Pinny’s REST Lock – Block REST User Enumeration for WordPress

Blocks public REST API user enumeration while preserving full WordPress functionality.

Pinny’s REST Lock is an ultra-lightweight security plugin that locks down WordPress REST API user endpoints without breaking your site.

It is designed to fix one of the most common and overlooked WordPress security issues — public user enumeration via the REST API — using the correct, core-aligned approach.

🚨 Why This Plugin Is Necessary By default, WordPress publicly exposes REST API endpoints such as:

/wp-json/wp/v2/users

On public sites, these endpoints can be accessed without authentication and are routinely used as the first step in real-world attacks.

This is where attackers start.

Public access to REST user endpoints allows attackers to:

Enumerate valid usernames

Identify administrator and privileged accounts

Eliminate guesswork before brute-force attacks

Chain enumeration with login abuse and password reset attacks

This is not theoretical. User enumeration is a baseline reconnaissance technique used by bots and human attackers alike.

Blocking public access to REST user endpoints should be considered required security hygiene for every WordPress site.

⚠️ Common REST Protection Pitfalls Securing REST user endpoints requires precision. Broad or poorly timed restrictions often introduce serious side effects.