Title: User Enumeration Protection
Last modified: June 6, 2026

---

# User Enumeration Protection

 *  Resolved [Mohsin Alam](https://wordpress.org/support/users/mohsinworld/)
 * (@mohsinworld)
 * [2 days, 14 hours ago](https://wordpress.org/support/topic/user-enumeration-protection/)
 * How to prevent user enumeration ([wp-json/wp/v2/users](https://wordpress.org/wp-json/wp/v2/users))
   I want no one be able to look my site’s usernames. How to prevent this?

Viewing 2 replies - 1 through 2 (of 2 total)

 *  Plugin Support [Jair – WPMU DEV Support](https://wordpress.org/support/users/wpmudevsupport15/)
 * (@wpmudevsupport15)
 * [2 days, 1 hour ago](https://wordpress.org/support/topic/user-enumeration-protection/#post-18930835)
 * Hello [@mohsinworld](https://wordpress.org/support/users/mohsinworld/)
 * Defender can detect when User Enumeration is accessible, and it provides options
   to block it.
 * Go to Defender -> Recommendations, and look for the “Prevent user enumeration”
   option. Even if you see that option in the “Actioned” section, you can expand
   it there and find additional options to block even more methods to access it.
   Please try this and let us know if it works for you.
 * Kind regards,
   Jair.
 *  Thread Starter [Mohsin Alam](https://wordpress.org/support/users/mohsinworld/)
 * (@mohsinworld)
 * [2 days, 1 hour ago](https://wordpress.org/support/topic/user-enumeration-protection/#post-18930843)
 * Thanks for your response. Yes it’s working on test site but the live site didn’t
   work. Later, I understood it was cached with the Vernish cache. I have added 
   this code to the Vhost, and it worked after clearing the Varnish cache. Thanks
 *     ```wp-block-code
       server {    listen 443 ssl;    http2 on;    server_name hmsalim.com;    ssl_certificate /etc/nginx/ssl-certificates/hmsalim.com.crt;    ssl_certificate_key /etc/nginx/ssl-certificates/hmsalim.com.key;    location ^~ /wp-json/wp/v2/users {        return 403;    }}
       ```
   

Viewing 2 replies - 1 through 2 (of 2 total)

You must be [logged in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fuser-enumeration-protection%2F%3Foutput_format%3Dmd&locale=en_US)
to reply to this topic.

 * ![](https://ps.w.org/defender-security/assets/icon-256x256.gif?rev=3435930)
 * [Defender Security - Malware Scanner, Login Security & Firewall](https://wordpress.org/plugins/defender-security/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/defender-security/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/defender-security/)
 * [Active Topics](https://wordpress.org/support/plugin/defender-security/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/defender-security/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/defender-security/reviews/)

 * 2 replies
 * 2 participants
 * Last reply from: [Mohsin Alam](https://wordpress.org/support/users/mohsinworld/)
 * Last activity: [2 days, 1 hour ago](https://wordpress.org/support/topic/user-enumeration-protection/#post-18930843)
 * Status: resolved