EnumGuard

EnumGuard is a focused WordPress plugin that stops attackers from confirming that a username or user ID exists. WordPress still prints those signals by default; EnumGuard closes the usual paths without hiding display names on posts.

Under Settings → EnumGuard you get three tabs:

• Protections — overview of which discovery paths are closed
• Settings — toggles and custom login / reset messages
• About — plugin info

Protections covered:

• Author ID queries (?author=1) that would otherwise redirect to the author archive
• Author archives and their feeds
• Author archive links printed in HTML
• author-{id} / author-{nicename} body, post, and comment CSS classes
• Core users sitemap (/wp-sitemap-users-1.xml)
• Unauthenticated /wp-json/wp/v2/users (including ?rest_route=)
• REST _embed author payloads and author link headers
• Login error messages that distinguish “bad username” from “bad password”
• Lost-password responses (same confirmation whether the account exists)
• oEmbed author_url / author_name
• XML-RPC user-listing methods, with an optional full XML-RPC disable
• Author sitemaps and author archive URLs from Yoast, Rank Math, and The SEO Framework

Recommended protections ship enabled. Gutenberg still reaches the users REST API for logged-in editors. Display names stay visible. Login and reset protections also cover WooCommerce forms when WooCommerce is active. XML-RPC can be turned off completely if you do not need Jetpack, pingbacks, or the WordPress mobile app.