Block WordPress user enumeration

tech-wp-user-enum

The WordPress REST API lists every account and its login name, which is half of a password guess. Close the users endpoint to anonymous callers.

Why this matters

Your WordPress REST API lists all user accounts. Username enumeration is reconnaissance that aids brute-force attacks but is not directly exploitable.

Your stack

Web servers

Nginx

Frameworks

WordPress

Nginx

1 Block the users REST API endpoint at the web server level

nginx

location ~* /wp-json/wp/v2/users {
    deny all;
    return 403;
}

WordPress

1 Disable the REST API users endpoint or restrict it to authenticated users
2 Install a security plugin like Wordfence or iThemes Security that can disable user enumeration
3 Alternatively, add a filter to functions.php to remove the users endpoint

php

// Add to functions.php
add_filter('rest_endpoints', function($endpoints) {
    if (isset($endpoints['/wp/v2/users'])) {
        unset($endpoints['/wp/v2/users']);
    }
    if (isset($endpoints['/wp/v2/users/(?P<id>[\\d]+)'])) {
        unset($endpoints['/wp/v2/users/(?P<id>[\\d]+)']);
    }
    return $endpoints;
});

WordPress docs

Does your app still have this?

Scan your domain