Address the Downsides to Disabling the REST API by Default about 10up-experience HOT 3 OPEN

The users endpoint is a problem and we do need to disable that for public consumption when we aren't using it. The problem is we build so many sites now that rely on the REST API that we will continue to cause outages on our client sites if we block any REST API end points by default and I just don't think engineers are going to read the documentation on this plugin before installing it. I would vote for an installation wizard, or, more simply, changing the behavior not to block anything but to show a warning in the wp-admin dashboard instead and require a box be checked in the settings to acknowledge that this endpoint is public on purpose. Now that we have the support monitor rolling out, we can potentially rely on that to provide visibility into which endpoints are public in a way we can take action on it.

from 10up-experience.

Uber projects have being blown up by this "bomb" today... We definitely need to escalate this issue and revisit how the plugin works during the initial activation and initial protection.

An alternative solution might be a setup wizard which is activated when we install and activate the plugin for the first time. Something like woocommerce does when you activate it for the first time.

cc @tylercherpak

from 10up-experience.

It feels like the default should probably be Restrict access to the users endpoint to authenticated users along with a much better explanation in the README. What does everyone think about that?

from 10up-experience.