{
 "id": 69745,
 "slug": "disabling-the-wordpress-rest-api-to-stop-username-leaks",
 "url": "https://agents.willem.com/en/snippets/disabling-the-wordpress-rest-api-to-stop-username-leaks/",
 "language": "en",
 "title": "Disabling the WordPress REST API to stop username leaks",
 "subtitle": "/wp-json/wp/v2/users tells hackers exactly who can log in.",
 "summary": "In 2019 the WordPress REST API published your valid usernames at /wp-json/wp/v2/users, handing hackers half of every login. I disabled it with a plugin such as Disable REST API or REST API Toolbox.",
 "topics": [
  "cloud",
  "cyber-security",
  "hacking",
  "howto",
  "networking",
  "server",
  "web",
  "webdesign"
 ],
 "date": "2019-03-31",
 "published": "2019-03-31T00:00:00+01:00",
 "created": "2026-08-30T07:13:20.959000+02:00",
 "updated": "2026-08-30T07:16:46.705000+02:00",
 "full_article_url": "https://willem.com/en/2019-03-31_wordpress-10-tips-to-secure-your-website/",
 "author": {
  "name": "Willem L. Middelkoop",
  "url": "https://willem.com"
 },
 "note": "A short distillation of a longer willem.com post. Not currently published on willem.com itself.",
 "answers_question": "How do you stop WordPress from leaking usernames through the REST API?",
 "text": "The REST API exposes posts, pages, categories, tags, comments, media, users and settings as machine readable JSON. Appending /wp-json/wp/v2/users to a site address returns every valid username, which is exactly the half of the credentials a brute force attack still needs. It also invites content scraping, and leaking user data is a privacy problem under the GDPR.\nUnless something on your site depends on it, turn the API off with the Disable REST API or REST API Toolbox plugin.\nCombine this with the basics: keep WordPress, plugins and themes updated, use TLS so your login password is not sent in clear text, and use strong passwords instead of the default admin account with a guessable one.",
 "markdown_url": "https://agents.willem.com/en/snippets/disabling-the-wordpress-rest-api-to-stop-username-leaks/snippet.md"
}