Why Secure User REST API?
What does this plugin do? Do you want to stop the public reading your user REST API in WordPress? Have you ever found yourself with a security exploit documented from a cyber security company? When it comes to secure audits, it’s better to be paranoid. We have found a common request from our WordPress care […]
Engineered from real client requirements and high-traffic performance audits, this tool eliminates database clutter, reinforces security policies, and streamlines your WordPress operational workflows.
How does it work?
User REST Permissions Plugin for WordPress
Block guest queries to sensitive user endpoints while keeping standard authenticated REST API workflows intact.
Pass Cybersecurity Penetration Audits
Instantly satisfy audit requirements for corporate clients who mandate blocking of public user enumeration on WordPress endpoints.
The Code Breakdown — Pure Performance
Hooks directly into the rest_authentication_errors filter without executing bulky database queries or external lookups.
Easy to Use and Saves Load Time
Stops automated credential stuffers and bots from wasting PHP processing cycles querying your author listings.
Free Download
Secure User REST API is free. Download it from GitHub and install it like any other plugin.
- The full plugin, free to use
- Use it on as many sites as you like
- Open source under GPLv2 or later
- Read the code and report issues on GitHub
How to install
- 1On GitHub, choose Code → Download ZIP.
- 2In WordPress, go to Plugins → Add New → Upload Plugin.
- 3Upload the ZIP file, then click Activate.
Frequently Asked Questions
Is this plugin free to use?
Yes, the Plugin is entirely free to use. We believe in providing a straightforward solution without any hidden costs. Simply download the plugin from our GitHub repository, follow the installation steps as your would for any wordpress plugin. On activation your WordPress user endpoints will require authentication.
What WordPress exploit does this fix?
In WordPress 4.7 the WordPress REST API was introduced. This API revealed a whole list of users to the API. It does not reveal emails or other data, but it does show usernames. The exploit is known as "CVE-2017-5487" The official fix is to only show users in this API that are Authors. Although this is an official fix, some penetration testers will say that any used data revealed without authentication is a risk. This plugin will allow that perceived weakness to be resolved by forcing the User API to be authenticated.
Can I use this code in my own plugin?
The code is released as GPL. You can use it with attribution.
Are there any alternatives to using this plugin?
As far as I know the only alternative is a pro plugin license for WordFence. A well known security plugin. If you are unsure of how best to secure your WordPress website, the use of WordFence would be a good start to harden your website.
Can I just turn off the end point for all users even when logged in?
No. The WordPress admin interface and block editor require the API to be readable or return a 401. The user / author selection box inside the Block Editor will disappear when a 401 is returned. If a 404 is returned it creates errors in the block editor.
What does the end point return when it is called?
The rest API for users will return a 401 response - Unauthorised when called directly. If you do not have permission inside the WordPress Admin it will return a 403. It does this automatically because it makes use of the API for the WordPress error object.
