Author Avatars List/Block
This plugin makes it easy to display lists of user avatars, grouped by user roles, on your (multiuser) site. It also allows you to insert single avatars for blog users or any email address into a post or page – great for displaying an image of someone you’re talking about. It makes use of built-in WordPress (core) functions to retrieve user information and get avatars. Integrates with: Gutenberg, BuddyPress, xprofile, Multisite, Wpmu, BBPress, co-authors. Avatar lists can be inserted into your sidebar by adding a widget or into posts/pages by using a shortcode. The plugin comes with a tinymce editor plugin which makes inserting shortcodes very easy. This also provides Gutenberg Block for use with the Gutenberg editor. Please help with the plugin Translations at https://translate.wordpress.org/projects/wp-plugins/author-avatars. Both the shortcode and widget and Gutenberg Block can be configured to: Show a custom title (widget only) Only show specific user groups and/or hide certain users Limit the number of users shown Change the sort order of users or show in random order Adjust the size of user avatars Optionally show a user’s name or biography Show users from the current blog, all blogs or a selection of blogs (on WPMU/Multisite) Group users by their blog (when showing from multiple blogs), and show the blog name above each grouping. Support users from Co-Author Plus, Ultimate Member, BBpress and BuddyPress (xprofile) Limit the number of avatars per page for large sets by adding a page_size to the shortcode e.g. “page_size=30” (shortcode only) Additionally, single user avatars can be inserted using the show_avatar shortcode and configured to: Adjust the size of the user avatar. Align the avatar left, centered or right. The Gutenberg Block support both single user avatars and role based selections of avatars Please report bugs and provide feedback in the wordpress support forum. Plugin support: In 2011, Ben stepped down as maintainer of the Plugin, handing over ownership to co-author Paul Bearne, who continues to provide support and drive the development of new features.
WP Author Security
WP Author Security is a lightweight but powerful plugin to protect against user enumeration attacks on author pages and other places where valid user names can be obtained. By default, WordPress will display some sensitive information on author pages. The author page is typically called by requesting the URI https://yourdomain.tld/?author= or with permalinks https://yourdomain.tld/author/ . The page will include (depending on your theme) the full name (first and last name) as well as the username of the author which is used to log in to WordPress. In some cases, it is not wanted to expose this information to the public. An attacker is able to brute force valid IDs or valid usernames. This information might be used for further attacks like social engineering attacks or log in brute force attacks with gathered usernames. However, when using the plugin and you disable author pages completely it must be noted that you need to take care that your active theme will not display the author name itself on posts like “Posted by admin” or something like that. This is something the plugin will not handle (at the moment). By using the extension, you are able to disable the author pages either completely or display them only when the author has at least one published post. When the page is disabled the default 404 error page of the active theme is displayed. In addition, the plugin will also protect other locations which are commonly used by attackers to gather valid user names. These are: The REST API for users which will list all users with published posts by default. https://yourdomain.tld/wp-json/wp/v2/users The log in page where different error messages will indicate whether an entered user name or mail address exists or not. The plugin will display a neutral error message independently whether the user exists or not. The password forgotten function will also allow an attacker to check for the existence of a user. As for the log in page the plugin will display a neutral message even when the user does not exists. Requesting the feed endpoint /feed of your blog will also allow others to see the username or display name of the author. The plugin will remove the name from the result list. WordPress supports so-called oEmbeds. This is a technique to embed a reference to a post into another post. However, this reference will also contain the author name and a direct link to the profile page. The plugin will also remove the name and link here. Since WordPress 5.5 a default sitemap can be reached via /wp-sitemap.xml. This sitemap will disclose the usernames of all authors. If this should not be disclosed you are able to disable this feature of WordPress.
