How to Fix: User enumeration blocked

User enumeration blocked is a check in the WordPress Specific category. It is medium-priority — not a fire, but a door you left ajar. It is really a security and privacy item that got filed under SEO because a hardened site is a trusted site, and I would close it on any WordPress install I own.

What this check is really about

WordPress will, by default, hand out your usernames to anyone who asks nicely. Visit /?author=1 and the site redirects to that author’s archive, revealing their login slug. Query the REST API at /wp-json/wp/v2/users and you often get a tidy JSON list of every account that has ever published. This check fails when those two doors are open. Neither is a breach on its own — but both hand an attacker the usernames, which is half of every brute-force and credential-stuffing attempt.

The exposures nobody looks at

My first paid job, at fourteen, in 1990, was showing a print shop how to lay reverse type on vellum — reversed so it read correctly once it printed through. It paid in pocket money and a soft drink, and the shop could not believe a kid with an Apple at home knew a production trick their own staff had missed. That is the whole lesson of this check: the vulnerabilities that bite are rarely exotic. They are the plain, documented behaviours sitting in the open that nobody thinks to look at because everything appears to work.

User enumeration is exactly that kind of exposure. It is not a clever exploit. It is a default that has been public for years, and the only reason it stays open is that a working site gives no reason to check. Knowing where to look is the entire job.

How I’d fix it in WordPress

Difficulty Level: EASY – This fix is straightforward and can typically be completed by anyone with basic WordPress knowledge.

Estimated Time: 10 min

Two things to close, and one habit to keep:

1. Block the ?author= redirect. A security plugin (Wordfence, iThemes/Solid Security, All In One WP Security) has a one-click toggle for this; or add a redirect rule that stops the author-ID scan cold.
2. Restrict the REST users endpoint so /wp-json/wp/v2/users does not return your account list to unauthenticated visitors. Most security plugins do this too.
3. Separately, make the display name different from the login name on every account. Even with the doors shut, that keeps the byline you publish under from being the username someone types into a login form.

Fix the door, then the lock

Blocking enumeration is worth doing, but keep it in proportion: it makes an attacker’s first step harder, it does not make you safe. Usernames are half of a login. The other half is the password, and that is where the real defence lives. If you close the enumeration doors and stop there, you have hidden the keyhole while leaving a weak lock.

So pair this fix with the things that actually stop the attack it enables: strong, unique passwords on every account, two-factor on anyone who can publish or administer, and login rate-limiting so a thousand guesses become impossible before the tenth. Do those, and enumeration stops mattering. Do only the enumeration block, and you have tidied the front step.

Tools I actually reach for

• Yoast SEO – Comprehensive SEO plugin with built-in checks
• Rank Math – Feature-rich SEO plugin with detailed analysis
• Google Search Console – Free tool to monitor your site’s search presence
• SEO Roadmap – Complete SEO audit and action plan tool

Where people go wrong

• Blocking ?author= but leaving the REST users endpoint wide open, or vice versa — close both.
• Treating an enumeration block as “the site is now secure” when it is one small step.
• Running the login name as the public display name, so the byline is the username.
• Adding raw redirect rules to a live site without testing, and breaking legitimate author archives.

This guide is part of the SEO Roadmap knowledge base – your complete resource for WordPress SEO optimization.