by fullworks 4.9 (132 reviews)

Stop User Enumeration

Name: Stop User Enumeration
Rating: 4.9 (132 reviews)
Author: fullworks

Helps secure your site against hacking attacks through detecting User Enumeration

Stop User Enumeration ranks #706 among WordPress.org plugins with 50,000+ active installations, is #101 of 4,488 in the Security category, a 4.9/5 rating from 132 reviews, and was last updated Sep 3, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1

v1.7.8 Current Version v1.7.8

Updated 1 week ago Last Update on 03 Sep, 2026

Refreshed 15 hours ago Last Refreshed on

#101 of 4,488 in Security Top 1% by installs Downloads -76.8% this week Actively maintained

View on WordPress.org

Rank

#706

— No change

Active Installs

50K+

-13%

KW Avg Position

39.3

0.5 worse

Downloads

1.3M

+203 today

Support Resolved

— No change

Rating

98%

Review 4.9 out of 5

4.9 (132 reviews)

Next Milestone 60K

Total Progress 86.6%

50K+ 60K+

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 1,341 more installs to reach 60K+

Rank Changes

Current #706

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

4.9

132 reviews

Overall 98%

128 (97%)

2 (2%)

1 (1%)

0 (0%)

1 (1%)

Security History

Source: WPVulnerability

15 known vulnerabilities on record · 1 in the last 24 months · checked 1 week ago

Jun 26, 2025

Stop User Enumeration [stop-user-enumeration] < 1.7.3

CVE-2025-4302 · Fixed in v1.7.3
Jul 18, 2023

Stop User Enumeration [stop-user-enumeration] < 1.4.0

CVE-2023-33999 · Fixed in v1.4.0
Mar 2, 2019

Stop User Enumeration [stop-user-enumeration] < 1.3.20

Fixed in v1.3.20
Feb 25, 2019

Stop User Enumeration [stop-user-enumeration] < 1.3.20

Fixed in v1.3.20
Jul 26, 2017

Stop User Enumeration [stop-user-enumeration] < 1.3.9

Fixed in v1.3.9
Jan 15, 2017

Stop User Enumeration [stop-user-enumeration] < 1.3.8

CVE-2017-18536 · Fixed in v1.3.8
Jan 4, 2017

Stop User Enumeration [stop-user-enumeration] < 1.3.9

CVE-2017-1000226 · Fixed in v1.3.9
Jan 4, 2017

Stop User Enumeration [stop-user-enumeration] < 1.3.5

Fixed in v1.3.5
Apr 1, 2016

Stop User Enumeration [stop-user-enumeration] < 1.3.4

Fixed in v1.3.4
May 15, 2015

Stop User Enumeration [stop-user-enumeration] < 1.2.5

Fixed in v1.2.5

Showing the 10 most recent of 15 records.

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 1.7.8
Last Updated: Sep 03, 2026
Requires WP: 6.3+
Tested Up To: 7.1
PHP Version: 7.4 or higher
Author: fullworks

Support & Rating

Rating: ★ ★ ★ ★ ★ 4.9
Reviews: 132
Support Threads: 0
Resolved: 0%

Keywords

fail2ban security user enumeration wpscan

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,752

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

Akismet Anti-spam: Spam Protection

5M+ installs

Wordfence Security - Firewall, Malware Scan, and Login Security

5M+ installs

#11

Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

View all Security-and-spam-protection plugins

TL;DR

AI summary of the plugin's readme

This plugin is for WordPress site owners and administrators who want to protect their sites from attackers scanning for valid usernames. It detects and blocks user enumeration attempts made via GET/POST requests, the REST API, oEmbed, and author sitemaps, and can log attacker IPs for use with tools like fail2ban.

Blocks user enumeration via GET/POST
Syslogs blocks for Fail2Ban
Blocks REST API user requests
Removes author sitemap
Removes author from oEmbed
Removes numbers from comment authors

Frequently Asked Questions

Common questions about Stop User Enumeration

Yes, but the default ones are fine for most cases This doesn't work with PHP 5.6 or 7.1 ! This plugin does not support PHP less than 7.4. You really need to sort out your hosting, running version of software way past its supported end of life is a security risk.

Yes

A .htaccess solution is insufficient for several reasons, but most published posts on the subject do not cover POST blocking, REST API blocking and inadvertently block admin users access. And don't log the IP to a firewall, the major benefit!

If a comment is left by someone just giving a number that comment would be forbidden, as it is assumed a hack attempt, but the plugin has a bit of code that strips out numbers from comment author namesa1 Also usernames containing numbers may not work in the front end. Additionally the default rule for Rest APi is anything with users in it, so other plugins may set up endpoints.

There are two filters stop_user_enumeration_rest_stop_match set to /users/i by default and stop_user_enumeration_rest_allowed_match set to simple-jwt-login by default ( to allow that plugin's endpoints ) Developer Hooks and Filters The following hooks and filters are available for developers: Filters: * stop_user_enumeration_rest_stop_match - Modify the pattern used to detect REST API user queries (default: /users/i) * stop_user_enumeration_rest_allowed_match - Add exceptions to the REST API blocking rules (default: /simple-jwt-login/i) * stop_user_enumeration_ip - Filter the detected IP address before logging or processing (useful for integration with CDNs or proxies) * stop_user_enumeration_should_block - Determine if a request should be blocked based on IP or other conditions (return false to allow the request) Actions: * stop_user_enumeration_attempt - Triggered when user enumeration attempt is detected and logged (passes the IP address as parameter) These hooks enable add-on features like limit login attempts, block lists, WAF notifications, and integration with external services like Cloudflare.

No, but fail2ban will allow you to block IP addresses at your VPS / Dedicated server firewall that attempt user enumeration.

An fail2ban config file, wordpress-userenum.conf is found in the plugin directory stop-user-enumeration/fail2ban/filter.d

An example jail.local is found in plugin directory stop-user-enumeration/fail2ban

You can report security bugs through the Patchstack Vulnerability Disclosure Program. The Patchstack team help validate, triage and handle any security vulnerabilities. Report a security vulnerability.