2

I just discovered /wp-json and it seem to give away some unwanted information. The entire json file is too big to scan everything so I decided to ask a question.

One particular thing I am concerned about is, it gives away user slug. Which kind of seem unnecessary to publish user id of site author. Should I be concerned or it is pretty common thing?

What other information does it give away? Should I be concerned and take any precautions?

Thanks.

1 Answer 1

3

/wp-json/ is the base part of the Wordpress REST API

https://developer.wordpress.org/rest-api/

An authors ID isn't a big deal. I would imagine on your theme, every time the post authors name shows, within the HTML showing the name, there'd be element classes containing the authors ID. It's normal to have shown in publicly viewable source code, and it's easy to discover "hack" an id by simply making a query on your site /?author=x and manually mapping IDs to usernames.

The link above details the REST API, and what it does and can show. I'm over simplifying it, but: the REST API acts as basically your entire Wordpress site, in JSON format - with availability to query and do specific things.

If nervous about the API and not using it, it's easy to remove.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.