Directory / plugin
SMNTCS Disable REST API User Endpoints
v2.6 · by Niels Lange
Hides the list of user accounts that the WordPress REST API shows to visitors who are not logged in, which helps prevent user enumeration.
About this plugin
By default, anyone can request /wp-json/wp/v2/users on a WordPress site and get a list of every author’s username slug. Attackers use that list to guess logins.
SMNTCS Disable REST API User Endpoints removes the user endpoints from the REST API for visitors who are not logged in. Logged-in users and everything else in the REST API keep working, including the block editor.
There are no settings. Activate the plugin and the user endpoints are gone.
Contribute
Contributions are more than welcome. Simply head over to GitHub and open an issue or a pull request.