If you are staring at Users > Profile because WordPress will not let you edit the Username field, you are in the right place. You can fix the login name safely without losing your posts or locking yourself out: create and test a replacement Administrator, move the old user’s content to it, and then remove the old account. This guide walks you through that safest option, plus a plugin and a phpMyAdmin method when they better fit your situation.
TL;DR: Create and verify a replacement Administrator, then delete the old user and attribute the old user’s content to the replacement account. Use a maintained plugin when you need to keep the same user record, and use phpMyAdmin only after making a verified database backup.
Changing a username alone does not stop automated login attacks. Read about WordPress login security for the broader picture, then protect the login with a unique password, two-factor authentication, WordPress login protection, login controls, and a firewall as well.
Before changing the username
Make a current backup of your site files and database. A backup plugin can help automate that protection. The database is the structured storage area that holds WordPress content, settings, and user records. Keep a second Administrator session or tested hosting restore process available until the new account works.
Confirm what you want to change. The login username is the name used to sign in. The display name is the author name shown to readers, while the nickname and author URL are separate settings. Changing the login username does not automatically hide the author’s identity or change every author page.
The steps below assume a single-site WordPress installation. Multisite can manage users and permissions across a network, and connected services may refer to a user’s account ID or login name. Ask the network administrator before changing a multisite account.
Note ⚠️: Do not delete the only working Administrator before you have tested the replacement account. That mistake can leave you without normal dashboard access.
Method 1: Create a replacement Administrator
This is the best choice for most site owners because it uses the normal dashboard and lets you test the new login before removing the old one. It creates a new user record rather than changing the existing record.
Add the replacement account with the right access
Open the user-creation screen: In the WordPress dashboard, go to Users > Add New.
Enter a new login and reachable email: Choose the username you want to use, create a strong unique password, and enter an email address you can access. WordPress cannot attach the same email address to both accounts at the same time, so use another reachable address if the old account still owns your preferred one.
Match the old account’s permissions carefully: Choose Administrator only when the new account needs the same site-wide access. Give a lower role to anyone who does not need to manage settings, plugins, or other users. Select Add New User to finish.
Test the new login before removing anything
Open a separate login session: Log out of the old account, or use a private browser window, and sign in with the new username and password.
Check the replacement account’s access: Open the dashboard and confirm that you can reach the posts, pages, settings, and other areas you manage. If the login fails, fix the new account while the old account still exists.
Delete the old user and preserve its content
Open the user list: Go to Users > All Users, find the old account, and select Delete.
Choose content reassignment: WordPress asks what to do with content owned by the old user. Choose the option to attribute all content to the replacement account, then select the new user. Do not choose an option that deletes the content unless that is your clear intention.
Confirm the handoff and inspect the site: Finish the deletion, then open several posts and pages to confirm their author attribution. Check that the replacement account can still manage the site.
Reclaim the preferred email after deletion: If you used a temporary address, open the replacement account’s profile and change it to your preferred address. The old account must be gone before WordPress will accept an address that was attached to it.
Note 🔗: Some integrations store the old user’s account ID. Review connected services, editorial tools, and automation after creating a new account.
Method 2: Use a maintained username plugin
A username plugin can change the login name on the existing user record. This can help when an integration or ownership record must keep the same account ID. It also avoids the content handoff required by the replacement-user method.
Change the existing login through a plugin
Check the plugin before installing it: Choose a plugin with recent maintenance, clear documentation, and compatibility with your WordPress and PHP versions. Do not rely on an old tutorial or assume a familiar plugin is still safe to use.
Keep a recovery path available: Retain the backup and another working Administrator or hosting recovery method until the new login works.
Install the current plugin version: From the dashboard, open Plugins > Add New, review the plugin details, and install and activate it. The update action may appear under Users or on the user-edit screen.
Apply and verify the username change: Select the target user, enter the new login name, review any email-notification setting, and save. Log out, sign in with the new name, and check the role, author attribution, and connected services.
Remove the plugin when it is no longer needed: If the plugin does not provide an ongoing function, deactivate and delete it after confirming the new login works.
The exact menu labels depend on the plugin and its current version. If you cannot verify that the plugin is maintained and compatible, use the replacement-user method instead.
Method 3: Change the username in phpMyAdmin
phpMyAdmin is a browser-based tool for managing MySQL databases, which store your WordPress site’s content and settings. It can change a login name directly, but it is the easiest method to apply to the wrong site or wrong user. Use it only when the dashboard options are unsuitable and you can identify the correct database.
Back up and identify the correct database
Export a fresh database backup: Save a copy before editing anything. Make sure you know how to restore it or how to ask your host to restore it.
Confirm the site database and table prefix: WordPress stores the database name and table prefix in wp-config.php or the hosting configuration. The prefix is the text placed before each WordPress table name, and it may not be wp_. A users table could instead look like site_users or abc_users.
Select the matching users table: In phpMyAdmin, choose the database used by this site, then open its users table. Hosting panels may list several databases, so confirm the site before editing.
Edit only the intended login field
Verify the exact user row: Find the account by checking the current login name along with another detail, such as the email address or user ID. A user ID is the number WordPress assigns to distinguish one account from another.
Change the sign-in name only: Select Edit and replace the value in user_login, the field that stores the login username. Do not change the user ID, password, role data, or unrelated user settings.
Save and test in a private window: Save the row, open the WordPress login screen, and sign in with the new username. Check the dashboard and several pieces of content after logging in.
If you cannot verify the database, table prefix, and user row, stop and use the dashboard method or ask your host or developer for help. Several untracked database edits can make recovery harder.
Note 🛠️: Changing user_login is not the same as changing the display name, nickname, or author URL. Edit only the field needed for the login change.
What makes a good WordPress username?
Choose a username that is not an obvious default, common role name, or piece of personal information. Make it memorable enough to store in a password manager, but do not treat it as a secret. Public author pages, site behavior, or a login form that accepts email may still reveal or suggest the account identity through user enumeration.
Change the username when you need to correct an unsafe default, an inherited account, a spelling mistake, or an ownership change. Do not rotate Administrator usernames on a schedule just for obscurity. The risk of deleting or misconfiguring an account can outweigh the small security benefit.
Does changing the username secure WordPress?
Only marginally, if at all. A less obvious username removes one easy guess, but it does not stop automated login attempts. Strong protection starts with a unique password and two-factor authentication, or 2FA, which asks for a second proof of identity after the password.
Add login controls that slow repeated failed attempts, a WordPress firewall, regular updates, and malware monitoring. These controls help protect your website from hackers; a new username alone does not.
MalCare can help with that broader WordPress security work through login protection, firewall and bot controls, two-factor authentication, malware scanning, and alerts. It is not required to change a username, and it does not make the username private.
Note 🛡️: Do not change a username and assume the site is protected. Review administrator passwords, 2FA, updates, and login protection as a separate checklist.
Conclusion
For most WordPress sites, create and test a replacement Administrator, move the old user’s content to it, and then delete the old account. A maintained plugin can preserve the existing user record, while phpMyAdmin is a last resort for people who can safely identify and edit the correct database row.
Changing the login username is useful housekeeping, but it is not a complete security measure. After the change, use a unique password, two-factor authentication, login protection, updates, and malware monitoring; a WordPress security maintenance checklist can help keep those protections in place.
For broader ongoing maintenance, follow a WordPress maintenance checklist.
