WordPress User Enumeration: What It Means and How to Fix It

What user enumeration actually means

WordPress has a habit of publishing the usernames of its accounts. It does this in two common places. The first is the REST API, specifically the /wp-json/wp/v2/users endpoint, which returns a tidy list of author accounts to anyone who visits it. The second is author archive URLs: a request to /?author=1 quietly redirects to /author/theusername/, revealing the login name in the address bar.

None of this is a break-in. It is public information that WordPress offers on request, which is exactly why the outside view can see it. Your BadgerScan check is passive and read-only. It reads what is publicly visible and never guesses or tests a password.

The concern is simple. A login has two halves, a username and a password. When the username is handed out freely, an attacker only has to work on the password. The WordPress documentation calls out limiting login information as part of basic hardening (WordPress.org, Hardening WordPress).

Why it is worth fixing

A username on its own does no harm, but it changes the math on a login form. Automated password-guessing tools work far more efficiently when they already know a valid account name, because every attempt is aimed at a real target instead of a guess.

Closing this off is low effort and low risk. For most small business sites, nobody needs to read the raw list of accounts from the REST API, and author archive pages are often unused. Tidying both up removes an easy piece of reconnaissance without changing how your site looks to visitors.

How to fix it, step by step

The goal is to stop publishing usernames and to make sure that even a leaked username is not enough to get in. Work through these in order.

• Restrict the REST API users endpoint so it is not public. A reputable security plugin can do this in one setting, or a developer can filter the rest_endpoints response in code to remove the users route. The WordPress REST API Handbook documents how endpoints and their permissions work.
• Disable author archives if you do not use them. Many security plugins include a toggle for this, which stops /?author=1 from redirecting to a /author/name/ URL that leaks the login.
• Turn on two-factor authentication for every account that can log in. This is the single change that makes a known username harmless, because the password alone is no longer enough.
• Add login rate-limiting, either through your security plugin or your host, so repeated password attempts against a known username get slowed down or blocked.
• Make sure your account usernames are not also your public display names, and avoid the default admin username. Set a separate display name in each user profile so your byline never reveals the login.
• Re-run a free scan to confirm the usernames are no longer publicly visible. You can run the free scan again in under a minute.

One thing to check after you fix it

Restricting the REST API users endpoint is safe for the vast majority of sites, but a small number of plugins or a custom theme genuinely read that endpoint to build author pages or bylines. After you lock it down, click through your site as a normal visitor and confirm nothing looks broken. If an author listing disappears, your plugin has a supported way to expose only the data it needs, rather than reopening the whole endpoint to the public. When in doubt, keep the endpoint closed and let two-factor authentication and rate-limiting carry the weight.