FormCourier User Enumeration Protection

FormCourier User Enumeration Protection reduces public exposure of WordPress usernames and author information without disabling the entire REST API.

The plugin:

• Blocks /wp-json/wp/v2/users for unauthenticated visitors.
• Blocks individual REST user endpoints such as /wp-json/wp/v2/users/1.
• Blocks numeric ?author=ID enumeration and returns a 404 response.
• Adds an option to hide public /author/username/ archive pages.
• Removes the core WordPress user sitemap to reduce public author enumeration.
• Replaces revealing WordPress login errors with a generic error message.
• Keeps REST user endpoints available to authenticated users.
• Does not collect, transmit, or share data with external services.

No external account, API key, or third-party service is required.

Settings

Go to Settings > User Enumeration Protection.

The Hide public author archives option controls whether normal /author/username/ archive pages are available.

When enabled, public author archive URLs return 404.

When disabled, normal author archives remain available. Numeric ?author=ID enumeration remains blocked regardless of this setting.

Privacy

This plugin does not collect, store, transmit, or share personal data with any external service.

The plugin stores one WordPress option that controls whether public author archives are hidden. This option is removed when the plugin is uninstalled.