Remove the /users/ REST API endpoint in WordPress and ClassicPress

functions.php

/**
 * The following code will remove access to the /users/ endpoint. This makes the
 * endpoint inaccessible while not blocking access to other endpoints. This code
 * works with both WordPress and ClassicPress.
 *
 * Why do this? The REST API is very handy, however, by default, it exposes data
 * that you may not want exposed – namely, your site's usernames. With a list of
 * your usernames, the success of a brut-force attack becomes more likely.
 * 
 */
function codepotent_disable_rest_user_endpoint($endpoints) {
	$route = '/wp/v2/users';
	if (isset($endpoints[$route])) {
		unset($endpoints[$route]);
	}
	if (isset($endpoints[$route.'/(?P<id>[\d]+)'])) {
		unset($endpoints[$route.'/(?P<id>[\d]+)']);
	}
	return $endpoints;
}
add_filter('rest_endpoints', 'codepotent_disable_rest_user_endpoint');