There's a new WordPress exploit out there but I will show you how I vaccinated myself against it 6+ years ago: remove\_filter ('wp\_head', 'rest\_output\_link\_wp\_head'); remove\_filter ('template\_redirect', 'rest\_output\_link\_header', 11); remove\_filter ('wp\_head', 'wp\_oembed\_add\_discovery\_links'); remove\_filter ('wp\_head', 'wp\_oembed\_add\_host\_js'); add\_filter ('json\_enabled', '\_\_return\_false'); add\_filter ('json\_jsonp\_enabled', '\_\_return\_false'); add\_filter ('xmlrpc\_enabled', '\_\_return\_false'); add\_filter ('rest\_url', 'jwz\_no\_rest', 1, 4); add\_filter ('rest\_url\_prefix', 'jwz\_no\_rest', 1, 1); function jwz\_no\_rest ($url, $path='', $blog\_id='', $scheme='') { return ''; } add\_filter ('rest\_authentication\_errors', function ($result) { return new WP\_Error ('Fuck REST', 'Fuck REST', array ('status' => 403)); }); // *And for good measure:* add\_filter ('wp\_supports\_ai', '\_\_return\_false'); Previously, previously, previously, previously.