{"id":368360,"date":"2026-09-19T07:53:17","date_gmt":"2026-09-19T07:53:17","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/enumguard\/"},"modified":"2026-09-19T07:53:01","modified_gmt":"2026-09-19T07:53:01","slug":"enumguard","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/enumguard\/","author":20815504,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.0","stable_tag":"1.0.0","tested":"7.1.1","requires":"6.3","requires_php":"7.4","requires_plugins":null,"header_name":"EnumGuard","header_author":"Alex Hedstr\u00f6m","header_description":"Stops WordPress user enumeration through author URLs, REST, login errors, XML-RPC, feeds, sitemaps, and oEmbed.","assets_banners_color":"","last_updated":"2026-09-19 07:53:01","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/enumguard.com","header_author_uri":"https:\/\/alexhedstrom.com","rating":0,"author_block_rating":0,"active_installs":10,"downloads":40,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"alexhedstrom","date":"2026-09-19 07:53:01","revision":3703092}},"upgrade_notice":[],"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[602,23853,600,46130,6558],"plugin_category":[38,54],"plugin_contributors":[259029],"plugin_business_model":[],"class_list":["post-368360","plugin","type-plugin","status-publish","hentry","plugin_tags-login","plugin_tags-rest-api","plugin_tags-security","plugin_tags-user-enumeration","plugin_tags-xml-rpc","plugin_category-authentication","plugin_category-security-and-spam-protection","plugin_contributors-alexhedstrom","plugin_committers-alexhedstrom"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/enumguard.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"<!--section=description-->\n<p>EnumGuard is a focused WordPress plugin that stops attackers from confirming that a username or user ID exists. WordPress still prints those signals by default; EnumGuard closes the usual paths without hiding display names on posts.<\/p>\n\n<p>Under Settings \u2192 EnumGuard you get three tabs:<\/p>\n\n<ul>\n<li>Protections \u2014 overview of which discovery paths are closed<\/li>\n<li>Settings \u2014 toggles and custom login \/ reset messages<\/li>\n<li>About \u2014 plugin info<\/li>\n<\/ul>\n\n<p>Protections covered:<\/p>\n\n<ul>\n<li>Author ID queries (<code>?author=1<\/code>) that would otherwise redirect to the author archive<\/li>\n<li>Author archives and their feeds<\/li>\n<li>Author archive links printed in HTML<\/li>\n<li><code>author-{id}<\/code> \/ <code>author-{nicename}<\/code> body, post, and comment CSS classes<\/li>\n<li>Core users sitemap (<code>\/wp-sitemap-users-1.xml<\/code>)<\/li>\n<li>Unauthenticated <code>\/wp-json\/wp\/v2\/users<\/code> (including <code>?rest_route=<\/code>)<\/li>\n<li>REST <code>_embed<\/code> author payloads and author link headers<\/li>\n<li>Login error messages that distinguish \u201cbad username\u201d from \u201cbad password\u201d<\/li>\n<li>Lost-password responses (same confirmation whether the account exists)<\/li>\n<li>oEmbed <code>author_url<\/code> \/ <code>author_name<\/code><\/li>\n<li>XML-RPC user-listing methods, with an optional full XML-RPC disable<\/li>\n<li>Author sitemaps and author archive URLs from Yoast, Rank Math, and The SEO Framework<\/li>\n<\/ul>\n\n<p>Recommended protections ship enabled. Gutenberg still reaches the users REST API for logged-in editors. Display names stay visible. Login and reset protections also cover WooCommerce forms when WooCommerce is active. XML-RPC can be turned off completely if you do not need Jetpack, pingbacks, or the WordPress mobile app.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>enumguard<\/code> folder to the <code>\/wp-content\/plugins\/<\/code> directory.<\/li>\n<li>Activate the plugin through the Plugins menu in WordPress.<\/li>\n<li>Open Settings \u2192 EnumGuard to review protections.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"will%20authors%20still%20show%20on%20posts%3F\"><h3>Will authors still show on posts?<\/h3><\/dt>\n<dd><p>Yes. Display names stay in content. EnumGuard stops login slugs, author archive URLs, and existence oracles\u2014not bylines.<\/p><\/dd>\n<dt id=\"does%20this%20break%20the%20block%20editor%3F\"><h3>Does this break the block editor?<\/h3><\/dt>\n<dd><p>No. Logged-in users who can edit posts or list users still reach <code>\/wp\/v2\/users<\/code>. Guests get a generic 404.<\/p><\/dd>\n<dt id=\"what%20about%20woocommerce%3F\"><h3>What about WooCommerce?<\/h3><\/dt>\n<dd><p>Login and lost-password protections apply to the WooCommerce account forms as well as wp-login.php. Bylines and display names are unchanged.<\/p><\/dd>\n<dt id=\"what%20about%20the%20wordpress%20mobile%20app%3F\"><h3>What about the WordPress mobile app?<\/h3><\/dt>\n<dd><p>The app uses <code>wp.getUsersBlogs<\/code>. That method is removed while \u201cXML-RPC user methods\u201d is on. Turn that protection off if you need the app. Do not enable \u201cDisable XML-RPC.\u201d<\/p><\/dd>\n<dt id=\"can%20i%20keep%20author%20archives%20for%20a%20magazine%20site%3F\"><h3>Can I keep author archives for a magazine site?<\/h3><\/dt>\n<dd><p>Yes. Disable \u201cAuthor archives\u201d and \u201cAuthor archive links\u201d on the Settings tab. Keep author ID queries blocked so <code>?author=1<\/code> cannot reveal the nicename.<\/p><\/dd>\n<dt id=\"does%20uninstall%20remove%20settings%3F\"><h3>Does uninstall remove settings?<\/h3><\/dt>\n<dd><p>Yes. Uninstall deletes EnumGuard options on the current site, and on every site in a multisite network.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release.<\/li>\n<\/ul>","raw_excerpt":"Stops WordPress user enumeration through author URLs, REST, login errors, XML-RPC, sitemaps, and oEmbed.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/368360","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=368360"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/alexhedstrom"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=368360"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=368360"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=368360"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=368360"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=368360"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=368360"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}