How to prevent hackers from harvesting WordPress usernames via the REST API
By default, WordPress publicly exposes a list of all registered usernames via its REST API at /wp-json/wp/v2/users. Any visitor – including attackers – can retrieve every username on your site without being logged in.
This is a common first step in brute-force attacks: collect valid usernames, then target them with password attempts.
Why it matters
Brute-force attacks are significantly easier when the attacker already knows valid usernames. With a list in hand, they can focus their attempts rather than guessing both credentials.
WordPress makes this information available by default because it’s technically useful for developers. But for most sites, there’s no good reason for usernames to be publicly accessible.
Blocking it with ToggleWP
ToggleWP’s Security & Authentication module includes a User Enumeration Prevention toggle. When enabled, it blocks public access to the /wp/v2/users REST API endpoint.
- Enable the Security & Authentication module.
- Toggle on User Enumeration Prevention.
The endpoint returns a permission error for unauthenticated requests. Authenticated admin requests still work normally.
Pair it with email-only login
If usernames are still used on the login form, knowing a username is half the battle. The Email-Only Login toggle in the same module forces users to log in with their email address instead. Email addresses are harder to enumerate than predictable usernames.
What else the module covers
The same module handles:
- Generic password reset error messages (prevents account confirmation via reset form)
- Admin domain restrictions (limit admin accounts to your agency’s email domain)
- Admin email change protection (requires confirmation before the change takes effect)
- Monthly admin check-ins to surface dormant accounts
These are lightweight, low-friction changes that close well-documented attack vectors. No security expertise required.