/ Plugin Category

/ Security & Privacy

/ Security Scanning & Malware Protection

/ Disable WP REST API

Disable WP REST API

By Jeff Starr

Security & Privacy / Security Scanning & Malware Protection

Disable WP REST API Review - In-Depth Analysis

Disable WP REST API for non-logged users. Protects site data from unauthorized access.

Performance Overview

WPS Score

7.04/10

User Rating

4.8/5 (based on 36+ reviews)

Active Installations

30,000+

Update Frequency

Below Average It is calculated using the weighted average of same category plugins.

Security Score

1 / 10 (Very Low Risk) It is calculated using the weighted average of all versions.

What It Does

This plugin completely disables the WordPress REST API for visitors who are not logged into WordPress. No configuration is required.

It is important to note that this plugin disables the WP REST API for visitors who are not logged in. Therefore, it is not recommended if your site needs the WP REST API for any non-logged users.

This solution is fast, simple, and prevents abuse of your site's REST/JSON API. It protects your site's REST data from all non-logged users and bots while using only 4KB of code, making it lightweight and effective.

The plugin disables REST/JSON for visitors who are not logged in, removes the REST header in HTTP responses, and disables REST links in the HTML head for all users. It is a 100% plug-and-play solution.

For logged-in users, the WP REST API works normally, while logged-out users will receive a message stating that the REST API is restricted to authenticated users. This message can be customized via a filter hook.

This plugin does not collect or store any user data, does not set cookies, and does not connect to any third-party locations. It improves user privacy by protecting potentially sensitive information.

Developed and maintained by Jeff Starr, a 15-year WordPress developer, this free plugin is supported by donations and the purchase of related books and premium plugins.

Comparing to Alternatives

Disable WP REST API is a straightforward plugin designed to restrict REST API access, focusing on simplicity and privacy. It stands out among similar plugins by offering an easy setup with minimal configuration.

Top alternatives

Strengths

Simple and lightweight with minimal impact on site performance
Effectively restricts REST API access to enhance privacy
Compatible with the latest WordPress versions
Easy to activate and use without complex settings

Weaknesses

May block functionality of other plugins relying on REST API, such as Contact Form 7
Lacks granular control over which endpoints to disable
Some users find it less flexible compared to .htaccess rule solutions
Premium features are not clearly detailed

User Sentiment Analysis

User feedback highlights the plugin's simplicity and effectiveness, though some report compatibility issues with other plugins.

Positive highlights

'Great plugin, takes no power from the blog' - tinaponting
'Simple, lightweight, maintains privacy, and functions with the latest WordPress' - wildstar2022
'Just activate the plugin and it works' - terrymason
'Good job' - pftsoi

Common complaints

Blocks Contact Form 7 forms from sending - Hendrik57
Can complicate other plugin functionalities relying on REST API - metaeditor

Weaknesses

Lacks fine-grained control over REST API endpoints
May cause conflicts with plugins that depend on REST API

Who Should Use This?

Best for

Users seeking a simple, no-fuss solution to disable the WordPress REST API for privacy or security reasons without needing advanced configuration.

Not ideal for

Sites that rely heavily on plugins or themes using the REST API, or users needing selective control over API endpoints.

Pricing & Value

Free version includes

The free version offers basic REST API disabling functionality, sufficient for most users wanting to block API access site-wide.

Pro version

Offers enhanced features such as selective endpoint disabling and advanced configuration options (details not explicitly provided).

Final Verdict

Disable WP REST API is an effective and lightweight plugin ideal for users wanting to quickly disable REST API access to improve site privacy and security.

However, users should be cautious if their site depends on REST API functionality, as it may interfere with other plugins or features.

Other Notable Features

Here are a few other notable features of this free Disable WP REST API plugin.

API

Disable WP REST API

REST API protection

FAQ

Technically this plugin disables REST API only for visitors who are not logged into WordPress. With that in mind, here are some good reasons why someone would want to disable REST API for non-logged users:

The REST API may not be needed for non-logged users
Disabling the REST API conserves server resources
Disabling the REST API minimizes potential attack vectors
Disabling the REST API prevents content scraping and plagiarism

I’m sure there are other valid reasons, but you get the idea 🙂

When the user is logged in to WordPress, the normal REST API data will be displayed. When the user is not logged in, this is the default message:

{"code":"rest_login_required","message":"REST API restricted to authenticated users.","data":{"status":401}}

By default the plugin displays a message for unauthenticated users: “REST API restricted to authenticated users.” To customize that message to whatever you want, add the following code via functions.php or simple custom plugin:

function disable_wp_rest_api_error_custom($message) {      return 'Customize your message here.'; // change this to whatever you want  } add_filter('disable_wp_rest_api_error', 'disable_wp_rest_api_error_custom');