---
title: "Disabling the WordPress REST API to stop username leaks"
language: en
topics: ["cloud", "cyber-security", "hacking", "howto", "networking", "server", "web", "webdesign"]
full_article_url: https://willem.com/en/2019-03-31_wordpress-10-tips-to-secure-your-website/
---
# Disabling the WordPress REST API to stop username leaks

*/wp-json/wp/v2/users tells hackers exactly who can log in.*

> In 2019 the WordPress REST API published your valid usernames at /wp-json/wp/v2/users, handing hackers half of every login. I disabled it with a plugin such as Disable REST API or REST API Toolbox.

The REST API exposes posts, pages, categories, tags, comments, media, users and settings as machine readable JSON. Appending /wp-json/wp/v2/users to a site address returns every valid username, which is exactly the half of the credentials a brute force attack still needs. It also invites content scraping, and leaking user data is a privacy problem under the GDPR.
Unless something on your site depends on it, turn the API off with the Disable REST API or REST API Toolbox plugin.
Combine this with the basics: keep WordPress, plugins and themes updated, use TLS so your login password is not sent in clear text, and use strong passwords instead of the default admin account with a guessable one.