- Published on
Disabling WordPress public REST API
I've recently found that the public WP REST API endpoints within WordPress can provide information which can be used in 'hacking' attempts. One such endpoint is '/wp-json/wp/v2/users' (e.g. https://yourdomain.com/wp-json/wp/v2/users), this will display Admin usernames to any unauthenticated user. There are a couple of way to mitigate this risk, install the Disable REST API or add...