Stop exposing usernames through a page nobody needed
Disable Author Archive blocks WordPress's automatic author archive pages and redirects visitors to a page or URL you choose, removing a thin duplicate-content page and the username it publishes in the same move.
- Blocks both /author/username/ and ?author=N author archive URLs.
- Redirect to a chosen page, a custom URL, or the homepage by default.
- Author byline links site-wide point straight at the new destination.
- Keeps author archive URLs out of the XML Sitemap module automatically.
Send visitors to
If left unset, visitors are redirected to the homepage.
What does Disable Author Archive do?
When the disable_author_archive module is active, TOWP_Disable_Author_Archive checks every request with WordPress's own is_author() conditional, which covers both the pretty-permalink /author/username/ form and the query-string ?author=N form, and issues a 301 redirect to a configured page, a custom URL, or the homepage if nothing's set. It also rewrites author byline links wherever a theme calls get_author_posts_url(), so links throughout the site point straight at the resolved destination instead of the blocked archive, and it tells the XML Sitemap module, if active, to leave author archive URLs out entirely.
WordPress publishes an archive nobody asked for
Because every user gets an author archive automatically, most sites end up with pages that duplicate content and expose a username without anyone deciding either was worthwhile.
Duplicated content, listed again at another address
An author archive usually shows the same posts already reachable through category, tag or date archives, creating a page whose content is duplicated somewhere else on the site.
The URL itself is the author's login name
The archive's own address, /author/username/, hands the account's actual login username to anyone who bothers to look, which is exactly the value an attacker would want for a login attempt.
One redirect, two problems solved
The module sends visitors somewhere useful before either the duplicate content or the exposed username gets published anywhere.
Every author archive URL blocked
Both the pretty-permalink and query-string forms of the author archive get caught by the same check, with nothing left unblocked.
Redirect to whatever fits the site
Send visitors to a specific page, a custom URL, or leave it unset for an automatic redirect to the homepage.
Links fixed at the source, not just blocked
Author byline links generated by the theme point directly at the new destination, so visitors never even hit the redirect in the first place.
Blocked, redirected, and corrected at the source
Every capability below is present in the supplied PHP class and its settings registration.
is_author() catches pretty and ugly permalinks alike
WordPress's own author conditional matches /author/username/ and ?author=N identically, so both forms redirect the same way.
Page, custom URL, or an automatic homepage fallback
Choose an existing published page, enter any URL, or, instead, leave it unset entirely and visitors land on the homepage by default.
The redirect host gets explicitly whitelisted
wp_safe_redirect() blocks any host but the site's own by default, so the module adds a configured external URL's host to the allowed list itself.
Not just blocked, corrected at the source
The author_link filter makes get_author_posts_url() return the resolved destination directly, so theme-generated byline links never point at a blocked page to begin with.
A permanent redirect search engines actually follow
The redirect uses a 301 status code, telling search engines the address has permanently moved rather than temporarily failing.
Author URLs excluded automatically
A dedicated filter tells the XML Sitemap module, if active, not to publish author archive URLs that this module redirects away from anyway.
Where blocking author archives helps most
The module supports any site where the author archive adds exposure or duplication without providing real value.
Sites where usernames shouldn't be public
Remove the one page that publishes a login username as its own URL, especially alongside a login restricted to username only.
Sites cleaning up duplicate content
Eliminate a page whose content already exists elsewhere, without needing to touch the posts or categories that create the duplication.
Single-author or small-team sites with no real use for author pages
Instead of leaving a page nobody actually browses, redirect it to somewhere more useful, like the homepage or a relevant landing page.
Less exposure, less duplication, better links
The module combines a real privacy improvement with a genuine SEO cleanup.
One check, early in the request
The verified implementation avoids rendering a page that would just be redirected away.
One conditional check per request
is_author() is a lightweight WordPress conditional; the check adds negligible overhead to every page load.
The redirect happens early, at template_redirect
Blocking happens before WordPress finishes building the page that would otherwise be discarded, avoiding unnecessary rendering work.
Link rewriting reuses an existing filter
Correcting author links uses WordPress's own author_link filter, adding no separate processing step beyond what themes already call.
Fewer usernames exposed, redirects validated carefully
The code closes off a real enumeration path and handles external destinations correctly rather than loosely.
Removes a username-enumeration page
Since the author archive's URL is the login username, blocking it removes one of the simplest ways to collect valid usernames for a login attempt.
Redirect destinations are validated
Before it's used, a configured page must actually exist, be a page, and be published; otherwise, anything else falls back to the homepage automatically.
External redirects are explicitly whitelisted, not blanket-allowed
Only the specific host of a configured Custom URL gets added to the allowed redirect list, not redirects to arbitrary hosts in general.
