Carlos

In many WordPress installations is possible enumerate usernames through the author archives, using urls like this:
http://wpsite/?author=1
http://wpsite/?author=1/
http://wpsite/?bypass=1&author%00=1
http://wpsite/?author%00=%001
http://wpsite/?%61uthor=1
And recently wordpress since 4.7 comes with a rest api integrated that allow list users:
curl -s http://wpsite/wp-json/wp/v2/users/ 
curl -s http://wpsite/?rest_route=/wp/v2/users 
curl http://wpsite/?_method=GET -d rest_route=/wp/v2/users
Know the username of a administrator is the half battle, now an attacker only need guest the password. 
This plugin stop it.
Also, is possible get usernames from the post entries. 
This plugin, hide the name of the author in a post entry if he is not using a nickname. 
Also, hide the url page link of an administrator author.
The main goal is hide the administrators usernames. 
Obviously, is better not choose “admin” as the username because is easiliy guessable.

No User Enumeration

incredibledeveloperr

User enumeration can be use for brute-force techniques to either guess or confirm valid users in a system. User enumeration is often a web application vulnerability, though it can also be found in any system that requires user authentication.
An enumeration attack allows a hacker to check whether a name exists in the database. For example, to set up a brute-force attack, rather than searching through login and password pairs, all they need is a matching password for a verified user name, saving time and effort.
The phrase “username harvesting” refers to a vulnerability that when exploited allows people or programs interacting with an application to determine what a valid username is vs an invalid username.
**You can check your site have user enumeration by simply type https://selectedfirms.co/wp-json/wp/v2/users that’s it. **
Features:
<ol>
<li>We only disable for non logged in users.</li>
<li>You can deactivate with single click. No extra configuration required.</li>
<li>Something else about the plugin</li>
</ol>

Disable User Enumeration

Disable User Enumeration is a plugin designed to prevent hackers scanning your site for user names using REST API call.

No User Enumeration vs Disable User Enumeration