WordPress username enumeration via the REST API

What it is

The WordPress REST API publicly lists real usernames. An attacker uses this to build a precise list of accounts to target with password-guessing, instead of guessing blindly.

How to fix it

Block REST-API user enumeration — the WordPress Plugin's Security tab does this automatically.

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)