Brute force attack off user names in directory

Sorry to hear about your issue.

It’s worth noting that BuddyPress doesn’t directly use user_logins in the directory and elsewhere in the interface. Instead, it uses the user_nicename value, which matches user_login by default, but need not; plugins like https://www.ads-software.com/plugins/edit-author-slug/ allow user_nicename to be customized.

The issue of user_nicename being public is not limited to BP. WordPress itself uses user_nicename to build author archives (example.com/author/felty, etc). As such, it’s not considered private information by WP, though your situation indicates that this can sometimes result in unpleasant enumeration attacks.

Good luck as you set up your site.

So as much as Boone Gorges tells it here – he’s not giving a fuck. That’s what you often have when it comes down to security and buddypress.

Well… Although I liked the way BuddyPress worked, it just got really bad because not all users will do this for themselves and keep the user names the same.

But ProfileGrid allows you to have better privacy between users and you can set profiles to be private by default:

https://www.ads-software.com/plugins/profilegrid-user-profiles-groups-and-communities/

This is a major issue – they should not have a default that reveals usernames. While this could be WP core’s responsibility it should not be because it would require additional friction when creating an account. BP should *not* reveal usernames in its directory – that’s just a dumb, dumb security decision.

How are you doing with ProfileGrid? It looks like a nice alternative to BP (which, tbh, has always seemed a little ‘off’ in its usability).

I had similar problem but I fixed this by disabling login with usernames and only enabled login by email address, I also use a plugin called email address encoder for additional safety. brute attacks should only happen if the email address is revealed publicly.