No User Enumeration
In many WordPress installations is possible enumerate usernames through the author archives, using urls like this:
Consider an alternative
No User Enumeration shows warning signs in 2026 — compare the alternatives below before installing. It runs on 100+ sites and was last updated 7 years ago, and scores 25/100 on our health check.
- Small user base (100+ active installs)
- Very few reviews so far
- No update in 6 years
- Only tested up to WordPress 5.2 (latest is 7.1)
How does it stack up?
Side-by-side on installs, updates, ratings & support
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where No User Enumeration stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| security | >100 |
| user enumeration | >100 |
| wpscan | >100 |
Version adoption
Share of active sites per release.
About No User Enumeration
From the official readme · v1.3.2Description
In many WordPress installations is possible enumerate usernames through the author archives, using urls like this:
http://wpsite/?author=1
http://wpsite/?author=1/
http://wpsite/?bypass=1&author%00=1
http://wpsite/?author%00=%001
http://wpsite/?%61uthor=1
And recently wordpress since 4.7 comes with a rest api integrated that allow list users:
curl -s http://wpsite/wp-json/wp/v2/users/
curl -s http://wpsite/?rest_route=/wp/v2/users
curl http://wpsite/?_method=GET -d rest_route=/wp/v2/users
Know the username of a administrator is the half battle, now an attacker only need guest the password.
This plugin stop it.
Also, is possible get usernames from the post entries.
This plugin, hide the name of the author in a post entry if he is not using a nickname.
Also, hide the url page link of an administrator author.
The main goal is hide the administrators usernames.
Obviously, is better not choose “admin” as the username because is easiliy guessable.
Installation
- Upload
no-user-enumerationto the/wp-content/plugins/directory - Activate the plugin through the ‘Plugins’ menu in WordPress
Changelog
.
1.3.2
- Using WP_DEBUG not emit undefined index notice.
1.3.1
- Minor changes.
1.3
- Fix bypass protection using this: curl http://wpsite/?_method=GET -d rest_route=/wp/v2/users
1.2
- Disallow list users using the rest api.
- Compatibility with plugin WP All Import.
1.1
- Hide admin usernames in post replies. Improved security.
1.0
- First version.
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
Best No User Enumeration alternatives
All security plugins →
FAQ
No User Enumeration: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Oct 9, 2026
Is No User Enumeration free?
Yes. No User Enumeration is free to download and use from the official WordPress.org plugin directory.
Is No User Enumeration safe to use in 2026?
No User Enumeration shows warning signs in 2026 — compare the alternatives below before installing. It runs on 100+ sites and was last updated 7 years ago, and scores 25/100 on our health check.
How many websites use No User Enumeration?
No User Enumeration is active on 100+ WordPress websites and has been downloaded 5,097 times since it launched in April 2016. It was downloaded 88 times in the last 30 days.
Does No User Enumeration work with WordPress 7.1?
No User Enumeration is officially tested up to WordPress 5.2.29, while the latest release is 7.1.3. It may still work, but try it on a staging site first.
When was No User Enumeration last updated?
The latest version, 1.3.2, was released on October 23, 2019 (7 years ago).
Who makes No User Enumeration?
No User Enumeration is developed and maintained by Carlos.
What are the best alternatives to No User Enumeration?
The most popular alternatives to No User Enumeration are Wordfence Security (5M+ installs), Really Simple Security (3M+ installs) and Jetpack (3M+ installs).
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
