wpForo shows Display Names of users. This cannot be restricted. The unique restriction is made for Nickname and Usernames, but not for Display Names.

WordPress and wpForo have three different names for Users:

• Username (Login) – Being used for forum authorization (login, sign-in) action
• Display Name – Other users and guests see in user profile details and next to user posts (post author name).
• Nicename – Unique name which is used in WordPress and wpForo core to generate user Profile URL. In other words this is the user slug. For example example.com/community/profile/martin59/.

After a regular user registration process, Username, Display Name and Nicename are set the same. For example If you register a user with “Martin59” Username your user names look like this:

• Username – Martin59
  
• Display Name – Martin59
• Nicename – martin59

And profile URL will be example.com/community/profile/martin59/

This is insecure, because profile URLs are public and hackers can see the martin59 part. Using this part (Nicename) they can detect the Username and try to login with different passwords. In this way they can also find Administrator username and your website will be under the risk.

In order to fix this security issue, wpForo has “Display Name” and “Nicename” fields in Forum > My Profile > Account font-end page. Using this options you should change the Display Name and  Nicename to something like this:

• Username – Martin59
• Display Name – Martin P.
• Nicename – martinos

This is a secure way to configure User Names.