Block user enumeration via ?author=

// Send logged-out visitors who try ?author=1, ?author=2... to the homepage.
add_action(
	'template_redirect',
	function () {
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only check.
		if ( ! is_user_logged_in() && isset( $_GET['author'] ) ) {
			wp_safe_redirect( home_url( '/' ), 301 );
			exit;
		}
	},
	1 // Before WordPress redirects to the author's archive URL.
);

// Remove the users sitemap, which lists every author archive.
add_filter(
	'wp_sitemaps_add_provider',
	function ( $provider, $name ) {
		return 'users' === $name ? false : $provider;
	},
	10,
	2
);

What it does

Visiting /?author=1 on a WordPress site redirects to that user's archive, for example /author/admin/. That reveals the login name, and bots run through ?author=1, ?author=2 and so on to collect them.

This snippet sends logged-out visitors who try it to your homepage, and removes the users sitemap (wp-sitemap-users-1.xml), which lists every author archive.

Good to know

• Author archives at /author/name/ still work. With plain permalinks, author archives use ?author=, so visitors won't see them.
• Add the "Disable the REST API users endpoints for visitors" snippet too. The REST API is the other common way to list users.
• This covers ?author= requests. Usernames can still show up elsewhere, for example in ?author_name= links, so don't rely on hidden usernames alone: use strong passwords.