Security: User Enumeration

Blocks guest attempts to enumerate valid usernames through the `author`

query variable or the REST API users endpoint.

Capabilities and extension points

Blocks guest attempts to enumerate valid usernames through the `author`

query variable or the REST API users endpoint.

Both guards are enabled by default and can be disabled independently, e.g. by a child theme that needs author archive pages or the REST users endpoint for guests:

add_filter( 'cherry/blossom/user_enumeration/block_author_param', '__return_false' ); add_filter( 'cherry/blossom/user_enumeration/restrict_users_endpoint', '__return_false' );

Registers hooks for blocking user enumeration.

Redirects guest requests carrying the `author` query variable.

Disable via the `cherry/blossom/user_enumeration/block_author_param` filter.

Removes the `/wp/v2/users` REST endpoints for unauthenticated

requests.

Disable via the `cherry/blossom/user_enumeration/restrict_users_endpoint` filter.

• param array $endpoints Registered REST endpoints.
• return array Endpoints without the users routes for guests.

Source reference

This editable reference page is based on the PHP documentation in security/class-user-enumeration.php.