Disable REST API

The WordPress REST API is powerful — it lets external apps read and write content on your site. But by default, a lot of data is publicly accessible to anyone who knows the endpoints. Your posts, users, and more can be scraped without authentication. This module locks that down, requiring login for any API access.

Use Cases#

• Prevent bots from scraping all your post content via API
• Block username enumeration through the /wp-json/wp/v2/users endpoint
• Reduce attack surface by removing an authentication endpoint
• Protect membership site content from unauthorized API access
• Keep internal data internal on private or corporate sites

How It Works#

This is a toggle module — enable it and the REST API is restricted. No configuration needed.

When enabled:

• Logged-in users: Full API access (works normally)
• Non-logged-in visitors: API returns “401 Unauthorized” error
• Frontend: REST API discovery links are removed from HTML

What Gets Blocked#

Before enabling:

curl yoursite.com/wp-json/wp/v2/users

Returns list of all users with usernames and profile info.

After enabling:

curl yoursite.com/wp-json/wp/v2/users

Returns:

{
  "code": "rest_disabled",
  "message": "REST API is disabled for non-authenticated users.",
  "data": { "status": 401 }
}

The module also removes:

• REST API <link> tags from your HTML head
• REST API links from HTTP headers
• REST API references in XML-RPC RSD

Who Can Still Access the API#

Any logged-in WordPress user can access the API. The API respects normal WordPress capabilities — a Subscriber can’t edit posts via API any more than they could in the admin.

Verification#

After enabling, test the restriction:

In an incognito/private browser window (not logged in):

1. Visit yoursite.com/wp-json/wp/v2/posts
2. Should see the “REST API is disabled” error message
3. View page source on your homepage — no wp-json link should appear

While logged in:

1. Visit yoursite.com/wp-json/wp/v2/posts
2. Should see normal JSON response with your posts

FAQ#

Common Integrations#