वर्णन
EnumGuard is a focused WordPress plugin that stops attackers from confirming that a username or user ID exists. WordPress still prints those signals by default; EnumGuard closes the usual paths without hiding display names on posts.
Under Settings EnumGuard you get three tabs:
- Protections — overview of which discovery paths are closed
- Settings — toggles and custom login / reset messages
- About — plugin info
Protections covered:
- Author ID queries (
?author=1) that would otherwise redirect to the author archive - Author archives and their feeds
- Author archive links printed in HTML
author-{id}/author-{nicename}body, post, and comment CSS classes- Core users sitemap (
/wp-sitemap-users-1.xml) - Unauthenticated
/wp-json/wp/v2/users(including?rest_route=) - REST
_embedauthor payloads and author link headers - Login error messages that distinguish “bad username” from “bad password”
- Lost-password responses (same confirmation whether the account exists)
- oEmbed
author_url/author_name - XML-RPC user-listing methods, with an optional full XML-RPC disable
- Author sitemaps and author archive URLs from Yoast, Rank Math, and The SEO Framework
Recommended protections ship enabled. Gutenberg still reaches the users REST API for logged-in editors. Display names stay visible. Login and reset protections also cover WooCommerce forms when WooCommerce is active. XML-RPC can be turned off completely if you do not need Jetpack, pingbacks, or the WordPress mobile app.
स्थापना
- Upload the
enumguardfolder to the/wp-content/plugins/directory. - Activate the plugin through the Plugins menu in WordPress.
- Open Settings EnumGuard to review protections.
नेहमी विचारले जाणारे प्रश्न
-
Yes. Display names stay in content. EnumGuard stops login slugs, author archive URLs, and existence oracles—not bylines.
-
Does this break the block editor?
-
No. Logged-in users who can edit posts or list users still reach
/wp/v2/users. Guests get a generic 404. -
What about WooCommerce?
-
Login and lost-password protections apply to the WooCommerce account forms as well as wp-login.php. Bylines and display names are unchanged.
-
What about the WordPress mobile app?
-
The app uses
wp.getUsersBlogs. That method is removed while “XML-RPC user methods” is on. Turn that protection off if you need the app. Do not enable “Disable XML-RPC.” -
Yes. Disable “Author archives” and “Author archive links” on the Settings tab. Keep author ID queries blocked so
?author=1cannot reveal the nicename. -
Does uninstall remove settings?
-
Yes. Uninstall deletes EnumGuard options on the current site, and on every site in a multisite network.
समीक्षा
ह्या प्लगइनसाठी कोणतेही समीक्षण नाही.
योगदानकर्ते आणि विकसक
“EnumGuard” हे मुक्त स्रोत सॉफ्टवेअर आहे. पुढील लोक या प्लगइनच्या निर्मितीत योगदान केले आहे.
योगदानकर्ते
भाषांतर करा “EnumGuard” तुमच्या भाषेत.
विकासातील आग्रह?
कोड ब्राउझ करा, SVN संग्रहालय तपासा, किंवा विकास लॉग च्या RSS द्वारे सदस्यता घ्या.
बदलांची यादी
1.0.0
- Initial release.