WordPress - 如何阻止未登录用户访问特定文件或目录？

Question

On my WordPress web site hundreds of login attempts by bots are observed.
They try to log in with user name that do exist in the system.

I want to stop this!

I found out, that these bots get the information about existing users from the URL mydomain.de/wp-json/wp/v2/users/

So I tried to block access to these files with the following code I found in other articles:

    add_filter( 'rest_authentication_errors', function( $result ) {
        // If a previous authentication check was applied,
        // pass that result along without modification.
        if ( true === $result || is_wp_error( $result ) ) {
            return $result;
        }

        // No authentication has been performed yet.
        // Return an error if user is not logged in.
        if ( ! is_user_logged_in() ) {
            return new WP_Error(
                'rest_not_logged_in',
                __( 'You are not currently logged in.' ),
                array( 'status' => 401 )
            );
        }
     
        // Our custom authentication check should have no effect
        // on logged-in requests
        return $result;
    });

With this, all those login attacks stopped.

But unfortunately this also stoped my addon CONTACT FORM 7 from working! I use this as a contact form for users that are not logged in. The addon tries to access /wp-json/contact-form-7/v1/contact-forms/9589/feedback and this is blocked by the code.

How cat I avoid this? Users that are not logged in should be able to use the web site. The should only be blocked from getting these "internal informations" from /wp-json/wp/v2/users/ and alike.

Thanks in advance.

Answer 1

Solved with addon

WP Cerber Security

which is able to block all rest api calls except for certain name-spaces like contact-form-7.