Case: Blocking REST User Enumeration Stopped Targeted Brute-Force

Case: Blocking REST User Enumeration Stopped Targeted Brute-Force
Attackers were pulling usernames from /wp-json/wp/v2/users, then brute-forcing those exact accounts. 12 valid usernames were exposed.

Enumeration SOP:

— Step 1: Confirm the leak. curl /wp-json/wp/v2/users returned all 12 author slugs + display names.
— Step 2: Restrict the endpoint to authenticated requests via a rest_authentication_errors filter.
— Step 3: Kill the legacy vector too: block /?author=1 redirect-to-slug at the WAF.
— Step 4: Set author slugs different from login usernames for all 12.
— Step 5: Re-curl both endpoints — expect 401 and no slug leak.

Outcome: Targeted brute-force attempts dropped from 1,900/day against named users to background noise. No further account-specific campaigns in 4 months.

Run this every time.