=== EnumGuard ===
Contributors: alexhedstrom
Tags: security, user enumeration, rest api, login, xml-rpc
Requires at least: 6.3
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Stops WordPress user enumeration through author URLs, REST, login errors, XML-RPC, sitemaps, and oEmbed.

== Description ==

EnumGuard is a focused WordPress plugin that stops attackers from confirming that a username or user ID exists. WordPress still prints those signals by default; EnumGuard closes the usual paths without hiding display names on posts.

Under Settings → EnumGuard you get three tabs:

* Protections — overview of which discovery paths are closed
* Settings — toggles and custom login / reset messages
* About — plugin info

Protections covered:

* Author ID queries (`?author=1`) that would otherwise redirect to the author archive
* Author archives and their feeds
* Author archive links printed in HTML
* `author-{id}` / `author-{nicename}` body, post, and comment CSS classes
* Core users sitemap (`/wp-sitemap-users-1.xml`)
* Unauthenticated `/wp-json/wp/v2/users` (including `?rest_route=`)
* REST `_embed` author payloads and author link headers
* Login error messages that distinguish “bad username” from “bad password”
* Lost-password responses (same confirmation whether the account exists)
* oEmbed `author_url` / `author_name`
* XML-RPC user-listing methods, with an optional full XML-RPC disable
* Author sitemaps and author archive URLs from Yoast, Rank Math, and The SEO Framework

Recommended protections ship enabled. Gutenberg still reaches the users REST API for logged-in editors. Display names stay visible. Login and reset protections also cover WooCommerce forms when WooCommerce is active. XML-RPC can be turned off completely if you do not need Jetpack, pingbacks, or the WordPress mobile app.

== Installation ==

1. Upload the `enumguard` folder to the `/wp-content/plugins/` directory.
2. Activate the plugin through the Plugins menu in WordPress.
3. Open Settings → EnumGuard to review protections.

== Frequently Asked Questions ==

= Will authors still show on posts? =

Yes. Display names stay in content. EnumGuard stops login slugs, author archive URLs, and existence oracles—not bylines.

= Does this break the block editor? =

No. Logged-in users who can edit posts or list users still reach `/wp/v2/users`. Guests get a generic 404.

= What about WooCommerce? =

Login and lost-password protections apply to the WooCommerce account forms as well as wp-login.php. Bylines and display names are unchanged.

= What about the WordPress mobile app? =

The app uses `wp.getUsersBlogs`. That method is removed while “XML-RPC user methods” is on. Turn that protection off if you need the app. Do not enable “Disable XML-RPC.”

= Can I keep author archives for a magazine site? =

Yes. Disable “Author archives” and “Author archive links” on the Settings tab. Keep author ID queries blocked so `?author=1` cannot reveal the nicename.

= Does uninstall remove settings? =

Yes. Uninstall deletes EnumGuard options on the current site, and on every site in a multisite network.

== Changelog ==

= 1.0.0 =
* Initial release.
