Web security

CMS user names not public

Security headers, HTTPS enforcement, cookies and cross-origin rules of the website.

Why it matters

With the login names public, password guessing needs only the password. Admin accounts named after the site or the owner are the first targets.

How to fix it

Quick fix · under 1 hour

Restrict the REST API users endpoint to signed-in users.
Make sure no administrator uses a name visible on the site.
Enable two-factor authentication and login rate limiting.

WordPress (functions.php)

add_filter('rest_endpoints', function ($endpoints) {
    if (!is_user_logged_in()) {
        unset($endpoints['/wp/v2/users']);
        unset($endpoints['/wp/v2/users/(?P<id>[\d]+)']);
    }
    return $endpoints;
});

How we test it

The check runs from the public internet as part of every scan, read-only and without touching your data. If it fails, your report shows the evidence that proves it - the record, header, file or banner we observed - together with the fix above, tailored to the issue we found.

Does your domain pass this check?

Run all 97 checks in about a minute. Your first scan is free, with the complete fix for your most urgent finding.

Scan your domain free