This HNQ answer seems to imply that the URL path /?rest_route=/wp/v2/users/ may be displaying information that is sensitive, and that perhaps there is some misconfiguration that allows WordPress to display details on that page.

Is there anything to those claims?

When I visit that url on my self-hosted WordPress site, I do indeed get a page full of items, but as far as I can tell there is nothing there that cannot be seen other parts of my site, such as the list of authors.

Should I be concerned? Is there a way to disable the /?rest_route functionality? Should I do that?

1 Answer 1


The /?rest_route URL is the non-prettified version of /wp-json, which is the URI the WordPress REST API uses.

The REST API should not be disabled since the Admin UI relies upon it. Having said that, you can require the REST API only service authenticated users. To require authentication, add the following rest_authentication_errors filter:

add_filter( 'rest_authentication_errors', function( $result ) {
    // If a previous authentication check was applied,
    // pass that result along without modification.
    if ( true === $result || is_wp_error( $result ) ) {
        return $result;

    // No authentication has been performed yet.
    // Return an error if user is not logged in.
    if ( ! is_user_logged_in() ) {
        return new WP_Error(
            __( 'You are not currently logged in.' ),
            array( 'status' => 401 )

    // Our custom authentication check should have no effect
    // on logged-in requests
    return $result;

I added it to my /wp-includes/rest-api.php file as part of the rest_api_default_filters() function definition. Clearly, this will be overwritten as soon as a new version of WordPress is release, so this is only a temporary measure. When I visit my site via the REST API url above, without being authenticated, I see the following:

enter image description here

  • 1
    Putting the code into a plugin would be the recommended way to survive version updates.
    – birgire
    Commented Oct 15, 2022 at 10:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.