Blog
WordPress User Enumeration via the REST API: What It Is and How to Stop It
WordPress has shipped a built-in user enumeration vector since version 4.7: the REST API /wp/v2/users endpoint. It is enabled by default, requires no authentication, and returns login usernames. Here is how to stop it.
How to Disable Specific WordPress REST API Endpoints (Without Breaking Your Site)
Most WordPress hardening guides tell you to disable the REST API entirely. That breaks Gutenberg, WooCommerce, and half your plugins. The right move is surgical: block only the endpoints you do not need.