Title: Security question
Last modified: September 7, 2026

---

# Security question

 *  Resolved [Jacob N. Breetvelt](https://wordpress.org/support/users/opajaap/)
 * (@opajaap)
 * [1 day, 13 hours ago](https://wordpress.org/support/topic/security-question-38/)
 * When you add `/wp-json/wp/v2/users/` to an url to a wp site, you get info that
   hackers will like very much.
    Example: [https://betatest.opajaap.nl/wp-json/wp/v2/users/](https://betatest.opajaap.nl/wp-json/wp/v2/users/)
   gives:
 *     ```
       0	
       id	1
       name	"Opajaap"
       url	""
       description	""
       link	"https://betatest.opajaap.nl/author/opajaap/"
       slug	"opajaap"
       avatar_urls	
       24	"https://secure.gravatar.com/avatar/121f62deb690afd6cb57c19b830d1a1ba4c8ce2f29e916426ded280bb7a71225?s=24&d=mm&r=g"
       48	"https://secure.gravatar.com/avatar/121f62deb690afd6cb57c19b830d1a1ba4c8ce2f29e916426ded280bb7a71225?s=48&d=mm&r=g"
       96	"https://secure.gravatar.com/avatar/121f62deb690afd6cb57c19b830d1a1ba4c8ce2f29e916426ded280bb7a71225?s=96&d=mm&r=g"
       meta	[]
       _links	
       self	
       0	
       href	"https://betatest.opajaap.nl/wp-json/wp/v2/users/1"
       targetHints	
       allow	
       0	"GET"
       collection	
       0	
       href	"https://betatest.opajaap.nl/wp-json/wp/v2/users"
       ```
   
 * How do i prevent this???

Viewing 2 replies - 1 through 2 (of 2 total)

 *  Moderator [threadi](https://wordpress.org/support/users/threadi/)
 * (@threadi)
 * [1 day, 12 hours ago](https://wordpress.org/support/topic/security-question-38/#post-19013521)
 * It’s just the REST API operating as it’s supposed to, not exposing anything that
   isn’t already publicly accessible on your site via a browser: [https://developer.wordpress.org/rest-api/](https://developer.wordpress.org/rest-api/)
 * There are plugins to disable it, but since it’s an expect and normal core function
   of WordPress, you could run into problems down the line: [https://wordpress.org/plugins/search/disable+rest+api/](https://wordpress.org/plugins/search/disable+rest+api/)
 *  Thread Starter [Jacob N. Breetvelt](https://wordpress.org/support/users/opajaap/)
 * (@opajaap)
 * [1 day, 11 hours ago](https://wordpress.org/support/topic/security-question-38/#post-19013587)
 * Thanx!

Viewing 2 replies - 1 through 2 (of 2 total)

You must be [logged in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fsecurity-question-38%2F%3Foutput_format%3Dmd&locale=en_US)
to reply to this topic.

 * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
 * 2 replies
 * 2 participants
 * Last reply from: [Jacob N. Breetvelt](https://wordpress.org/support/users/opajaap/)
 * Last activity: [1 day, 11 hours ago](https://wordpress.org/support/topic/security-question-38/#post-19013587)
 * Status: resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics