Description
EnumGuard is a focused WordPress plugin that stops attackers from confirming that a username or user ID exists. WordPress still prints those signals by default; EnumGuard closes the usual paths without hiding display names on posts.
Under Settings EnumGuard you get three tabs:
- Protections — overview of which discovery paths are closed
- Settings — toggles and custom login / reset messages
- About — plugin info
Protections covered:
- Author ID queries (
?author=1) that would otherwise redirect to the author archive - Author archives and their feeds
- Author archive links printed in HTML
author-{id}/author-{nicename}body, post, and comment CSS classes- Core users sitemap (
/wp-sitemap-users-1.xml) - Unauthenticated
/wp-json/wp/v2/users(including?rest_route=) - REST
_embedauthor payloads and author link headers - Login error messages that distinguish “bad username” from “bad password”
- Lost-password responses (same confirmation whether the account exists)
- oEmbed
author_url/author_name - XML-RPC user-listing methods, with an optional full XML-RPC disable
- Author sitemaps and author archive URLs from Yoast, Rank Math, and The SEO Framework
Recommended protections ship enabled. Gutenberg still reaches the users REST API for logged-in editors. Display names stay visible. Login and reset protections also cover WooCommerce forms when WooCommerce is active. XML-RPC can be turned off completely if you do not need Jetpack, pingbacks, or the WordPress mobile app.
Installation
- Upload the
enumguardfolder to the/wp-content/plugins/directory. - Activate the plugin through the Plugins menu in WordPress.
- Open Settings EnumGuard to review protections.
FAQ
-
Yes. Display names stay in content. EnumGuard stops login slugs, author archive URLs, and existence oracles—not bylines.
-
Does this break the block editor?
-
No. Logged-in users who can edit posts or list users still reach
/wp/v2/users. Guests get a generic 404. -
What about WooCommerce?
-
Login and lost-password protections apply to the WooCommerce account forms as well as wp-login.php. Bylines and display names are unchanged.
-
What about the WordPress mobile app?
-
The app uses
wp.getUsersBlogs. That method is removed while “XML-RPC user methods” is on. Turn that protection off if you need the app. Do not enable “Disable XML-RPC.” -
Yes. Disable “Author archives” and “Author archive links” on the Settings tab. Keep author ID queries blocked so
?author=1cannot reveal the nicename. -
Does uninstall remove settings?
-
Yes. Uninstall deletes EnumGuard options on the current site, and on every site in a multisite network.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“EnumGuard” is open source software. The following people have contributed to this plugin.
Contributors
Translate “EnumGuard” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.0.0
- Initial release.