Disabling the REST API with a filter that returns an error for unauthenticated requests was a common hardening step, and on 5.0 it breaks the editor completely.
// what a lot of sites did in 2017 — now breaks editing
// add_filter( 'rest_authentication_errors', '__return_wp_error' );
// what to do instead: restrict the endpoints that leak
add_filter( 'rest_endpoints', function ( $endpoints ) {
if ( ! is_user_logged_in() ) {
unset( $endpoints['/wp/v2/users'] );
unset( $endpoints['/wp/v2/users/(?P<id>[d]+)'] );
}
return $endpoints;
} );The users endpoint is the one those hardening snippets were actually aimed at, since it enumerates author slugs for anyone who asks. Removing that endpoint specifically keeps the editor working and closes the hole. Any site that applied a blanket block will find the editor showing a white screen with a console error about a failed request, and it is worth checking for before upgrading rather than after.