wpForo shows Display Names of users. The Display Name is not Nicename nor Username.

WordPress and wpForo have three different names for Users:

• Username (Login) – Being used for forum authorization (login, sign-in) action
• Display Name – The Display Name is what shows up next to a user’s posts, as well as on their Profile page.
• Nicename – Unique name which is used in WordPress and wpForo core to generate user Profile URL. In other words this is the user URL /path/. For example example.com/community/profile/martin59/.

After a regular user registration process, Username, Display Name and Nicename are set the same. For example If you register a user with “Martin59” Username your user names look like this:

• Username – Martin59
  
• Display Name – Martin59
• Nicename – martin59

And profile URL will be:

 example.com/community/profile/martin59/

This is insecure, because profile URLs are public and hackers can see the martin59 part. Using this part (Nicename) they can detect the Username and try to login with different passwords. In this way they can also find Administrator username and your website will be under the risk.

In order to fix this security issue, wpForo has “Display Name” and “Nicename” fields in Forum > My Profile > Account font-end page. Using this options you should change the Display Name and Nicename to something like this:

• Username – Martin59
• Display Name – Martin P.
• Nicename – martinos

This is a secure way to configure User Names.