If you use an SEO plug (like Yoast, for exampe), you can control your sitemaps.

To turn off the core sitemap altogether, click “discourage search engines” under SETTINGS->READING. Note that it will block crawling by searchbots.

@mariedi To address your point, no, username is not part of security.

The username is an identifier. It’s not a secret. The password is the secret, and the security lies there. Making your password stronger is far more important than having hard-to-find usernames.

I can explain this to you by example:

Imagine that username was to be considered secret. The general way people think about this is that two secrets are better than one. Twice as hard to login, right? Hackers must crack two fields instead of just one.

However, if two secrets are better, then we could say that instead of having secret usernames, we could keep the username not secret and simply add another password field. Usernames are already not stored hashed, and we find them useful for user listing pages and so on, so simply having a second password is the same thing as having both of them be secret. It’s the same security, since hackers still have to crack two fields.

But remembering two passwords is tricky, so we want password managers to be able to remember them for us. No password managers remember two password fields on a page. So for simplicity, let’s combine those two passwords into one field, so that it can be password1+password2. Then password managers can remember our long combined password and even put it in for us.

So, now we have one username field, and one big long password field. Voila, more secure. 🙂

See, having more secrets doesn’t help security any, because the existing password can be of any length. WordPress will take a password up to 4096 bytes long, so simply making it unguessably long isn’t that hard to do. Using a secure password manager means that it doesn’t need to be remembered either. And username, is thus, irrelevant.

Note that we’re not the only ones who feel this way. Your username here is that @name beside your posts. Your username on Twitter is right in your URL. Your username on reddit is your handle there. Your username for Facebook is in your URL, although Facebook, like Google, doesn’t really use usernames for logging in, they just use your email address to login. Is your email address also a secret? Because everybody who you send an email gets your email address, and you use it as part of the login on most sites nowadays.

Drupal feels the same way: https://www.drupal.org/drupal-security-team/security-team-procedures/disclosure-of-usernames-and-user-ids-is-not-considered

Basically, your password is the security. Make it long and strong. Making a system require multiple secrets doesn’t increase security. Adding a second type of security, like two factor does, can increase security, and there are two factor plugins you can use if you need that. We’ve been trying to build two factor into WordPress for a long time, but it’s complicated, so it’s not on the roadmap right now.

I hope that helps you to understand. If you want to remove the users sitemap, it’s three lines of code I already gave you. But removing it is *not* a security improvement.

I just can’t understand why this has been implemented without a UI and optional settings.

The basic sitemaps feature has no UI or settings because it doesn’t need one. I’m sure plugins will exist soon enough to let people customize them and adjust them and so on, but by and large, most users should not care about sitemaps. It’s not relevant to them.

Like the built-in RSS feeds and so on is intended for feed readers, the functionality of a sitemap is intended for search engines. It’s not meant for users to see or care about. WordPress makes a lot of pages and URLs that lead to those pages. Giving search engines a sitemap lets them index those pages faster and better, eliminating excessive crawling. The sitemap itself doesn’t even need to look pretty in a browser, that’s generally done for aesthetics only. It doesn’t need any configuration because people who write posts and publish them to their website should want search engines to see them.

If you are the kind of person who needs control over every detail, then plugins will exist for just that purpose. You will be able to pick and choose what is displayed using them, and you’ll have your choice of interfaces to do so. I’m sure that is coming very soon.

But for the basic core functionality of sitemaps existing, no custom settings are required or necessary.