User Enumeration

Estimated reading: 2 minutes 527 views

The User Enumeration feature strengthens your WordPress site’s security by preventing attackers and automated bots from discovering valid usernames. User enumeration is a common reconnaissance technique used in brute-force and targeted attacks. This feature ensures that all possible username exposure points in WordPress are effectively secured.

How It Works

Attackers often exploit WordPress endpoints and functionalities such as author pages, REST API endpoints, or error messages to extract valid usernames. Once they obtain these usernames, they can perform brute-force or phishing attacks more efficiently.

The User Enumeration feature mitigates this risk by blocking, restricting, or masking user data across multiple WordPress components.

Enabling User Enumeration Protection

Navigate to AIO Login → Security → User Enumeration.
Toggle “Enable Protection” to activate the module

Once enabled, additional settings will appear for detailed configuration.
Choose specific protections or select “Enable All” for full coverage.
Click Save Changes to apply the settings.

Available Settings:

Stop oEmbed Calls Revealing User IDs:

Prevents WordPress from exposing author login IDs through oEmbed requests, which are used when embedding content across websites.

When to use it:

Enable this if your site’s content is embedded on other domains or external platforms. It helps prevent user IDs from being revealed in oEmbed metadata.

Disable WP Core Author Sitemaps:

This removes author-based sitemaps automatically generated by WordPress to prevent bots and crawlers from collecting usernames.

When to use it:

Recommended for multi-author or contributor-based websites. This setting prevents author profile URLs (which may include usernames) from appearing in search engine results.

Prevent Username from Comment Authors:

Obfuscates or hides comment author names to protect against username leaks through public comment metadata.

When to use it:

Useful for blogs, news, or community websites that allow comments. It safeguards users who might use their login names as display names.

Protect REST API User Endpoints:

Restricts public or unauthorized access to WordPress REST API endpoints that can reveal registered user information.

When to use it:

This is essential for sites that use the REST API or headless WordPress setups. It ensures that user data is only accessible to authenticated or authorized requests.

Generic Login & Registration Errors:

The system displays generic error messages during login and registration instead of revealing whether a username exists

When to use it:

Recommended for all WordPress sites. It prevents attackers from identifying valid usernames through login form responses, reducing brute-force attack risks.

User Enumeration

How It Works

Enabling User Enumeration Protection

Available Settings:

Stop oEmbed Calls Revealing User IDs:

When to use it:

Disable WP Core Author Sitemaps:

When to use it:

Prevent Username from Comment Authors:

When to use it:

Protect REST API User Endpoints:

When to use it:

Generic Login & Registration Errors:

When to use it:

Leave a Reply Cancel reply

User Enumeration