Hardening
Information disclosure
Stops your site from handing out usernames and its WordPress version to anyone who asks, two facts attackers collect before they strike.
What it does
Block user enumeration: by default, visiting yoursite.com/?author=1 or the users list in the REST API reveals usernames. With this on, visitors who are not signed in get nothing: author lookups go to the home page, and the users list, the users sitemap and author details in embeds are removed.
Hide WordPress version: removes the version number WordPress prints in your page code and in the addresses of its own files.
Why it matters
A known username halves the work of guessing a password. A known version tells a robot exactly which old weaknesses to try. Neither fact helps your visitors.
Set it up
- Go to the Hardening tab, section Information disclosure.
- Switch on Block user enumeration and Hide WordPress version.
- Click Save Changes.
Good to know
Signed-in users are not affected, so the block editor and other admin tools keep working.
On sites using plain page addresses (like ?p=123), author archive pages stop working for visitors.
Hiding the version is not a substitute for updating. The readme.html file in your site's main folder still shows it; your host can remove that file.
Pair this with Hide login error details on the Login tab, which stops the sign-in page revealing usernames.
Which plan includes it
Both switches are in every plan.
How it works, for developers
- User enumeration (only for visitors not signed in):
?author=requests are redirected home with a 302 ontemplate_redirectat priority 1, before WordPress's own canonical redirect; the/wp/v2/usersREST routes are removed; the users sitemap provider is removed; author name and address are stripped from oEmbed responses. - Version:
wp_generatoris removed andthe_generatorreturns nothing. On the front end, a core file'sver=value is replaced with a hash of the version, so browser caches still refresh after an update. - Settings:
smg_block_user_enumeration,smg_hide_wp_version.
Quick answers about information disclosure
What does Information disclosure do in Stack Guard?
Block user enumeration: by default, visiting yoursite.com/?author=1 or the users list in the REST API reveals usernames. With this on, visitors who are not signed in get nothing: author lookups go to the home page, and the users list, the users sitemap and author details in embeds are removed. Hide WordPress version: removes the version number WordPress prints in your page code and in the addresses of its own files.
Why use information disclosure on a WordPress site?
A known username halves the work of guessing a password. A known version tells a robot exactly which old weaknesses to try. Neither fact helps your visitors.
How do I set up information disclosure?
1. Go to the Hardening tab, section Information disclosure. 2. Switch on Block user enumeration and Hide WordPress version. 3. Click Save Changes.
Which Stack Guard plan includes information disclosure?
Both switches are in every plan.
More in Hardening
- Remote access and commentsSwitches off the old and rarely used ways into WordPress, XML-RPC, pingbacks, trackbacks and application passwords, and can turn comments off across the whole site.
- File editor and admin over HTTPSRemoves the built-in code editors for themes and plugins, so a stolen admin account cannot be used to write malicious code into your site, and shows whether the admin area uses HTTPS.
- Security keysChanges the secret keys WordPress uses to sign people in. Every existing sign-in stops working at once, including any an attacker stole. Do it by hand, get reminders, or let Stack Guard do it on a schedule.
Not running Stack Guard yet? It is free.
Download Free