Can people see my WordPress usernames?

Short answer: often, yes. Out of the box, WordPress can list user accounts at /wp-json/wp/v2/users and through author pages like /?author=1. That hands anyone the usernames to try passwords against.

How to check it yourself

Open https://yourdomain.com/wp-json/wp/v2/users in a private window and look for usernames.
Try https://yourdomain.com/?author=1 and see whether the address changes to show a username.
Use a security plugin or a small code snippet to hide user listings from logged-out visitors.
Make sure every account has a strong password and two-factor sign-in.

Why it matters

A login needs a username and a password. If your usernames are public, attackers only have to guess the password, and automated tools try common passwords against every name they find. Hiding usernames isn't a defence on its own, but it removes half of the guessing.

Common causes

WordPress's REST API lists users by default.
Author archive pages show the account name in the address.
The display name is set to the login name.
A theme shows author names linked to their archive pages.

What Preventionlabs shows

For WordPress sites, every report checks from outside, without logging in, whether user accounts are listed publicly and whether xmlrpc is open, and checks the WordPress version and the plugins it can see against their latest releases. It reports the display names it finds, not login names.

Price

First report free, no card needed. Then A$50 a month, up to 10 domains.

Run your first report free