A few months ago, one of my clients messaged me in a panic. His WordPress site was acting weird, and his admin email had been compromised. As someone who builds and maintains WordPress sites every day, I took it seriously — and what I discovered while fixing his site alarmed me.
Hackers have more ways to find your WordPress admin email than most site owners realize. And once they have it, they can reset your password, lock you out, send phishing emails to your users, or use your site to spam others. This article explains exactly how they do it — and how to stop them.
Why Hackers Want Your WordPress Admin Email
- Password reset attacks – With your email, they can trigger a password reset and lock you out of your own site
- Phishing campaigns – They impersonate you to trick your users into giving up credentials
- Spam operations – Your domain’s email reputation gets weaponized to send bulk spam
- Targeted brute-force attacks – Your email doubles as your login username on many sites
Method 1: Author URL Enumeration
WordPress exposes author archives by default. A hacker can visit yoursite.com/?author=1 and WordPress will redirect to a URL containing your username — and often your display name. From your username, they can guess or find your email via other exposed sources.
Fix: Install a security plugin like Wordfence or iThemes Security and disable author enumeration. You can also add this to your .htaccess:
# Block author enumeration
RewriteCond %{QUERY_STRING} ^author=d
RewriteRule ^ /? [L,R=301]Method 2: The WordPress REST API
WordPress’s built-in REST API exposes user data publicly. Visiting yoursite.com/wp-json/wp/v2/users will often return a JSON response containing usernames and sometimes email addresses of all users.
Fix: Restrict the users endpoint. Add this to your functions.php:
add_filter('rest_endpoints', function($endpoints) {
if (isset($endpoints['/wp/v2/users'])) {
unset($endpoints['/wp/v2/users']);
}
return $endpoints;
});Method 3: Exposed Contact Page or Comments
If you’ve ever left a comment on your own site using your admin email, or published your admin email on your contact page, it’s now publicly indexed by Google — and harvestable by email scraper bots within hours.
Fix: Never publish your admin email publicly. Use a separate contact address (e.g., contact@yourdomain.com) for public-facing communication. Use a contact form instead of a raw email address.
Method 4: WHOIS Lookup
Domain WHOIS records sometimes expose the registrant’s email address. If your domain was registered without WHOIS privacy protection, your email is publicly available in WHOIS databases.
Fix: Enable WHOIS Privacy / Domain Privacy on your domain registrar. Hostinger, Namecheap, and most registrars offer this for free or a small fee.
Method 5: Login Page Exposure
WordPress’s default error message on the login page will confirm whether an email address is registered. Hackers test thousands of emails against your login page to verify which ones belong to real accounts.
Fix: Add generic login error messages by adding this to functions.php:
add_filter('login_errors', function() {
return 'Invalid credentials. Please try again.';
});Method 6: Data Breach Databases
If your email has been part of any past data breach (have you checked HaveIBeenPwned?), hackers can find your email in breach databases. They then target your email across multiple platforms including your WordPress login.
Fix: Check your admin email at haveibeenpwned.com. If it’s been breached, change your admin email immediately and use a unique email address that you don’t use anywhere else.
Quick Protection Checklist
- ✅ Disable author enumeration
- ✅ Restrict REST API users endpoint
- ✅ Never publish your admin email publicly
- ✅ Enable WHOIS privacy on your domain
- ✅ Use generic login error messages
- ✅ Use a unique admin email not used elsewhere
- ✅ Enable two-factor authentication (2FA) on your admin account
Frequently Asked Questions
Can I change my WordPress admin email without losing access?
Yes. Go to Settings → General and update the Administration Email Address. WordPress will send a confirmation to the new email before making the change.
Is it safe to use my admin email as my WordPress username?
No — using your email as a username doubles the exposure. Create a separate admin username and keep your email private.
What’s the most important step to protect my admin email?
Enable two-factor authentication. Even if a hacker gets your email and password, 2FA makes it nearly impossible to complete the login.
