We are about to launch a WordPress site hosted internally. As a standard practice, our IT security team does their check for any vulnerabilities. And sadly, they are able to retrieve the list of WordPress users/accounts.
Is there a way to hide them? I am envisioning this will involve changes to WordPress PHP files.