How to Fix WordPress User Enumeration

By default, WordPress shows the login usernames of your authors in two public places: the REST API users list and ?author= links. A username is half of a login, so bots collect them before guessing passwords. A short snippet closes both for logged-out visitors.

Test it (logged out)

Use a private browser window so you're not logged in, then open:

• https://your-site.com/wp-json/wp/v2/users
• https://your-site.com/?rest_route=/wp/v2/users (the same endpoint without pretty permalinks)
• https://your-site.com/?author=1

A leak looks like a JSON list with "slug" values, or a redirect from ?author=1 to /author/your-login-name/. You can also run the free WordPress scan, which checks both and shows any usernames masked.

The fix: one small plugin file

Save this as wp-content/mu-plugins/stop-user-enumeration.php (create the mu-plugins folder if it doesn't exist), or paste the two functions into a code-snippets plugin. Don't put it in a parent theme, where a theme update would wipe it.

<?php
/**
 * Plugin Name: Stop user enumeration (logged-out visitors)
 */
// Fix 1: hide the REST API users endpoints from logged-out visitors.
add_filter( 'rest_endpoints', function ( $endpoints ) {
	if ( ! is_user_logged_in() ) {
		unset( $endpoints['/wp/v2/users'] );
		unset( $endpoints['/wp/v2/users/(?P<id>[\d]+)'] );
	}
	return $endpoints;
} );

// Fix 2: return 404 for ?author=N lookups from logged-out visitors (runs before the canonical redirect).
add_action( 'template_redirect', function () {
	if ( is_user_logged_in() || ! isset( $_GET['author'] ) ) {
		return;
	}
	global $wp_query;
	$wp_query->set_404();
	status_header( 404 );
	nocache_headers();
}, 1 );

Fix 1 uses the rest_endpoints filter to remove the /wp/v2/users routes for logged-out visitors only (developer.wordpress.org: rest_endpoints; REST API handbook: Users). Logged-in editors keep the endpoint, so the block editor keeps working.

Fix 2 returns a 404 for ?author=N lookups before WordPress redirects them to the author's URL.

We tested this file on a WordPress 7.1 test site on Oct 20, 2026. Logged out, /wp-json/wp/v2/users, ?rest_route=/wp/v2/users and ?author=1 all returned 404. Logged in, the users endpoint still returned 200.

Also go to Users → Profile and set "Display name publicly as" to something other than your login name, because themes show the display name on posts.

What can break

Anything that reads the users endpoint without logging in: some headless front ends, page builders, membership or directory plugins, and apps that list authors. After adding the file, check your author pages, any author lists, and your editor. If something needs the endpoint, delete the file (or remove Fix 1) and keep Fix 2.

The defense that matters more

Usernames are easy to guess anyway. Hiding them cuts noise from bots, but it doesn't replace strong unique passwords and two-factor login for every admin. Do both.

Standards: CWE-200 (exposure of sensitive information) · CWE-204 (observable response discrepancy).

Related guides

• WordPress security scan
• How to disable xmlrpc.php in WordPress

FAQ

What is WordPress user enumeration?

It's when anyone can list your site's login usernames, usually through /wp-json/wp/v2/users or ?author= links. Bots use the names to guess passwords.

Will blocking the users endpoint break the block editor?

Not with this fix. It only removes the endpoint for logged-out visitors, so logged-in editors keep it. Check any plugin or app that reads authors without logging in.

Is hiding usernames enough to stop brute-force attacks?

No. It reduces noise. Strong unique passwords and two-factor login for every admin are what stop account takeovers.

Does the free scan show my usernames?

It checks the REST API users list and ?author= links and reports what it finds, with usernames masked. It never tries to log in.

Ready to see your score? Run the free check on your site. It detects WordPress automatically.