Block User Enumeration
Stops visitors from discovering usernames through ?author=N URLs, the public REST API users endpoint, the users sitemap and oEmbed data.
Opens WPIDE on
Code
add_action( 'template_redirect', function () {
if ( ! is_user_logged_in() && isset( $_GET['author'] ) ) {
wp_safe_redirect( home_url( '/' ), 301 );
exit;
}
}, 1 );
add_filter( 'rest_endpoints', function ( $endpoints ) {
if ( is_user_logged_in() ) {
return $endpoints;
}
foreach ( array_keys( $endpoints ) as $route ) {
if ( 0 === strpos( $route, '/wp/v2/users' ) ) {
unset( $endpoints[ $route ] );
}
}
return $endpoints;
} );
add_filter( 'wp_sitemaps_add_provider', function ( $provider, $name ) {
return 'users' === $name ? false : $provider;
}, 10, 2 );
add_filter( 'oembed_response_data', function ( $data ) {
unset( $data['author_name'], $data['author_url'] );
return $data;
} );How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.