There's a new WordPress exploit out there but I will show you how I vaccinated myself against it 6+ years ago: remove_filter ('wp_head', 'rest_output_link_wp_head'); remove_filter ('template_redirect', 'rest_output_link_header', 11); remove_filter ('wp_head', 'wp_oembed_add_discovery_links'); remove_filter ('wp_head', 'wp_oembed_add_host_js'); add_filter ('json_enabled', '__return_false'); ...