TL;DR

WP fail2ban can stop WordPress exposing valid usernames through the core routes attackers commonly use to collect them. Direct anonymous enumeration through the author query string or the REST users endpoint is blocked and becomes a hard-filter signal. oEmbed responses lose their author details, and the users sitemap is suppressed.

This protects login-capable usernames when your site still accepts them at login and can keep them out of public view. An attacker has to discover a valid identifier elsewhere instead of collecting one directly from WordPress.

WP fail2ban Free includes the protection, configured in wp-config.php, and writes the blocked enumeration attempts to the hard filter. Premium lets you configure the policy through WordPress admin and keeps those events available so you can see when the direct routes are being probed.

Treat direct enumeration as a hard signal

The classic author query string, ?author=N, lets a caller work through numeric IDs and discover the corresponding authors. When you enable the policy, you declare that route invalid for unprivileged visitors. WP fail2ban blocks the request and writes a hard-filter event that a configured fail2ban jail can act on immediately.

The REST users endpoint can return a list of users and their public details. WP fail2ban blocks anonymous requests to that endpoint and gives them the same hard treatment, while authorised requests and legitimate WordPress use can continue.

These requests go directly to interfaces used to enumerate users. Once your policy closes them to anonymous visitors, an attempt to use either one has a clear meaning.

Remove the information from public responses

Other WordPress features can expose the same information while doing legitimate work. oEmbed responses are used when another site creates a preview of your content, so WP fail2ban removes the author details without treating the request as an attack.

The users sitemap provides a ready-made list of public authors. WP fail2ban suppresses that sitemap rather than turning every request for it into a firewall event.

Direct enumeration attempts become hard signals; public mechanisms that disclose author information simply stop returning it.

Keep public identity distinct from the login username

WP fail2ban can protect the core enumeration routes, but WordPress is still a publishing system. Author identity is standard metadata used throughout the site.

WordPress can show a public nickname or display name instead of the login username. If you keep those values distinct, your site can publish an author identity without publishing a login identifier.

If the public name is the same as the username, however, the site is already publishing the value an attacker needs. No security plugin can remove it from every author reference without breaking normal WordPress behaviour.

WP fail2ban gives you the controls to choose a workable policy. You can keep public identity distinct and block the core enumeration routes, or require email addresses at login so a public username no longer works for authentication.

More about email-only login.

Use it where usernames still matter at login

User-enumeration protection is most useful when your site still accepts usernames at login but has no reason to publish them. WP fail2ban can then remove information that makes targeted login attacks easier while preserving the legitimate WordPress behaviour your site still needs.

When your site needs its usernames to remain public, email-only login can separate public identity from login identity. Blacklisted usernames give you another way to declare particular identifiers invalid.

You choose the policy that reflects how your site actually works. WP fail2ban gives you the controls to implement it.

More about login policy.