > Change Username.
Will the user be told about the change?
Tick “Email the user their new username” and they get a short email from your site with the old and new username and the login link. If your site cannot send email, the screen tells you so.
Why does it warn me about the username admin?
Automated login attacks try usernames like admin first. Renaming that account means an attacker has to guess the username as well as the password. You can dismiss the warning.
Can I change my own username?
Yes. Tick the confirmation box. You are signed out and log in again with the new username or your email address.
What characters are allowed?
The same as WordPress core: up to 60 characters, using letters, numbers, spaces and . – _ @. Anything else is rejected with a message and nothing is changed.
What happens to posts, comments and other data?
Nothing. They are linked to the user ID, which does not change.
Does the author URL change?
Only if you tick “Also update the author URL slug”. The old author URL then redirects to the new one with a 301. If you leave it unticked, public URLs stay exactly as they were.
Is the display name changed?
No. Edit the display name on the user’s profile if needed.
Can users still log in with their email address?
Yes. WordPress accepts the email address on the login screen, and renaming does not change it.
Does it work on multisite?
Yes, for users who are not network super admins. Activate it on each site where you need it, or network activate it.
The outside checker says Partly hidden. Why?
Your theme probably links to author pages, so author slugs are public. After “Fix author slugs” they are based on display names, not logins, which is why the plugin says Hidden. To keep author slugs out of public pages too, turn off author archives, if your site does not need author pages.
Will hiding login names break my site?
Visitors can no longer read the REST API users list, and ?author=1 lookups go to the home page. Logged-in users who can write posts still get the users list, so the block editor works as before. If another plugin needs the public users list, leave the switch off.
How do trap usernames work?
Nobody can log in with a name that no account uses, so every attempt with admin (when no admin account exists) or with an old name you kept is a bot. The plugin refuses it with the normal error and adds it to the “Login attacks caught” widget. If you later create a real account with that name, the trap stops applying to it.
What is removed when I delete the plugin?
The rename log, the settings, the trap names and counts, the stored old author slugs used for redirects and the small per-user markers for self-service and dismissed notices.
Website LLMs.txt and LLMs-Full.txt Generator is an LLMs.txt generator and llms-full.txt generator for WordPress. It helps site owners generate, manage, preview, validate, and serve AI discovery files from published public content. Use it to create structured /llms.txt and optional /llms-full.txt end
EngageDock AI is a customizable floating contact widget for WordPress websites that want more leads and faster visitor communication. It helps small businesses turn website traffic into calls, texts, emails, and callback requests from one clean contact panel. Key Features: Click-to-Call – One tap ca
Altify AI is an auto ALT text and AI ALT text plugin for WordPress images. It helps generate descriptive image ALT text for accessibility and image SEO. Use bulk image ALT text tools for your Media Library, generate featured image ALT text automatically, and scale WooCommerce image ALT updates with
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
