Directory / plugin
FormCourier User Enumeration Protection
v1.1.2 · by Den Slav
Blocks common WordPress user enumeration methods and optionally hides public author archives.
About this plugin
FormCourier User Enumeration Protection reduces public exposure of WordPress usernames and author information without disabling the entire REST API.
The plugin:
- Blocks
/wp-json/wp/v2/usersfor unauthenticated visitors. - Blocks individual REST user endpoints such as
/wp-json/wp/v2/users/1. - Blocks numeric
?author=IDenumeration and returns a 404 response. - Adds an option to hide public
/author/username/archive pages. - Removes the core WordPress user sitemap to reduce public author enumeration.
- Replaces revealing WordPress login errors with a generic error message.
- Keeps REST user endpoints available to authenticated users.
- Does not collect, transmit, or share data with external services.
No external account, API key, or third-party service is required.
Settings
Go to Settings > User Enumeration Protection.
The Hide public author archives option controls whether normal /author/username/ archive pages are available.
When enabled, public author archive URLs return 404.
When disabled, normal author archives remain available. Numeric ?author=ID enumeration remains blocked regardless of this setting.
Privacy
This plugin does not collect, store, transmit, or share personal data with any external service.
The plugin stores one WordPress option that controls whether public author archives are hidden. This option is removed when the plugin is uninstalled.