Usernames nobody can look up

A sign-in is two halves, and on a stock WordPress site the username is the easy one: the site hands it to anybody who asks. Stop usernames being looked up (on by default) closes the four ways machines ask:

• /?author=1, which WordPress redirects to /author/<username>/, and a machine counts on through 2, 3, 4. It now answers not found.
• The REST API's user list, /wp-json/wp/v2/users, which lists everybody who has published. It is refused to anybody who cannot write posts. Editors keep it, because the block editor's author menu reads it, and an app signed in with an application password can still ask who it is signed in as.
• Embeds. Every post that can be embedded elsewhere carried its author's name and author page. They are left out.
• The author sitemap, one file listing every author page. It is not offered.

The comment-author-<username> class WordPress puts on each comment by a signed-in user is taken off too.

What stays. An author page your theme links to keeps working, and a post keeps its byline, because those are things your site shows on purpose. That is also the one place no setting can help: WordPress sets a new account's public name to its username, so on many sites the byline is the username. The Settings screen lists anybody who can publish whose public name is still their username, with a link to their profile, where Display name publicly as changes it.

With pretty permalinks off, ?author=1 is the address of the author page itself, so it is left alone.

A failed sign-in is the other way a machine asks, because WordPress answers a name that is not an account differently. That is covered by Stop somebody after too many wrong passwords, and Not telling a machine which half was wrong below says exactly what it hides and what it cannot.