---
title: Prevent username enumeration
canonical: https://wpsecurityninja.com/docs/security-fixes/disable-username-enumeration/
---
WordPress can expose usernames in two common ways:

1. **`?author=N` scans** that redirect to `/author/username/` when the ID exists.
2. **Anonymous REST requests** to `/wp-json/wp/v2/users` (or `?rest_route=/wp/v2/users`) that list users without logging in.

Attackers use those paths to collect valid usernames before password guessing. Disabling username enumeration makes that harder.

![Disable Username Enumeration in Fixes](https://wpsecurityninja.com/media/2022/04/disable-username-enumeration.webp)

## Enable in Security Ninja

1. Go to **Security Ninja → Fixes**.
2. Turn on **Disable Username Enumeration**.
3. Save.

This Fix (Pro) does the following:

* Blocks classic **`?author=N`** enumeration attempts. It matches the WordPress `author=` query parameter only, not unrelated parameters such as `book_author=`.
* Skips the block for **logged-in users** so normal admin workflows keep working.
* Removes **anonymous access** to the REST users endpoint (`/wp-json/wp/v2/users` and the `?rest_route=` form).
* Filters **oEmbed author data** where applicable.

Security Tests include a check for REST user listing on that path.

## Optional server-level hardening

You can also block author archive probes in `.htaccess` if you prefer a server rule:

```apache
# Block access to author scans
RewriteEngine On
RewriteCond %{QUERY_STRING} ^author=([0-9]*) [NC]
RewriteRule ^ - [F,L]
```

The Security Ninja Fix is usually enough on its own. Use server rules only if you need an extra layer.

## Related practices

* Avoid predictable usernames like `admin`.
* Use [login form protection](https://wpsecurityninja.com/docs/firewall/login-form-protection/) and [2FA](https://wpsecurityninja.com/docs/firewall/how-to-set-up-two-factor-authentication-2fa-in-security-ninja/) on Pro sites.
* Run [Security Tests](https://wpsecurityninja.com/docs/security-tests/security-tests/) after enabling the Fix to confirm the REST check passes.

## Related

* [Security Fixes overview](https://wpsecurityninja.com/docs/security-fixes/)
* [Activate default security measures](https://wpsecurityninja.com/docs/installation-and-usage/activate-default-security-measures/)