/ Plugin Category

/ Security & Privacy

/ Security Scanning & Malware Protection

/ Stop User Enumeration

Stop User Enumeration

By fullworks

Security & Privacy / Security Scanning & Malware Protection

Reviewed by Omar Dabbas

Trusted WordPress expert with 20+ years of experience evaluating plugins for the WP ecosystem.

Stop User Enumeration Review - In-Depth Analysis

Stop User Enumeration secures your site by detecting and preventing user enumeration attacks. It logs IPs of potential attackers for enhanced security.

Performance Overview

WPS Score

6.99/10

User Rating

4.9/5 (based on 132+ reviews)

Active Installations

50,000+

Update Frequency

Below Average It is calculated using the weighted average of same category plugins.

Security Score

6 / 10 (Medium Risk) It is calculated using the weighted average of all versions.

What It Does

Stop User Enumeration is a security plugin designed to detect and prevent hackers scanning your site for user login names.

User Enumeration is a type of attack where nefarious parties can probe your website to discover your login name. This is often a pre-cursor to brute-force password attacks. Stop User Enumeration helps block this initial attack and allows you to log IPs launching these attacks to block further attacks in the future.

Tools like WPSCAN are designed for use by ethical hackers and make efforts to find user login names. Ethical hackers ask permission first, this plugin is designed to reduce the tools when used without permission and when used in conjunction with fail2ban can block those attempts at the firewall.

If you are on a VPS or dedicated server, as the attack IP is logged, you can use fail2ban to block the attack directly at your server's firewall, a very powerful solution for VPS owners to stop brute force attacks as well as DDoS attacks.

If you don't have access to install fail2ban, you can still use this plugin.

The plugin can stop the user id being leaked by the oEmbed API call.

Since WordPress 4.5 user data can also be obtained by API calls without logging in, this is a WordPress feature, but if you don't need it to get user data, this plugin will restrict and log that too.

Since WordPress 5.5 sitemaps are generated by core WP which includes a user/author sitemap that exposes the user id. You can enable or disable this in the plugin settings.

This plugin includes an optional email feature for plugin news and updates. When enabled, your email address may be sent for important plugin updates and security notices. This is completely optional and requires your explicit consent via the opt-in form in the plugin settings.

The plugin logs attempted user enumeration attacks locally using WordPress's standard logging system. IP addresses of potential attackers are logged locally for security monitoring. These logs remain on your server and are not transmitted to any external service. Logs can be used with fail2ban or similar tools for enhanced security.

Comparing to Alternatives

Stop User Enumeration is a specialized plugin focused on preventing user enumeration attacks, with several alternatives available that offer broader login security features.

Top alternatives

Strengths

Highly effective at blocking user enumeration attacks.
Lightweight and easy to configure without bloat.
Strong positive user feedback praising simplicity and reliability.
Works well at scale, used successfully on hundreds of sites.
Provides peace of mind by addressing a common security vulnerability.

Weaknesses

No pro version or advanced premium features.
Has a history of multiple security vulnerabilities, though fixed in updates.
Limited scope compared to broader security plugins.
Relies on users to keep plugin updated to avoid known vulnerabilities.

User Sentiment Analysis

With a near-perfect 4.9-star rating from 132 reviews, users overwhelmingly praise the plugin's effectiveness and ease of use, with very few complaints.

Positive highlights

"This plugin is incredibly easy to set up and works exactly as promised to keep my site secure—highly recommended!" - midimutt
"Simple, effective, and gives great peace of mind!" - 071910hytte1
"We as an agency use this plugin in 250+ WP installations and have made the best experience with its functionality and usability." - doffine
"Very helpful plug-in, thanks for developing it!" - Zinster
"Easy, yet powerful little tool." - meli2024

Common complaints

Weaknesses

History of multiple security vulnerabilities requiring timely updates.
No advanced features or premium support options.
Limited to user enumeration protection only.

Who Should Use This?

Best for

Site owners and administrators looking for a lightweight, focused solution to prevent user enumeration attacks without extra complexity.

Not ideal for

Users seeking comprehensive security suites or premium features; those unwilling to maintain regular updates due to past vulnerabilities.

Pricing & Value

Free version includes

The free version offers complete protection against user enumeration attacks with easy setup and no cost.

Final Verdict

Stop User Enumeration is a highly rated, specialized plugin that effectively blocks user enumeration attacks with minimal configuration and excellent user feedback. Its lightweight nature and ease of use make it a great choice for those needing focused protection without additional features.

However, its history of multiple security vulnerabilities means users must keep it updated to maintain security. Those seeking broader security solutions or premium support may prefer alternative plugins. Overall, it offers strong value as a free, dedicated user enumeration blocker.

Other Notable Features

Here are a few other notable features of this free Stop User Enumeration plugin.

User enumeration

Security

Fail2ban

FAQ

Are you logged in? This plugin won’t do anything for logged in users, it only works when you are logged out. This is the way it is designed. A common mistake is to install the plugin and test it, while still logged in as admin.