WordPress is pretty easy to detect even when wp-admin is hidden. People seem to not know theres a json api that exposes a lot of information. It's a good idea t

WordPress is pretty easy to detect even when wp-admin is hidden. People seem to not know theres a json api that exposes a lot of information. It's a good idea to disable showing authors since this can give an attacker information they can use to exploit in a few different ways. We had to do this for a high profile client a while back and wrote a little helpful plugin I bet they are undercounting a bit since the large content sites will keep their WordPress install outside of public view completely and the site is just headless. [0] https://github.com/firstandthird/wp-disable-authors https://github.com/firstandthird/wp-disable-authors