Clever Members 1.14.341 keeps hackers from learning your administrators' usernames. It turns off WordPress's built-in sitemap, author pages and XML-RPC. It also hides the public users list and the author's name in link previews. Every failed login and lost-password request gets the same answer, so bots can't tell a real username from a fake one. It's always on, needs no setup, and doesn't affect updates.
Why usernames matter
The latest Clever Members upgrade quietly closes the doors hackers use to learn your administrators' usernames. It works the moment you update, with nothing to set up.
A break-in attempt on a WordPress site needs two things: a username and a password. Out of the box, WordPress hands out the first half for free. It lists authors in its built-in sitemap and shows usernames in author page addresses. It also returns a public list of users through its API and tells anyone who tries to log in whether the username they typed is real.
Once a bot has a real username, it only has to guess the password. Taking the username away makes every one of those attacks far harder.
What the upgrade closes off
Version 1.14.341 shuts seven ways usernames leak out:
| Where usernames leaked | What happens now |
|---|---|
| WordPress's built-in sitemap (wp-sitemap.xml) and its list of authors | Turned off. Clever Members' own sitemap.xml keeps telling search engines about your pages and posts. |
| Author pages (?author=1 and /author/…) | Visitors who try them are sent to the home page. |
| The public users list in the REST API | Only people who are logged in can see it. |
| Link previews (oEmbed) | They no longer include the author's name or author page. |
| WordPress's login screen | One message for every failed login: “The username, email address or password is incorrect.” |
| Lost Password | Says “check your email” whether the account exists or not. |
| XML-RPC (xmlrpc.php) | Turned off. Bots used it to try hundreds of passwords in a single request. |
The Clever Members login form gets the same treatment. An unknown username and a wrong password now show the same “Invalid username or password.” The Restricted Notification page is only shown to members with the Waiting role, after they enter the correct password.
What stays the same
Nothing you use day to day changes. Plugin updates, Raya AI, and the page builder keep working, and so do your shopping cart, forms, invoices and payments. Logged-in administrators and members see everything they saw before. Account lock still works: three wrong passwords in a row still lock the account.
The only things that stop working are the WordPress mobile app and Jetpack, because both depend on XML-RPC. Clever Members doesn't use either one, and we don't recommend them for Clever Members websites.