There's a new WordPress exploit out there but I will show you how I vaccinated myself against it 6+ years ago:

remove_filter ('wp_head', 'rest_output_link_wp_head'); remove_filter ('template_redirect', 'rest_output_link_header', 11); remove_filter ('wp_head', 'wp_oembed_add_discovery_links'); remove_filter ('wp_head', 'wp_oembed_add_host_js'); add_filter ('json_enabled', '__return_false'); add_filter ('json_jsonp_enabled', '__return_false'); add_filter ('xmlrpc_enabled', '__return_false'); add_filter ('rest_url', 'jwz_no_rest', 1, 4); add_filter ('rest_url_prefix', 'jwz_no_rest', 1, 1); function jwz_no_rest ($url, $path='', $blog_id='', $scheme='') { return ''; } add_filter ('rest_authentication_errors', function ($result) { return new WP_Error ('Fuck REST', 'Fuck REST', array ('status' => 403)); }); // And for good measure: add_filter ('wp_supports_ai', '__return_false');

Previously, previously, previously, previously.