Configuration requires the same access as any other setting
Choosing the redirect destination happens through the standard TheOneWP settings screen, available only to an administrator.
Built directly around WordPress's own author and redirect systems
The supplied code integrates through APIs present in WordPress core and TheOneWP's own modules; this page makes no compatibility claim beyond the verified implementation.
is_author()
The native WordPress conditional used to detect any author archive request, in either permalink format.
wp_safe_redirect() and allowed_redirect_hosts
The core function and filter WordPress uses to redirect safely while still permitting an explicitly whitelisted external destination.
towp_sitemap_include_authors filter
A dedicated filter that keeps TheOneWP's own XML Sitemap module from publishing author archive URLs this module redirects away from.
TheOneWP versus common alternatives
Compare the verified Disable Author Archive implementation with a typical hand-written redirect snippet.
| Capability | TheOneWP Disable Author Archive | Other common solutions |
|---|---|---|
| Blocking both URL formats | /author/username/ and ?author=N both covered by the same check | Some snippets only catch the pretty-permalink form |
| Redirect destination | Page, custom URL, or automatic homepage fallback | Often hardcoded to a single fixed destination |
| External redirect targets | Explicitly whitelisted so they actually work | wp_safe_redirect can silently fail without this handling |
| Author byline links | Rewritten site-wide at the source | Usually still point at the now-blocked archive URL |
| Sitemap coordination | Author URLs excluded automatically when the module is active | Can leave dead author-archive links in a generated sitemap |
Block the archive in four steps
Confirm the redirect actually lands where expected before considering it done.
Enable Disable Author Archive
Activate the module from the TheOneWP Components settings tab.
Choose a Page or a Custom URL
Select an existing page from the site, or enter any URL as the redirect destination.
Leave it unset if the homepage is the right fallback
Skip configuration entirely to send visitors to the homepage by default.
Visit an author archive URL to confirm
Check that /author/username/ now redirects correctly to the configured destination.
Send visitors somewhere they'll actually want to be
A thoughtful destination makes the redirect feel intentional rather than like a dead end.
Redirect to something genuinely relevant
A category page, a team or about page, or the homepage all make better destinations than an arbitrary unrelated URL.
Confirm an external Custom URL actually redirects
Since external hosts need explicit whitelisting to work with wp_safe_redirect(), it's worth checking the redirect actually lands where expected.
Pair this with Hide Author Slug for full coverage
Blocking the archive removes the page; hiding the slug elsewhere removes remaining places the username might still surface.
Recheck after changing the destination
A quick visit to an author URL after updating the setting confirms the new destination is actually in effect.
Avoid gaps the redirect alone doesn't close
A couple of details are easy to overlook when relying on this module as the only fix.
Assuming an unpublished or deleted page still works as a destination
A configured page must be published and still exist; otherwise the module falls back to the homepage automatically.
Expecting an external redirect to work without checking it
An external Custom URL needs its host allowed for wp_safe_redirect() to actually reach it, which this module handles, but it's still worth confirming.
Forgetting the username is still visible elsewhere
Blocking the archive removes one exposure point; a username can still appear in other places like the login error message or a REST API response.
Disable Author Archive FAQ
These answers come directly from the verified class and its settings registration.
What does Disable Author Archive do?
It blocks WordPress's author archive pages, at both /author/username/ and ?author=N, and redirects visitors to a configured page, a custom URL, or the homepage by default.
Does this block both permalink formats for author archives?
Yes. WordPress's own is_author() conditional catches both the pretty-permalink and query-string forms identically.
What happens if I don't configure a destination?
Visitors get redirected to the homepage automatically.
Can I redirect to an external website?
Yes. A Custom URL can point anywhere, and the module whitelists that specific host so the redirect actually works.
What happens if the page I configured gets deleted or unpublished?
The module falls back to the homepage automatically, rather than redirecting to a broken destination.
Does this fix author links elsewhere on the site, or just block the archive page?
Both. Author byline links generated by the theme get rewritten to point at the resolved destination directly.
Does this affect the XML Sitemap module?
Yes, if it's active. Author archive URLs get excluded from the generated sitemap automatically.
Is this a permanent or a temporary redirect?
Permanent. The module uses a 301 redirect, the correct signal for search engines.
Does this remove the username from everywhere on the site?
No. It removes the author archive specifically; a username can still appear elsewhere, such as in login error messages.
Who can configure the redirect destination?
Only an administrator with access to the TheOneWP settings screen.
Stop publishing a duplicate page with a username as its address.Redirect it somewhere that actually helps visitors.
Use Disable Author Archive to block /author/ pages and send visitors to a page, a custom URL, or the homepage, with author links corrected site-wide.