Stop User Enumeration

83 Quality Score

Active Installs

21/30

With 50,000 active installs and a niche security focus, it sits well below general-purpose plugins but is solidly adopted within its category.

Update Freshness

25/25

Last updated in December 2025 and tested against WordPress 6.9.4, the plugin is clearly current and actively maintained.

User Rating

15/15

A 98 out of 100 rating across 130 reviews is exceptional and indicates very high user satisfaction.

Support Health

8/15

Zero support threads, both opened and resolved, means there is no public track record to evaluate; the score is essentially a default.

WP Compatibility

15/15

Full marks for working on WordPress 6.3 through 6.9.4 with PHP 7.4, covering the vast majority of installations in 2026.

Scores higher than 91% of indexed plugins

About

Helps secure your site against hacking attacks through detecting User Enumeration

Active Installs 50k+

Rating ★★★★½ 4.9/5

Last Updated 2026-09-03 3:17pm GMT

Requires WordPress 6.3+

Tested Up To 7.1

Requires PHP 7.4+

Security History

8 known vulnerabilities, all patched

2 High 6 Medium

Most recent: June 26, 2025

View details ▸

Stop User Enumeration <= 1.7.2 - Protection Mechanism Bypass Medium

June 26, 2025 Patched in ["1.7.3"] CVE-2025-4302

Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get Medium

July 18, 2023 Patched in ["1.4.2"] CVE-2023-33999

Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update High

February 25, 2019 Patched in ["1.3.20"]

Stop User Enumeration plugin <1.3.9 - User Enumeration Medium

May 16, 2017 Patched in ["1.3.9"] CVE-2017-1000226

Stop User Enumeration <= 1.3.7 - Cross-Site Scripting Medium

January 15, 2017 Patched in ["1.3.8"] CVE-2017-18536

Stop User Enumeration <= 1.3.8 - Unauthenticated Username Enumeration Medium

January 4, 2017 Patched in ["1.3.9"] CVE-2017-1000226

Stop User Enumeration <= 1.3.4 - Username Enumeration Bypasses Medium

January 4, 2017 Patched in ["1.3.5"]

Stop User Enumeration <= 1.2.4 - Security Bypass High

February 3, 2014 Patched in ["1.2.5"]

What It Does

Stop User Enumeration blocks attackers from probing your WordPress site to discover valid usernames through author archives, REST API endpoints, and other common information disclosure vectors. Once installed, it requires no configuration; it silently intercepts enumeration requests and returns errors instead of leaking user data. It is a narrow, single-purpose security fix rather than a full security suite.

Who It's For

This plugin is best suited for site owners who want a lightweight, set-and-forget defence against username harvesting without installing a heavy security suite. It pairs well with fail2ban environments and sites that already handle authentication through other means but want to close off an easy reconnaissance vector. Small business sites, blogs, and membership platforms worried about targeted brute force will get good value here.

Who Should Skip It

If you already run Wordfence, Sucuri, or a comparable WAF with built-in user enumeration blocking, this plugin is redundant and adds no measurable protection. Sites on managed WordPress hosts like WordPress.com or Pressable, where enumeration is blocked at the edge, do not need it either.

The Bottom Line

Stop User Enumeration does one thing and does it well, with a near-perfect user rating, current compatibility, and zero configuration required. The lack of support thread activity is a minor worry, though it likely reflects the plugin's simplicity rather than neglect. Recommended as a low-cost belt-and-suspenders layer, especially if your main security plugin does not cover enumeration.

Pick this if you want broader hardening, including SSL enforcement and login protections, rather than a single-purpose enumeration block.

Wordfence Security – Firewall, Malware Scan, and Login Security 97/100

Choose Wordfence when you need a full firewall, malware scanning, and built-in enumeration blocking in one heavyweight package.

Jetpack – WP Security, Backup, Speed, & Growth 94/100

Go with Jetpack if you want security, backups, and performance bundled together, and do not mind a feature-rich, subscription-based plugin.

All-In-One Security (AIOS) – Security and Firewall 91/100

Pick AIOS if you prefer a free, all-in-one security suite with a friendly interface and built-in user enumeration defences.

Safe SVG 89/100

Safe SVG does not overlap directly; it addresses a different vulnerability (SVG uploads) and is not a real alternative to this plugin.