WordPress user enumeration is a technique where an attacker discovers your WordPress usernames. Once they have a valid username, brute-forcing the password becomes significantly easier — they've eliminated half the puzzle.
How enumeration works
WordPress exposes usernames in several places by default:
Author archive URLs: Visiting /?author=1 redirects to /author/username/ — revealing the username of user ID 1 (typically your admin account). Iterating through IDs reveals all users.
The REST API: /wp-json/wp/v2/users returns a JSON list of all users with usernames and display names — publicly accessible by default.
Login error messages: WordPress's default error distinguishes "unknown username" from "incorrect password" — confirming to an attacker that a username exists.
XML-RPC: The XML-RPC interface can also be queried to enumerate users.
Why it matters
With a valid username, an attacker can: - Mount a targeted brute-force against that specific account - Try the username against your email provider, cloud services, or other tools - Personalise phishing emails to that user
How to prevent it
Disable author archive redirects — block ?author= queries via .htaccess or a security plugin.
Restrict the REST API users endpoint — limit /wp-json/wp/v2/users to authenticated requests. Wordfence and iThemes Security include this option.
Use generic login error messages — replace the default specific error with a single, non-descriptive one.
Disable XML-RPC if unused — add add_filter('xmlrpc_enabled', '__return_false'); to your functions.php.
threatprobe.app's Full report checks whether usernames are exposed through author archives, the REST API, and other vectors.