# Hide the REST Users Endpoint From Subscribers and Customers

> Blocks the REST API users endpoint for logged-in users who cannot edit posts, such as subscribers and shop customers, so a low-level account cannot list your authors and their usernames.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: user-enumeration, rest-api, users
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/sec-rest-users-hidden-from-subscribers/

## Code

```php
add_filter( 'rest_pre_dispatch', function ( $result, $server, $request ) {
    $route = $request->get_route();

    if ( null !== $result || 0 !== strpos( $route, '/wp/v2/users' ) || ! is_user_logged_in() || current_user_can( 'edit_posts' ) ) {
        return $result;
    }

    if ( '/wp/v2/users/me' === untrailingslashit( $route ) ) {
        return $result;
    }

    return new WP_Error( 'rest_user_cannot_view', 'Sorry, you are not allowed to list users.', array( 'status' => 403 ) );
}, 10, 3 );
```

## Notes

Authors, editors and administrators keep access because the block editor needs it; their own /users/me request keeps working for everyone.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Hide the REST Users Endpoint From Subscribers and Customers" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/