Disable the REST API user endpoints due to obscure user slugs.
As of April 2026, SMNTCS Disable REST API User Endpoints is a WordPress rest-api plugin with 6.0K+ active installations and a 5/5 rating from 2 reviews. It has been downloaded 29K+ times in total. Requires WordPress 5.5+ and PHP 5.6+. Available on WordPress.org since 2016. Last updated 1 year ago — may have compatibility concerns. Downloads are up 61% this week. Top alternative: WooCommerce Legacy REST API.
With WordPress 4.7 the REST API is part of the core. At the moment everyone has read access to the REST API. As a result of that a potential intruder can retrieve a list of all user slugs via /wp-json/wp/v2/users. This plugin disables the REST API user endpoints to obscure the user slugs.
Contributions are more than welcome. Simply head over to Github and open an issue or a pull request.
Great plugin, works as it should, a must for any WordPress site.
Does what is says, and you really shoud use this on all your sites.
I just can’t imagine your woocommerce customers login names being exposed via the REST API. Though the REST API is an amazing feature
Kudos on this !!!
| WordPress | 5.5+ requiredTested up to 6.7.5 |
| PHP | 5.6+ required |
Plugin data sourced from WordPress.org. Analysis and metrics by PluginSift.