Wp User Enumerate
Checks if usernames can be enumerated via /?author=1, /wp-json/wp/v2/users, /author/admin/.
One of 122 modules in the GateTest scan suite. Catches the issue before it reaches code review, and on paid tiers opens a pull request with the fix already written.
/?author=1 reveals login 'admin' via redirect
Why we catch it
Live-URL probes for the WordPress health check at /wp. Run against any public WordPress site.
The Wp User Enumerate module sits in this category alongside 5 related modules. Together they form one of the layers of a GateTest scan — checks fire in parallel, findings cluster by root cause, and on paid tiers the AI auto-fix loop reads each finding, writes the fix, validates against the scanner, and opens a PR.
How GateTest covers wp user enumerate
- Runs against a live URL. The live-URL scanners, not the repository tiers: the website scan ($29 full report) and the WordPress health check ($19). It probes a running site, so it needs a URL rather than a repo. No additional configuration.
- Free CLI.
npm i -g @gatetest/cli && gatetest --crawl https://your-site.example --module wpUserEnumerateagainst a site you own. No paywall on the scanning itself. - AI auto-fix PR. Live-URL findings come with plain-English fix instructions. Auto-fix pull requests are for repository findings on the Scan + Fix and Forensic tiers.
- Honest confidence rating. Findings come with high / medium / low confidence so noisy patterns don't block the gate. The confidence-calibrator trainer reads customer suppressions and tightens rules over time.
Scan your repo for wp user enumerate
Free preview of the headline findings. Pay per scan, not per seat — one-time scans never auto-renew.
Frequently asked questions
What does the Wp User Enumerate module catch?
Checks if usernames can be enumerated via /?author=1, /wp-json/wp/v2/users, /author/admin/. Example finding: /?author=1 reveals login 'admin' via redirect
Does GateTest fix Wp User Enumerate issues automatically?
Live-URL findings ship with plain-English fix instructions and, where the platform allows it, a generated config file. Auto-fix pull requests are written for repository findings on the Scan + Fix ($199) and Forensic ($399) tiers.
Which tiers include the Wp User Enumerate module?
The live-URL scanners, not the repository tiers: the website scan ($29 full report) and the WordPress health check ($19). It probes a running site, so it needs a URL rather than a repo.
Can I run the Wp User Enumerate module from the CLI for free?
Yes — install with `npm i -g @gatetest/cli` and run `gatetest --crawl https://your-site.example --module wpUserEnumerate`. The local CLI is free; paid tiers add AI auto-fix and the cross-finding correlation work.