The list of WordPress users is publicly accessible

What it is

The /wp-json/wp/v2/users endpoint returns a list of all authors on the site — including user_login. In other words, exactly what you need on a login screen. On top of that, /?author=1 redirects to a URL containing the author’s name.

WordPress does this by design — the REST API is meant to expose authors publicly so themes know who wrote an article. But the default configuration also reveals the username, not just the display name.

Why it’s a problem

A brute-force attack on WordPress has two halves: guessing the username and guessing the password. /wp-json/wp/v2/users hands the attacker the first half for free. They’re no longer hunting for admin, root or info — they’re targeting your real accounts directly.

If you have XML-RPC enabled or no rate limit on /wp-login.php, this combination (user enum + brute-force) is a realistic attack within a few hours.

How to fix it

Step 1 — disable the REST API users endpoint

Add this to functions.php or to a site-specific plugin:

add_filter('rest_endpoints', function ($endpoints) {
    if (isset($endpoints['/wp/v2/users'])) {
        unset($endpoints['/wp/v2/users']);
    }
    if (isset($endpoints['/wp/v2/users/(?P<id>[\d]+)'])) {
        unset($endpoints['/wp/v2/users/(?P<id>[\d]+)']);
    }
    return $endpoints;
});

Step 2 — block the ?author=N redirect

add_action('template_redirect', function () {
    if (isset($_GET['author']) && !current_user_can('edit_posts')) {
        wp_redirect(home_url(), 301);
        exit;
    }
});

Step 3 — separate the display name from the username

If user enum leaks somehow anyway (cache, theme, plugin), user_nicename should not be identical to user_login. In each user’s admin profile:

A WordPress username can’t be changed through the UI once created. If you have an admin named admin, create a new admin, reassign all posts to them, and delete the old admin(WordPress offers to “attribute all content to” another user when deleting).

Plugin alternative

WPS Hide Login + Stop User Enumeration handle both in a couple of clicks.

References