@wpforo-support 

Firstly, thank you for your reply. I probably didn't explain what I wanted to say clearly enough.

Now, let's take it step by step.

I thought I could avoid the problem of the login being displayed in the URL if I purchased "wpForo - User Custom Field"  add-on. With its help, I could add a "nickname" field to the wpWoro registration form. However, after reading the topics related to my question on this forum, I came to understand that this add-on would not solve the problem. This is because the "nickname" field in this add-on would make changes to the table $wpdb->usermeta. And then the following would happen

It described the problem that makes it impossible to change the wpForo user nickname (URL identifier) in the WordPress panel. And, accordingly, adding the add-on's "nickname" field will not solve the problem. And clearing the cache won't help.

Now, I know that WordPress uses user_nicename to display URLs. I also know that if you don't specify user_nicename during registration, WordPress will set it equal to your login. But I was hoping that the add-on's “nickname” field would make changes to user_nicename. Alas, this is not true.

The question is precisely how to set the URL identifier during registration using the wpForo registration form, i.e., to set user_nicename.

You have written everything correctly here.

Posted by: @wpforo-support

↑

To address privacy concerns, some users disable editing of the nicename and keep it in sync with the display name using custom code or hooks. But there is no ready-made hook or setting in wpForo to replace the URL identifier with the usermeta nickname.

But there is no need for any WordPress plugins, as you say here

Posted by: @wpforo-support

↑

For more control over usernames and nicknames, you might need custom development or WordPress plugins.

There really is a need for a hook.

There are some fairly trivial ways to solve this problem. It is possible to simply add a hook to the body that registers the user using the wpForo register form with the 'user_register' parameter and userdata 'user_nicename'. At the same time, add an additional "nickname" field to the registration form and add validation for its data so that there are no matches for 'user_nicename'.

Since I am not a coding specialist and my knowledge is limited to basic knowledge and understanding of the C language, and is also long forgotten, as I learned it in the distant past, I was interested in the question: where can I find a function that describes the registration hook using the vpFor registration wrapper? Because it would take a considerable amount of time to analyze your plugin and find it myself.

Since I am limited in time to solve this problem, I have decided to solve it as quickly as possible for myself - during registration, a random set of numbers is entered in 'user_nicename', and I have also added a "nickname" field to the registration form, which sets the user's nickname so that people can immediately claim it for themselves. At the same time, the "nickname" must also be recorded in the 'display_name' field because your function.php file is set to display either 'display name' in the forum footer after registration. Of course, also possible simply remove the display of 'display_name' or replace it with the same 'user_nicename' from random numbers. After that, I plan to ask them to go to their profile and manually change the "URL identifier" field to the nickname they have chosen. Also, one can try working with the hook 'pre_user_nicename', which filters the 'user_nicename' before the user is created or updated, so that the modified value can be returned later. But I think that people who develop add-ons for WP understand this better than I do and know all the possible ways to implement it.

Of course, this is a very monkey solution, but it can be implemented with minimal knowledge and with a few dozen lines of code in less than an hour.

However, now after updating wpForo, I will have to add this to the code every time, which is inconvenient.

Here's the topic where a person writes that he has created a community of elderly people who are not very tech-savvy, and they mistakenly entered their email addresses in the "Login" field, and now they are displayed in the URL.

Currently, emails, phone numbers, and simple character sets are used as logins for registration on various platforms, so it is not surprising that users may mistakenly enter their email address in the "login" field.

Firstly, considering how data protection legislation has changed, forum owners could be liable to pay large fines for displaying email addresses in this way. As a result, people are moving to other platforms and other developments in order to build their communities, and you, in turn, are losing potential customers.

Secondly, if I registered on a platform and saw that my email address or phone number was displayed in the address bar, I would never return to that site and would advise other users not to do so either. This, in turn, leads to a decrease in interest in wpForo, which, in turn again, reduces the number of your potential customers.

Just because WP considers displaying nicknames to be normal does not mean that their policy is ideal. A known nickname is already 50% of what is needed for brute force.

Okay, even if you take all the necessary security measures, such as 2FA and others (which is the only way to avoid brute force attacks, as claimed by WP), and avoid the possibility of password guessing. Also, people usually set up the same logins for different sites, which again puts them at risk of hacking, only on a other site (if that site has not taken the necessary security measures). And this again deters users.

Also, there is still the issue of data protection legislation.

Let's assume that I install all the necessary protections, but what should I do about sensitive user data becoming public?

In fact, it is no longer just an addition, but a default requirement. Because сurrently, even the "wpForo - User Custom Field" does not allow you to avoid such situations for the reasons I have already outlined.

As a quick example, here are a few more topics where users write that they have encountered the problem of disclosing sensitive data.

https://wpforo.com/community/how-to-and-troubleshooting-2/how-to-change-the-default-mention-name/

https://wpforo.com/community/how-to-and-troubleshooting-2/display-name-default-to-username/

https://wpforo.com/community/how-to-and-troubleshooting-2/display-wp-username-by-default/

You can also find many pages in the web where people write that the VP policy in this respect is not ideal and sometimes causes problems. Indeed, most services today display the user's nickname in the URL, but it is not the same as the login and, moreover, does not display any sensitive data that may have been entered by mistake.

However, initially, the people who register with WP are those who will be developing the website, and they can change their 'user_nacename' in the database before anyone visits their profile. Forum users, however, will not have this option, so this issue falls to the forum owners.

In fact, wpForo is an excellent tool for creating a community, and it is obvious that a lot of effort has been put into its development. However, the problem with the possibility of sensitive data disclosure deprives it of many advantages over its competitors and, in specific cases, even makes it to an extent unsuitable for use.

If this were an obsolete project, then there would be no questions, but you support it, correct errors, refine it, and make other changes. So it's not entirely clear why you are disregarding issues related to data disclosure for such a considerable time, because they are really important. Especially since solving them does not require a lot of time and effort.

After all, these are your potential customers who want to use your product but are facing obstacles due to legislation and other factors.

For the rest, you have a really great product.

The questions I asked at the beginning of this thread remain unanswered for now.

1.

So, I wish I were wrong and knew that this problem would somehow be solved, but as I understand it, you don't plan to change anything with the display of the login in the URL. However, in our reality, the login is displayed by default, despite the fact that technically the nickname is displayed there.

That's right?

2.

Where and how can I find the vpForo hook that is responsible for user registration and make changes to the vpForo registration form, as a result of which, when a user registers, the data they enter (for example, from the custom field "login" that I will add to the registration form or registration page wrapper) is recorded in the 'user_nicename' field of the $wpdb->users table?

Best regards!