How to Disable User Enumeration in WordPress

What Is the Disable User Enumeration feature?

User enumeration is a common WordPress attack where bad actors try to discover valid usernames. With a valid username, an attacker can:

• Launch targeted password brute-force attacks
• Use leaked password databases to test for credential reuse
• Combine the username with social engineering
• Build a profile of the site (admins, editors, etc.)

WordPress exposes user data in two main places:

1. REST API: /wp-json/wp/v2/users returns user data
2. Author Archives: /?author=1 redirects to the author’s archive page (revealing the username)

The Disable User Enumeration feature blocks both methods.

Why You Need It

Username enumeration is the first step in most WordPress attacks:

• Brute force attacks: Need a valid username to attack
• Credential stuffing: Use leaked username/password combos
• Phishing: Combine username with other leaked data
• Reconnaissance: Build a profile of the site

Blocking enumeration is a critical security measure.

How to Disable User Enumeration in WordPress

Step 1: Navigate to Settings

Click into the Classic Monks plugin settings in your WordPress dashboard.

Step 2: Go to the Security Tab

Click on the Security menu, then click the WP Protection subtab.

Step 3: Enable Disable User Enumeration

Scroll to Disable User Enumeration and toggle on.

Step 4: Save Changes

Click Save Changes.

Step 5: Test

Try to access /wp-json/wp/v2/users in your browser. The response should be 404 (or an empty array). Try to access /?author=1, the page should not redirect to an author archive.

Configuration Options

Option	Description	Default
Disable User Enumeration	Master toggle.	Off

No nested options.

What Gets Affected

• The REST API users endpoint: returns 404 or empty
• The REST API users search: blocked
• The author archive pages: return 404 for non-logged-in users
• The author query in WP_Query: blocked for non-authorized users

What Does NOT Get Affected

• The WordPress admin: not affected (admins can still see user lists)
• The wp-admin users page: still works for admins
• The user profile pages (author=me): still work for the logged-in user
• The REST API for logged-in users: still works (the user is authenticated)

Advanced Options (Developers)

This feature registers 1 WordPress hook in security-functions.php:

Actions:

• init calls cm_disable_user_enumeration() (Blocks user enumeration via author archives and REST API)

// Hooked in security-functions.php
add_action( 'init', 'cm_disable_user_enumeration' );

The feature modifies WordPress behavior by registering or removing hooks. Disabling it reverses those changes and WordPress returns to its default behavior.