How do you stop WordPress from leaking usernames through the REST API?
Answer
In 2019 the WordPress REST API published your valid usernames at /wp-json/wp/v2/users, handing hackers half of every login. I disabled it with a plugin such as Disable REST API or REST API Toolbox.