diff --git a/auth/classes/external.php b/auth/classes/external.php
index 498c1879607..d6b44fdd111 100644
--- a/auth/classes/external.php
+++ b/auth/classes/external.php
@@ -370,7 +370,7 @@ class core_auth_external extends external_api {
      * @throws moodle_exception
      */
     public static function resend_confirmation_email($username, $password, $redirect = '') {
-        global $PAGE;
+        global $PAGE, $CFG;
 
         $warnings = array();
         $params = self::validate_parameters(
@@ -387,20 +387,27 @@ class core_auth_external extends external_api {
         $username = trim(core_text::strtolower($params['username']));
         $password = $params['password'];
 
+        $user = core_user::get_user_by_username($username);
+
+        if (!empty($user) && $user->confirmed) {
+            if (!empty($CFG->protectusernames)) {
+                throw new moodle_exception('invalidlogin');
+            }
+            throw new moodle_exception('alreadyconfirmed');
+        }
+
         if (is_restored_user($username)) {
+            if (!empty($CFG->protectusernames)) {
+                throw new moodle_exception('invalidlogin');
+            }
             throw new moodle_exception('restoredaccountresetpassword', 'webservice');
         }
 
         $user = authenticate_user_login($username, $password);
-
         if (empty($user)) {
             throw new moodle_exception('invalidlogin');
         }
 
-        if ($user->confirmed) {
-            throw new moodle_exception('alreadyconfirmed');
-        }
-
         // Check if we should redirect the user once the user is confirmed.
         $confirmationurl = null;
         if (!empty($params['redirect'])) {
diff --git a/auth/tests/external/external_test.php b/auth/tests/external/external_test.php
index 3aa3c459f6e..b07098fd4e3 100644
--- a/auth/tests/external/external_test.php
+++ b/auth/tests/external/external_test.php
@@ -182,6 +182,7 @@ final class external_test extends externallib_advanced_testcase {
         $this->assertTrue($result['success']);
         $this->assertEmpty($result['warnings']);
 
+        set_config('protectusernames', 0);
         $_SERVER['HTTP_USER_AGENT'] = 'no browser'; // Hack around missing user agent in CLI scripts.
         $this->expectException('\moodle_exception');
         $this->expectExceptionMessage('error/invalidlogin');
@@ -205,6 +206,7 @@ final class external_test extends externallib_advanced_testcase {
         $this->assertTrue($result['success']);
         $this->assertEmpty($result['warnings']);
 
+        set_config('protectusernames', 0);
         $_SERVER['HTTP_USER_AGENT'] = 'no browser'; // Hack around missing user agent in CLI scripts.
         $this->expectException('\moodle_exception');
         $this->expectExceptionMessage('error/invalidlogin');
@@ -235,6 +237,13 @@ final class external_test extends externallib_advanced_testcase {
         $result = external_api::clean_returnvalue(core_auth_external::confirm_user_returns(), $result);
         $this->assertTrue($result['success']);
 
+        // Keep protectusernames enabled so the call returns invalidlogin exception.
+        $this->expectException('\moodle_exception');
+        $this->expectExceptionMessage('error/invalidlogin');
+        core_auth_external::resend_confirmation_email($username, $password);
+
+        // Now disable protectusernames and expect an exception.
+        set_config('protectusernames', 0);
         $this->expectException('\moodle_exception');
         $this->expectExceptionMessage('error/alreadyconfirmed');
         core_auth_external::resend_confirmation_email($username, $password);