Remove users from WP-JSON - Rest / Route users

PHP 49

By default it is possible to call the route `{domain}/wp-json/wp/v2/users` and also `{domain}/wp-json/wp/v2/users/1`
This is a security issue because of shown login usernames.
// Disable /users rest routes
add_filter('rest_endpoints', function( $endpoints ) {
if ( isset( $endpoints['/wp/v2/users'] ) ) {
unset( $endpoints['/wp/v2/users'] );
}
if ( isset( $endpoints['/wp/v2/users/(?P<id>[\d]+)'] ) ) {
unset( $endpoints['/wp/v2/users/(?P<id>[\d]+)'] );
}
return $endpoints;
});

Recent Pastes

Raw Paste