Public discovery
Blocks ?author=N redirects, /author/ archives, HTML author links, author-{username} CSS classes, and the core users sitemap.
WordPress user enumeration
Stop attackers from confirming your usernames.
WordPress still prints those signals by default. EnumGuard closes author URLs, REST, login errors, XML-RPC, feeds, sitemaps, and oEmbed — without hiding display names on posts.
13
Discovery paths closed
12
On by default
0
Bylines hidden
1.0
Focused plugin, GPL
The problem
WordPress confirms accounts without trying.
Attackers do not need a password to start. They only need to know that admin, shopmanager, or a nicename exists. Core still helps them find it.
Without EnumGuard
Usernames leak in public
?author=1 → 301 → /author/admin/
ERROR: The password you entered for the username admin is incorrect.
[{"id":1,"slug":"admin","name":"Alex"}]
Author archives, body classes, oEmbed, XML-RPC, and SEO sitemaps also publish login slugs. One confirmed username is enough to start a brute-force campaign.
With EnumGuard
Same request, no confirmation
?author=1 → 404
Invalid username or password.
No route was found matching the URL and request method.
Login and reset replies stay generic. REST users 404 for guests. Author URLs, CSS classes, sitemaps, and oEmbed stop pointing at nicenames. Display names on posts stay put.
Six groups
Every usual discovery path, closed.
Thirteen protections, grouped the way you actually think about WordPress. Recommended ones ship enabled. Gutenberg still works for logged-in editors.
REST API
Unauthenticated /wp/v2/users returns a generic 404, including ?rest_route=. Public _embed author payloads and author link headers are stripped.
Login & passwords
One generic login failure. The same reset confirmation whether the account exists or not — including WooCommerce lost-password forms.
Feeds & embeds
Removes author_url and author_name from oEmbed JSON so embedding a post cannot expose /author/username/.
XML-RPC
Removes wp.getUsers, wp.getAuthors, wp.getProfile, and related Blogger methods. Optionally disable XML-RPC entirely if you do not need Jetpack or the mobile app.
SEO plugins
Disables author sitemaps and strips author archive URLs from Yoast, Rank Math, and The SEO Framework when those plugins are active.
What stays visible
Bylines stay. Login slugs go.
EnumGuard is not a hide-the-author plugin. Readers still see display names on posts. Editors still use Gutenberg. Magazine sites can keep author archives if they want — just leave those two toggles off and keep author ID queries blocked.
Logged-in users who can edit posts or list users still reach /wp/v2/users. Guests get a generic 404. Site Health reports whether recommended protections are on.
The WordPress mobile app uses wp.getUsersBlogs. That method is removed when XML-RPC user methods are on. Turn that protection off, or leave XML-RPC enabled, if you need the app.
Install in minutes
Activate, then review Settings → EnumGuard.
1
Upload and activate
Drop the enumguard folder into /wp-content/plugins/ and activate it. Recommended protections turn on immediately.
2
Check Protections
The Protections tab shows which discovery paths are closed. Site Health also reports if any recommended toggle is off.
3
Tune messages
Customize the generic login and lost-password copy. Reset to defaults anytime. Uninstall removes options, including on multisite.
Questions
Straight answers.
Will authors still show on posts?
Yes. Display names stay in content. EnumGuard stops login slugs, author archive URLs, and existence oracles — not bylines.
Does this break the block editor?
No. Logged-in users who can edit posts or list users still reach /wp/v2/users. Guests get a generic 404.
Can I keep author archives for a magazine?
Yes. Disable Author archives and Author archive links. Keep author ID queries blocked so ?author=1 cannot reveal the nicename.
Close the username oracle.
EnumGuard 1.0.0 is a focused, GPL-licensed WordPress plugin. Requires WordPress 6.3+ and PHP 7.4+. Tested up to WordPress 7.1.