Skip to main content
Login Join
Snippet · PHP

Disable User Enumeration via Query String

Shared by Darshit Rajyaguru · May 8, 2026 · @init

37 views
1 upvote
Back to Snippets

Blocks attackers from discovering usernames using ?author=1

add_action( 'init', 'wpf_block_user_enumeration' );

function wpf_block_user_enumeration() {
    if ( isset( $_GET['author'] ) && ! is_admin() ) {
        wp_redirect( home_url(), 301 );
        exit;
    }
}
Know a different way to do this? Add your approach as a variation so folks can compare them side by side.
Submit a variation

0 comments