A quick script to unadvertise all the layers on a geoserver to by setting advertised to false using the geoservers REST APIs.

geoserver_unadvertise.py

'''
By default, all the layers in any geoserver are advertised. This means
that anyone with the link to the geoserver can view all the available
layers.

This is not an ideal situation. In case you already have a lot of layers
already uploaded onto the geoserver, it is cumbersome to manually go to
each layer an uncheck the `advertised` checkbox.

So a quick script can do that for you.
This works on vectors (datastores) and rasters (coveragestores)
'''

import requests

GEOSERVER_LINK = 'http://yourgeoserver.example.com/geoserver/rest'
AUTH = ('username', 'password')

def make_unadvertised(link):
    # Depending on whether the layer is a datastore or a coveragestore
    # The exact put request will vary.
    headers = {'Content-Type': 'application/xml'}
    if 'coverages' in link.lower().split('/'):
        data = '<coverage><advertised>false</advertised></coverage>'
    elif 'featuretypes' in link.lower().split('/'):
        data = '<featureType><advertised>false</advertised></featureType>'
    else:
        raise ValueError('Only works for coverages and datastores...')
    return requests.put(link, headers=headers, data=data, auth=AUTH)
  
def main():
    # First we get all the layers that are currently on the Geoserver
    layers = requests.get(f'{GEOSERVER_LINK}/layers', auth=AUTH).json()['layers']['layer']
    for i, layer in enumerate(layers):
        print(f'Layer number {i}: {layer["name"]}')
        # This link includes the details about workspace, datastore/coveragestore et
        layer_link = requests.get(layer['href'], auth=AUTH).json()['layer']['resource']['href']
        response = make_unadvertised(layer_link)
  
if __name__ == '__main__':
    main()