REST API Lockdown SOP

REST API Lockdown SOP
The REST API leaks usernames by default. Close it methodically.

— Step 1: Hit /wp-json/wp/v2/users unauthenticated. If it returns names, you're enumerable.
— Step 2: Require authentication on the users endpoint, or filter it to return nothing for anonymous callers.
— Step 3: Disable endpoints you don't use — most sites never need /wp/v2/comments open for writes.
— Step 4: Verify author archives don't leak the login: /?author=1 must not redirect to a slug that equals the username.
— Step 5: Decouple display names from login names so a leak doesn't hand over half the credential.
— Step 6: Re-test after each plugin install — plugins re-open routes.

Do this on every new build.
Run this every time.