Title: User ID’s
Last modified: May 1, 2021

---

# User ID’s

 *  [tequenikality](https://wordpress.org/support/users/tequenikality/)
 * (@tequenikality)
 * [5 years, 3 months ago](https://wordpress.org/support/topic/user-ids-2/)
 * Hi guys;
 * I’ve been using WordPress for 2 years now, and recently one of my sites was compromised
   by a plugin that a contractor I hired installed. It had malicious code in it 
   that changed the password of User ID #1 (the admin) and demoted all other users
   to subscribers.
 * To me, this highlighted a flaw in the design of WordPress in that the ID’s of
   users is predictable, beginning with #1 for the initial admin and going onward,
   potentially toward customers’ accounts and data.
 * Would it not be prudent to use unique ID’s? For example, I had the idea to make
   a plugin that hooks into user creation and changes the ID to 16-char alphanumeric(
   a-z & 1-9) tokens – but I ran into a snag in that WP’s database by default is
   configured to INT. To do my idea, it needs to be configured to CHAR(16) and I
   don’t know how to do that safely because I’m new to web development.
    -  This topic was modified 5 years, 1 month ago by [Jan Dembowski](https://wordpress.org/support/users/jdembowski/).
 * The page I need help with: _[[log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fuser-ids-2%2F%3Foutput_format%3Dmd&locale=en_US)
   to see the link]_

Viewing 3 replies - 1 through 3 (of 3 total)

 *  [catacaustic](https://wordpress.org/support/users/catacaustic/)
 * (@catacaustic)
 * [5 years, 3 months ago](https://wordpress.org/support/topic/user-ids-2/#post-14104455)
 * If someone already has access to the database (eg: malicious code as in yur example)
   they don’t care or need to know the ID’s because it will just read them from 
   the database table anyway, no matter what they are. The progression in integers
   isn’t always linear anyway. Users get deleted, so those numbers are removed, 
   and that would break anything that was coded to do things in the way that you’re
   thinking.
 * The big thing is that what you’re proposing wouldn’t make any difference to security
   or make it harder for hackers. It may mean it takes 1/1000th of a second longer
   for their processes to run, but that’s all that you’d do to upset them.
 *  Thread Starter [tequenikality](https://wordpress.org/support/users/tequenikality/)
 * (@tequenikality)
 * [5 years, 3 months ago](https://wordpress.org/support/topic/user-ids-2/#post-14105063)
 * That’s not entirely the case. You’re thinking as an experienced coder – not everyone
   is. For example, the script that compromised my site was hard-coded with User
   ID #1, no detection or anything. And indeed, I wouldn’t know how to retrieve 
   a recursive list of all ID’s in a timely manor.
 * Would it stop a professional hacker? No not even close. But it’s a stumbling 
   block. The key to security isn’t necessarily to make it IMPOSSIBLE to hack something
   because that in of itself is impossible – it’s to make it so difficult that it
   isn’t worth a pro’s time for the potential gains.
 * Besides, if a user submitted the function to randomly generate ID’s and there
   were no egregious language errors for example, would there be a specific reason
   to reject it? Perhaps it’s security gains are only small, but they are there 
   nonetheless. The change wouldn’t worsen security or cause an inconvenience for
   users, would it?
    -  This reply was modified 5 years, 3 months ago by [tequenikality](https://wordpress.org/support/users/tequenikality/).
 *  Moderator [Jan Dembowski](https://wordpress.org/support/users/jdembowski/)
 * (@jdembowski)
 * Forum Moderator and Brute Squad
 * [5 years, 3 months ago](https://wordpress.org/support/topic/user-ids-2/#post-14122734)
 * > To me, this highlighted a flaw in the design of WordPress in that the ID’s 
   > of users is predictable, beginning with #1 for the initial admin and going 
   > onward, potentially toward customers’ accounts and data.
 * >  Would it not be prudent to use unique ID’s? For example, I had the idea to
   > make a plugin that hooks into user creation and changes the ID to 16-char alphanumeric(
   > a-z & 1-9) tokens – but I ran into a snag in that WP’s database by default 
   > is configured to INT. To do my idea, it needs to be configured to CHAR(16) 
   > and I don’t know how to do that safely because I’m new to web development.
 * It really isn’t the case. After a while it becomes passwords on top of passwords
   to log into a WordPress site. If you make the user ID a 16-char alpanumeric then
   you don’t have a user ID, you have another password. How many secrets are needed
   to log into a site?
 * When you log into anything there’s at least two parts. The public part which 
   is your user ID and/or your email. It’s desirable that that part be something
   the user will easily recognize and use.
 * When asked, people will hand out their email address. It’s a good use of public
   facing data. Yes, you don’t post email addresses publicly as that’s a great way
   to get spam. All users should assume that the user ID is public.
 * Then there’s the password and that should be something difficult to guess like`
   freh_gin3knif!PROX`. That should be something hard to guess. And you can add 
   two factor authentication for additional security if you’re worried about it.
 * [https://wordpress.org/plugins/search/two+factor/](https://wordpress.org/plugins/search/two+factor/)
 * Two factor authentication is attractive because you get a user ID (identity),
   a password (what you know) and a token from an app (what you have).
 * If a “hacked” account still gets into your site even with two factor authentication
   then it’s not a hacked account. The account owner is messing with you.

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘User ID’s’ is closed to new replies.

## Tags

 * [database](https://wordpress.org/support/topic-tag/database/)

 * In: [Requests and Feedback](https://wordpress.org/support/forum/requests-and-feedback/)
 * 3 replies
 * 3 participants
 * Last reply from: [Jan Dembowski](https://wordpress.org/support/users/jdembowski/)
 * Last activity: [5 years, 3 months ago](https://wordpress.org/support/topic/user-ids-2/#post-14122734)
 * Status: not a support question

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics