Block User Enumeration
Stops visitors from discovering usernames through ?author=N URLs, the public REST API users endpoint, the users sitemap and oEmbed data.
WPIDE Team 6 installs
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
Generic Login Error Message
Shows the same error for a wrong username and a wrong password, so the login form does not reveal which usernames exist.
WPIDE Team 6 installs404 for Author Pages of Users Without Posts
Returns a 404 for the author archive of anyone who has never published, such as subscribers and customers, so their usernames and empty profile pages are not exposed.
Ban IPs That Try Common Attack Usernames
Blocks an IP address from logging in for a day as soon as it tries a username like "admin" or "test" that does not exist on your site.
Block Reserved Usernames
Prevents anyone from registering or being created with usernames like admin, support or root that look official or invite attacks.
BuddyPress: Username Rules on the Sign-Up Form
Requires BuddyPress usernames to be at least a few characters long and not just numbers, giving members a clear error message on the sign-up form.
Hide Whether an Account Exists on Password Reset
Shows the same "check your email" screen for unknown usernames and emails on the lost password form, so it cannot be used to find valid accounts.
Hide the REST Users Endpoint From Subscribers and Customers
Blocks the REST API users endpoint for logged-in users who cannot edit posts, such as subscribers and shop customers, so a low-level account cannot list your authors and their usernames.
Log In With Email Address Only
Accepts only an email address and password on the login form. Usernames are rejected, which makes guessing logins harder.
Log In With Username Only
Stops WordPress from accepting an email address in the login form, so only usernames work.
Never Show Login Names as Public Display Names
When a user's public display name is the same as their login name (the WordPress default), switches it to their first and last name, or to a neutral name, so author bylines and comments do not reveal usernames.
Password Reset by Email Address Only
Makes the "Lost your password?" form accept only an email address, not a username, so the form can't be used to probe which usernames exist.
Reject Login Attempts for Common Usernames
Refuses login attempts for usernames bots love to try, such as "admin", "administrator" or "root", before WordPress even checks a password.
Remove Usernames From CSS Classes
Strips the author and commenter usernames WordPress adds to body and comment classes, closing a quiet way to discover login names.
Username Rules for New Registrations
Requires new usernames to be a sensible length, use only letters, numbers, dots, dashes and underscores, and not be just a number.