/** * Restrict public access to the WordPress REST API user endpoints. * Administrators and users with the list_users capability retain access. */ add_filter( 'rest_endpoints', function( $endpoints ) { $restricted_routes = array( '/wp/v2/users', '/wp/v2/users/(?P[\d]+)', ); foreach ( $restricted_routes as $route ) { if ( ! isset( $endpoints[ $route ] ) ) { continue; } foreach ( $endpoints[ $route ] as &$endpoint ) { // Restrict read operations only. $methods = $endpoint['methods'] ?? ''; $is_read_request = is_array( $methods ) ? ( isset( $methods['GET'] ) || isset( $methods['HEAD'] ) ) : ( stripos( $methods, 'GET' ) !== false ); if ( ! $is_read_request ) { continue; } // Preserve the original WordPress permission callback. $original_permission_callback = $endpoint['permission_callback'] ?? '__return_true'; $endpoint['permission_callback'] = function( $request ) use ( $original_permission_callback ) { if ( ! current_user_can( 'list_users' ) ) { return new WP_Error( 'rest_user_enumeration_forbidden', 'Access to the user endpoint is restricted.', array( 'status' => 403 ) ); } if ( is_callable( $original_permission_callback ) ) { return call_user_func( $original_permission_callback, $request ); } return true; }; } unset( $endpoint ); } return $endpoints; }, 99 ); home - Henniges Automotive