Disable Author Archives

Every WordPress site has author archive pages at /author/username/. These pages list all posts by that author — and they also reveal the author’s login username. Attackers use this for reconnaissance: find the username, then brute force the password. If you don’t need author archives (many sites don’t), disable them entirely.

Use Cases#

• Prevent attackers from discovering admin usernames
• Remove unnecessary pages on single-author blogs
• Block the /?author=1 enumeration technique
• Reduce SEO crawl of low-value archive pages
• Simplify site structure by removing unused features

How It Works#

This is a toggle module — enable it and author archives are gone. No configuration needed.

When enabled:

• All /author/username/ URLs return 404 errors
• Author links in themes point to # (nowhere)
• The /?author=1 enumeration trick stops working
• Author archive templates are never loaded

What Gets Disabled#

Username Enumeration Explained#

Attackers use several techniques to discover WordPress usernames:

Technique 1: Direct URL

yoursite.com/author/admin/

If this loads, “admin” is a valid username.

Technique 2: Author Parameter

yoursite.com/?author=1

WordPress redirects to /author/[username]/, revealing the username.

Technique 3: REST API

yoursite.com/wp-json/wp/v2/users

Returns user data including usernames. (Use “Disable REST API” module for this.)

This module stops techniques 1 and 2. For technique 3, combine with the REST API module.

Verification#

After enabling:

1. Try visiting yoursite.com/author/admin/
2. Should see your theme’s 404 page
3. Try yoursite.com/?author=1
4. Should also return 404 (not redirect)
5. Check a blog post — author name link should go to #

Impact on Themes#

Most themes display the author name on posts with a link to their archive. After enabling this module:

• The link points to # (nowhere)
• Clicking the author name does nothing
• The author name itself is still visible

If you want to hide author names entirely, that’s a theme customization — edit your theme’s templates or use CSS to hide the author display.

Single-Author Blogs#

If you’re the only author on your site, author archives add no value:

• The author archive is just a duplicate of your main blog
• It exposes your username unnecessarily
• Search engines may see it as duplicate content
• There’s no reason for visitors to filter by author

This module is perfect for single-author blogs.

Multi-Author Sites#

On multi-author sites, author archives can be useful for:

• Finding all posts by a specific writer
• Author profile/bio pages (if theme supports it)
• SEO for author-brand building

Consider the tradeoff: Is the feature value worth the security exposure? You can use “Obfuscate Author Slugs” instead if you want archives but not username exposure.

FAQ#

Related Modules#

For comprehensive username protection, consider using multiple modules together: