Skip to main content
Get the plugin

WordPress user enumeration

Make login names impossible to confirm.

Attackers probe ?author=1, REST /users, login errors, XML-RPC, sitemaps, and SEO URLs. EnumGuard closes those answers. Bylines stay public. Gutenberg stays intact.

Get the plugin Watch a probe →

The leak

WordPress answers when asked who exists.

A guessed login is half a brute-force attack. Core still confirms accounts through redirects, REST lists, and chatty form errors.

Probe

GET /?author=1

Anonymous request. No cookies. No guesswork required.

↓
Reveal

302 → /author/admin/

The login name is now confirmed.

↓
Next

wp-login.php · admin

Half the credential pair is already known.

Two identities

Hide the login. Keep the byline.

EnumGuard is not “anonymous authors.” It separates what attackers want from what readers need.

Login name

admin

Used at wp-login. Confirmed by author IDs, REST users, archives, sitemaps, oEmbed, XML-RPC, and SEO plugins — until EnumGuard closes those doors.

Blocked

Display name

Alex Hedström

Still prints under posts, in theme templates, and in the editor. Readers see a person. Attackers do not get a login oracle.

Allowed

Thirteen shields

Every probe surface gets its own switch.

Twelve on by default. Full XML-RPC disable stays off so Jetpack and the mobile app keep working.

Author ID queries

author_id_query

Stops ?author=1 from confirming a login.

On

Author archives

author_archives

Closes /author/{login}/ for anonymous hits.

On

REST users

rest_users

No public user list from /wp/v2/users.

On

Login errors

login_errors

Generic failures — no “invalid username” oracle.

On

XML-RPC users

xmlrpc_user_methods

Blocks remote user listing and probe methods.

On

SEO author URLs

seo_author

Yoast, Rank Math, The SEO Framework stay closed.

On

Sitemaps & oEmbed

user_sitemap · oembed_author

Author sitemap entries and oEmbed author URLs.

On

Classes & embeds

author_classes · rest_user_embeds

Login names out of body classes and REST embeds.

On

Disable all XML-RPC

xmlrpc_disable

Optional. Off by default for Jetpack / mobile app.

Off

How it works

Activate. Leave it on. Keep writing.

01

Install & activate

Add EnumGuard like any plugin. Twelve recommended protections start immediately.

02

Tune if you must

Settings → EnumGuard. Each protection is independent. Leave xmlrpc_disable off unless you want it.

03

Editors stay unblocked

Users with edit_posts or list_users still get author data. Public probes do not.

Get the plugin

Close the username oracle.

Install EnumGuard, leave the defaults on, and stop handing login names to anonymous probes.

Get the plugin

FAQ

Operational details

Does this hide author names on posts?

No. Display names and bylines stay. It stops login names, user IDs, and author archive URLs from being confirmed by anonymous requests.

Will Gutenberg break?

No. Users who can edit posts or list users still get author data in the editor.

Why is xmlrpc_disable off?

Jetpack and the WordPress mobile app still use XML-RPC. User-probing methods are blocked; a full disable is opt-in.

Yoast / Rank Math / WooCommerce?

SEO author URLs cover Yoast, Rank Math, and The SEO Framework. Lost-password covers WooCommerce’s reset flow.