kimipooh

WordPress redirects /?author=(number) to /author/(userID) if the author id exists. This is the security vulnerability because an internet user might be able to know all User ID and the user name in a website using WordPress.
If you can control the configuration of a web server, you had better use the rewrite rule (Search as “Block Author URLs”) for reducing the system load of WordPress.
The plugin prevents the security vulnerability regarding the author archive redirection.
Detailed Behavior 
1. It isn’t applied in the admin dashboard. 
2. If “author” query in URL (QUERY_STRING) exists, displays 404 error. 
3. If “/author/” in REQUEST_URI involves, redirects to the top page. 
4. Apply to the “redirect_canonical” hook, too.

Disable Author Archive Redirection

The plugin disables the author archive redirection.

Konstantin Obenland

This plugin replaces the author slug with a sanitized version of the user’s display name.
This plugin will not prevent hackers from finding out your login name but the login name won’t be visible 
in the author archive’s URL, which works towards your friendly URLs with using your display name.
DO NOT use this on a site with more than 1000 registered users, as updating all of their nicenames at once might break your site.

WP Author Slug

Easy way to add some obscurity to login guessing.

But please update as it's over 2 years now.

Excellent

This plugin would probably work OK if you have a small number of users (e.g. if your site doesn't allow public login). But if you have a large number of users (e.g. if you are running ecommerce or allow users to register for other reasons), this plugin will probably take down your site.

The reason is that there are hooks that run when you activate or delete the plugin. It runs database fetch and update queries on every user in your database, all in-line on the request (rather than background via a cron). So if you have a thousand or more users it attempts to do a thousand or more database writes when you click Activate or Delete from the plugins list. This will likely grind your website to a halt. 

It would be better/useable if you could either choose to only apply these scripts to specific user types (e.g. Author) or if you could run the update in batches in the background.

Don't use if you have a large user database

Add a layer of security and prevent your login name from being shown in the author archive's URL.

Disable Author Archive Redirection vs WP Author Slug