描述
EnumGuard is a focused WordPress plugin that stops attackers from confirming that a username or user ID exists. WordPress still prints those signals by default; EnumGuard closes the usual paths without hiding display names on posts.
Under Settings EnumGuard you get three tabs:
- Protections — overview of which discovery paths are closed
- Settings — toggles and custom login / reset messages
- About — plugin info
Protections covered:
- Author ID queries (
?author=1) that would otherwise redirect to the author archive - Author archives and their feeds
- Author archive links printed in HTML
author-{id}/author-{nicename}body, post, and comment CSS classes- Core users sitemap (
/wp-sitemap-users-1.xml) - Unauthenticated
/wp-json/wp/v2/users(including?rest_route=) - REST
_embedauthor payloads and author link headers - Login error messages that distinguish “bad username” from “bad password”
- Lost-password responses (same confirmation whether the account exists)
- oEmbed
author_url/author_name - XML-RPC user-listing methods, with an optional full XML-RPC disable
- Author sitemaps and author archive URLs from Yoast, Rank Math, and The SEO Framework
Recommended protections ship enabled. Gutenberg still reaches the users REST API for logged-in editors. Display names stay visible. Login and reset protections also cover WooCommerce forms when WooCommerce is active. XML-RPC can be turned off completely if you do not need Jetpack, pingbacks, or the WordPress mobile app.
安装
- Upload the
enumguardfolder to the/wp-content/plugins/directory. - Activate the plugin through the Plugins menu in WordPress.
- Open Settings EnumGuard to review protections.
常见问题
-
Yes. Display names stay in content. EnumGuard stops login slugs, author archive URLs, and existence oracles—not bylines.
-
Does this break the block editor?
-
No. Logged-in users who can edit posts or list users still reach
/wp/v2/users. Guests get a generic 404. -
What about WooCommerce?
-
Login and lost-password protections apply to the WooCommerce account forms as well as wp-login.php. Bylines and display names are unchanged.
-
What about the WordPress mobile app?
-
The app uses
wp.getUsersBlogs. That method is removed while “XML-RPC user methods” is on. Turn that protection off if you need the app. Do not enable “Disable XML-RPC.” -
Yes. Disable “Author archives” and “Author archive links” on the Settings tab. Keep author ID queries blocked so
?author=1cannot reveal the nicename. -
Does uninstall remove settings?
-
Yes. Uninstall deletes EnumGuard options on the current site, and on every site in a multisite network.
评价
此插件暂无评价。
贡献者及开发者
更新日志
1.0.0
- Initial release.