Pinny’s REST Lock – Block REST User Enumeration

Blocks public REST API user enumeration while preserving full WordPress functionality.

Pinny’s REST Lock is an ultra-lightweight security plugin that locks down WordPress REST API user endpoints without breaking your site.

It is designed to fix one of the most common and overlooked WordPress security issues — public user enumeration via the REST API — using the correct, core-aligned approach.

🚨 Why This Plugin Is Necessary

By default, WordPress publicly exposes REST API endpoints such as:

/wp-json/wp/v2/users

On public sites, these endpoints can be accessed without authentication and are routinely used as the first step in real-world attacks.

This is where attackers start.

Public access to REST user endpoints allows attackers to:

• Enumerate valid usernames
• Identify administrator and pri…