Block user enumeration

Requesting /?author=1 makes WordPress redirect to that user's archive, which exposes their login slug. Walking the numbers gives an attacker a list of real usernames, which is half of a brute-force attempt already solved. The REST endpoint /wp-json/wp/v2/users hands over the same list in a single request.

This closes both without taking away anything you use. Author archives at /author/name/ keep working, and logged-in users are unaffected, so the block editor's author pickers behave exactly as before.

What it does

• Redirects the ?author=N probe to your home page before WordPress can reveal the slug
• Removes the public /wp/v2/users REST endpoints for logged-out visitors
• Leaves real author archives working normally
• Skips the admin entirely, so nothing inside wp-admin changes

Good to know

• Priority is what makes this work, and it is the part most versions of this snippet get wrong. Core's own canonical redirect is what turns ?author=1 into /author/admin/, and at the same priority it runs first, so the slug leaks anyway. This runs ahead of it.
• Named archives are told apart from the numbered probe deliberately. WordPress resolves /author/admin/ to the same author id, so checking the author number alone would block the archive along with the probe.
• Logged-in visitors keep the users endpoint, which is what the editor needs
• The one thing to watch is a headless front end or third-party service that reads the users endpoint anonymously. Authenticated requests are unaffected.