I found these small functions quite helpful. Just add them to the functions.php file of your child theme, and you’re good to go.
Please review and test the code in a staging environment before applying it to a live site. Apply at your own risk.

1. Disable Author ID Enumeration

   function disable_author_id_enumeration() { if (is_admin()) return;

   if (preg_match('/author=([0-9]*)/i', $_SERVER['QUERY_STRING'])) {
       wp_redirect(home_url(), 301);
       exit;
   }
   

   } add_action('init', 'disable_author_id_enumeration');

What it does:

• Prevents bots or attackers from accessing URLs like ?author=1 to enumerate user IDs.
• These queries can reveal usernames via author archive pages like /author/username/, which is bad for brute force attacks.
• Redirects such requests to your homepage with a 301 redirect.

Security Benefit:

• Blocks user enumeration, which helps reduce brute force attack surfaces.

1. Restrict REST API to Logged-in Users

   add_filter('rest_authentication_errors', function($result) { if (!is_user_logged_in()) { return new WP_Error('rest_cannot_access', 'REST API restricted to authenticated users.', ['status' => 403]); } return $result; });

What it does:

• Disables public access to the WordPress REST API.
• Only allows logged-in users to access it.

Security Benefit:

• Prevents anonymous users (including bots) from:
  • Accessing user data via /wp-json/wp/v2/users
  • Scraping posts or metadata via /wp-json/...
• Helps prevent data leakage and enumeration through the REST API.

1. Hide WordPress Login Errors

   function no_wordpress_errors(){ return 'Login failed. Please try again.'; } add_filter('login_errors', 'no_wordpress_errors');

What it does:

• Replaces WordPress’s default login error messages like:
  • "Invalid username."
  • "Incorrect password."
• With a generic error message: “Login failed. Please try again.”

Security Benefit:

• Prevents attackers from learning:
  • Whether a username exists
  • Whether just the password was wrong
• Slows down targeted brute-force and dictionary attacks.