Open your WordPress profile page and you will notice something odd: every field is editable except the username. It sits there greyed out with a note saying usernames cannot be changed. For many site owners this is just a curiosity, until the day they realize their login name is admin, or their first name, or an embarrassing nickname from years ago.
A bad username is more than a cosmetic problem. It is a security problem. Bots that attack WordPress login pages always try admin first, then common names. If your username is easy to guess, attackers already know half of your login credentials and only need to crack the password. Changing to an unguessable username is one of the simplest hardening steps you can take.
The good news is that you can change your WordPress username without installing any plugin. This guide shows you three methods: a safe no-database approach that works for everyone, a direct database edit for advanced users, and a one-time code snippet. We will also cover what to update after the change so nothing breaks.
Why does WordPress lock usernames?
WordPress uses the username as a permanent identifier in the database. Posts, comments, and settings all reference your user account through internal IDs, but the login system keys off the username string. The developers decided long ago that letting users rename themselves freely could cause confusion and edge-case bugs, so they locked the field in the profile screen.
The lock is only in the interface, though. The database itself has no problem with a changed username, which is why all three methods in this guide work. WordPress will not punish you for changing it, as long as you use a method that keeps your account, your content, and your permissions intact.
Why should you change a username like admin?
If your username is admin, administrator, your first name, or your domain name, change it. Automated attacks hammer wp-login.php with these exact guesses millions of times a day. A unique username does not replace a strong password, but it removes the easiest half of the guessing game.
This pairs well with other login hardening. Our guide on limiting login attempts without a plugin shows how to block brute force attacks at the door, and understanding WordPress user roles helps you assign the right permissions to the new account you are about to create. Together, an unguessable username plus limited login attempts makes your login page a very unrewarding target.
Method 1: create a new user and move your content (recommended)
This is the safest method because it uses only the WordPress dashboard. No database edits, no code, no risk of corrupting anything. You create a brand new administrator account with the username you want, transfer all your content to it, and delete the old account. It takes about five minutes.
Step 1: create the new administrator account
Go to Users, then Add New in your dashboard. Fill in the new username you want, a strong password, and an email address. Set the role to Administrator. Click Add New User. Pick a username that is not guessable: avoid your name, your site name, and words like admin or webmaster. Something like riverstone_editor_42 is far better than john_admin.
Step 2: log out and log in as the new user
Log out of WordPress completely, then log back in with the new username and password. This step is mandatory. WordPress will not let you delete the account you are currently logged in with, so you must be signed in as the new administrator before removing the old one.
Step 3: delete the old account and attribute its content
Go to Users, then All Users. Hover over the old account and click Delete. WordPress will ask what to do with that user’s content. Choose Attribute all content to, and select your new user from the dropdown. Confirm the deletion. Every post, page, and media item the old account owned now belongs to the new username.
That is the whole method. Your site is unchanged for visitors, all content is intact, and you now log in with the new username. If you also want a nicer public byline, visit Users, then Profile, and set a display name under your site identity settings. The display name is what readers see on posts, so it can be your real name even when the login username is unguessable.
Method 2: edit the username directly in phpMyAdmin
If you cannot create a second administrator, for example on a site where you only have one user and no spare email address, you can edit the username directly in the database. This method is fast but riskier, so take a full backup first. If you have never exported your database, follow our guide on backing up your WordPress database without a plugin before touching anything.
Open phpMyAdmin from your hosting control panel and select your WordPress database. Open the wp_users table and click Edit on your user row. Change the user_login field to the new username and save. Do not touch the user_pass field: the password is stored as a hash, and editing it as plain text would lock you out. The user_nicename field controls the author archive URL slug, and you can update it to match the new username if you like.
Log out and log back in with the new username and your existing password. Everything else, your posts, settings, and permissions, stays exactly the same because those are tied to your user ID, not to the username string.
Method 3: change the username with a one-time code snippet
If you are comfortable adding a small snippet and removing it afterward, this method changes the username programmatically without you ever opening the database. Add this code with a code snippets plugin, run it once by loading any admin page, then delete the snippet immediately:
global $wpdb;
$wpdb->update(
$wpdb->users,
array( 'user_login' => 'new_username_here' ),
array( 'user_login' => 'old_username_here' )
);Replace new_username_here and old_username_here with the real values, load one admin page to execute it, then remove the snippet. Leaving it active would re-run on every page load, which is harmless here but untidy. The official WordPress developer documentation explains the $wpdb class in detail if you want to understand what the snippet does before running it.
What should you update after changing your username?
The username change itself is quick, but a few follow-up steps keep everything consistent and secure:
- Update your display name under Users, then Profile, so your public byline shows what you want readers to see.
- Re-check any login security you had configured, such as two-factor authentication or login alert emails, since some of these tie to the username.
- If you use a password manager, update the saved login entry so autofill keeps working.
- Test the login from a private browser window to confirm the new username and old password work together.
- Review your user list to make sure no stray administrator accounts were left behind during the process.
Frequently asked questions
Will changing my username delete my posts?
No. With method 1, WordPress explicitly asks you to attribute all content to the new user during deletion, so nothing is lost. With methods 2 and 3, your content never moves at all because posts are linked to your internal user ID, which does not change. Your site looks identical to visitors either way.
Will my password change too?
No. With method 1, WordPress explicitly asks you to attribute all content to the new user during deletion, so nothing is lost. With methods 2 and 3, your content never moves at all because posts are linked to your internal user ID, which does not change.
Can I change the username back later?
Yes, using the same methods. With method 1, you would create another new user, attribute content to it, and delete the current one. With methods 2 and 3, you simply edit the value again. There is no limit on how many times you can do this.
Does changing the username affect my Google rankings?
Only if you also change the user_nicename, which controls the author archive URL. If your author archive pages are indexed by Google, changing that slug without a redirect could cause 404 errors. The login username itself is invisible to search engines, so changing only user_login has zero SEO impact. Learn more about how WordPress handles identity and URLs in the WordPress.org documentation.
Last updated: October 2026.
