'block_rest_users', 'title' => 'Block public user list API', 'desc' => 'Remove the /wp-json/wp/v2/users routes', 'icon' => 'user', 'risk' => 'recommended', 'level' => 'standard', 'audience' => 'everyone', 'priority' => 7, 'benefit' => 'Anyone can open /wp-json/wp/v2/users and get the names and URL slugs of users who have published posts. The slug is usually the login name. Removing the route closes this easy way of collecting usernames.', 'help' => 'Removes the /wp/v2/users and /wp/v2/users/ REST routes for everyone, including logged-in users, so requests to them get a 404 (rest_no_route). /wp/v2/users/me keeps working. Side effect: the block editor loads its Author list from this route, so changing a post\'s author in the editor will not work while this is on. Plugins and apps that read users through the REST API are affected too.', 'before' => '/wp-json/wp/v2/users lists users who have published posts', 'after' => 'Returns 404 (rest_no_route) for everyone, logged in or not.', 'detect' => function () { return array( 'detected' => true, 'message' => 'User list exposed via REST API (/wp-json/wp/v2/users)', 'safe' => true, 'savings' => 'Security', ); }, 'callback' => function () { add_filter( 'rest_endpoints', function ( $e ) { unset( $e['/wp/v2/users'], $e['/wp/v2/users/(?P[\d]+)'] ); return $e; } );}, );