Block author enumeration
Redirects author enumeration requests to your homepage, so scanners cannot harvest the usernames they need for a brute force run.
What it does
Closes a URL that hands out usernames
Block author enumeration is a Vectro security feature that redirects author query requests to your homepage, preventing scanners from harvesting the WordPress usernames they need for a brute force attack.
Request /?author=1 on a default WordPress site and it redirects to that user archive – and the redirect URL contains the account username. Increment the number and you can walk the whole user list without logging in.
This feature intercepts those requests and sends them to your homepage instead. No user archive, no username in the URL, nothing for a scanner to collect.
It is a small change with a specific job: it removes the first half of a brute force attempt.
Why it matters
A password guess needs a username first
Brute force against WordPress is usually described as password guessing, but every attempt needs two values. Author enumeration hands over the first one for free, and it is exactly the accounts an attacker wants: user ID 1 is very often the original administrator.
Once a valid username is confirmed, the attack becomes far more efficient – and error messages that distinguish a wrong username from a wrong password make it more efficient still. Blocking enumeration forces an attacker to guess both halves at once, which is a much poorer use of their time.
How to use it
Enable it, then try to enumerate yourself
Technical detail
What is intercepted
Vectro checks every front-end request for an author query parameter, whether or not the visitor is logged in, and issues a 301 redirect to the site homepage before WordPress resolves the query into a user archive. Because the redirect happens before resolution, the username never appears in a response.
Author archives at pretty permalink addresses such as /author/name/ keep working, because they do not carry an author query parameter. On a site using plain permalinks, where author archives are reached through ?author=N, those links will redirect to the homepage.
author query parameter, logged in or not.Compatibility
Vectro detects these and steps aside
You can override any automatic deferral from the Compatibility panel in Vectro’s dashboard if you would rather Vectro handle it.
Questions
Frequently asked
What is WordPress author enumeration?
Author enumeration is requesting URLs such as /?author=1 on a WordPress site, which redirects to a user archive whose address contains that account username. Incrementing the number lets an attacker collect usernames without logging in.
Does blocking author enumeration work with other security plugins?
If All In One Security is active, Vectro detects it and switches its own author enumeration blocking off, leaving it to All In One Security. With other security plugins, Vectro keeps redirecting author queries as normal.
How do I block author enumeration in Vectro?
Go to Vectro > Security in wp-admin and toggle Block Author Enumeration on. Test it by loading your-site.com/?author=1 in a private window, which should send you to the homepage with no username in the address bar.
Is blocking author enumeration in Vectro free or Pro?
Yes, Blocking author enumeration is free. It is included in the free Vectro plugin on WordPress.org with no account required.
Will blocking author enumeration break my author archive pages?
Not if your site uses pretty permalinks. Archive pages at /author/name/ keep working, because Vectro only redirects requests that carry an ?author= query parameter. On a site using plain permalinks, author archive links use ?author=N and will redirect to the homepage.
Related features
Stop usernames leaking anywhere
Vectro Pro adds a login activity log showing every login attempt with IP and browser details. See Pro plans
Download Vectro free on WordPress.org
27 features across Security, Performance and Maintenance. No account required, no expiry, unlimited sites.