add_action( 'plugins_loaded', function() {
if( ! is_user_logged_in() && isset( $_REQUEST['author'] ) ) {
if( preg_match( '/\\d/', $_REQUEST['author'] ) > 0 ) {
wp_die(
esc_html__( 'forbidden - number in author name not allowed = ', 'stop-user-enumeration' )
. esc_html( $_REQUEST['author'] )
);
}
}
} );
add_action( 'rest_authentication_errors', function( $access ) {
if(
preg_match( '/users/', $_SERVER['REQUEST_URI'] ) !== 0
|| isset( $_REQUEST['rest_route'] ) && preg_match( '/users/', $_REQUEST['rest_route'] ) !== 0
) {
if( ! is_user_logged_in() ) {
return new WP_Error(
'rest_cannot_access',
esc_html__( 'Only authenticated users can access the User endpoint REST API.', 'stop-user-enumeration' ),
array( 'status' => rest_authorization_required_code() )
);
}
}
return $access;
} );
Stop user enumerations for PCI scanner compliance
Secures user enumerations for PCI scanner compliance. Must be set to run on both front-end and back-end (run everywhere setting).
How to use
- Log into a staging, development, or locally hosted clone of your site
- Install and activate Code Snippets
- WP Admin > Snippets > Add New
- Copy and paste the code from the Description tab above
- Check to ensure formatting came over properly and no syntax errors show up in the editor
- Customize the code as desired
- Add a meaningful title
- Select whether to run on front-end or back-end (or both)
- Click “Save and Activate”
- Test your site to ensure it works
- Disable if any problems, or recover
- Repeat for live environment
License
All code snippets are licensed GPLv2 (or later) matching WordPress licensing.
Disclaimer of warranty:
Except when otherwise stated in writing the copyright holders and/or other parties provide the program as-is without warranty of any kind, either expressed or implied, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose.
Support
- Describe the issue and what you’ve observed.
- Describe your expected outcome(s).
- List steps to reproduce the issue.
- Optionally provide screen-shot or video URLs.
- Email to [email protected]
Partners
