/ Plugin Category

/ Security & Privacy

/ Security Scanning & Malware Protection

/ Disable WP REST API

Disable WP REST API

By Jeff Starr

Security & Privacy / Security Scanning & Malware Protection

Reviewed by Omar Dabbas

Trusted WordPress expert with 20+ years of experience evaluating plugins for the WP ecosystem.

Disable WP REST API Review - In-Depth Analysis

Disable WP REST API for non-logged users. Protects site data from unauthorized access.

Performance Overview

WPS Score

6.86/10

User Rating

4.8/5 (based on 36+ reviews)

Active Installations

30,000+

Update Frequency

Below Average It is calculated using the weighted average of same category plugins.

Security Score

1 / 10 (Very Low Risk) It is calculated using the weighted average of all versions.

What It Does

This plugin completely disables the WordPress REST API for visitors who are not logged into WordPress. No configuration is required.

It is important to note that this plugin disables the WP REST API for visitors who are not logged in. Therefore, it is not recommended if your site needs the WP REST API for any non-logged users.

This solution is fast, simple, and prevents abuse of your site's REST/JSON API. It protects your site's REST data from all non-logged users and bots while using only 4KB of code, making it lightweight and effective.

The plugin disables REST/JSON for visitors who are not logged in, removes the REST header in HTTP responses, and disables REST links in the HTML head for all users. It is a 100% plug-and-play solution.

For logged-in users, the WP REST API works normally, while logged-out users will receive a message stating that the REST API is restricted to authenticated users. This message can be customized via a filter hook.

This plugin does not collect or store any user data, does not set cookies, and does not connect to any third-party locations. It improves user privacy by protecting potentially sensitive information.

Developed and maintained by Jeff Starr, a 15-year WordPress developer, this free plugin is supported by donations and the purchase of related books and premium plugins.

Comparing to Alternatives

Disable WP REST API is a focused plugin designed to restrict access to the WordPress REST API, enhancing site privacy and security. It competes with a few similar plugins that offer REST API control with varying scopes and features.

Top alternatives

Strengths

Simple and lightweight, causing minimal performance impact
Effectively restricts REST API access to enhance privacy
Compatible with the latest WordPress versions
Easy to activate and use without complex configuration
No known security vulnerabilities reported

Weaknesses

May block legitimate REST API usage by other plugins, causing conflicts
Limited customization options for selective REST API access
Some users report it complicates other plugin functionalities
Not suitable for complex setups requiring granular REST API control

User Sentiment Analysis

With a high overall rating of 4.8 out of 5 from 36 reviews, users generally appreciate the plugin's simplicity and effectiveness. Positive feedback highlights ease of use and reliability, while a small minority report compatibility issues.

Positive highlights

'Great plugin, takes nopower from the blog' - tinaponting
'Simple, lightweight, maintains privacy, and functions with the latest WordPress' - wildstar2022
'Just activate the plugin and it works' - terrymason
'Good job' - pftsoi

Common complaints

Blocks Contact Form 7 forms from sending after activation

Weaknesses

Can interfere with other plugins relying on REST API
Limited flexibility in managing REST API access
May complicate setups that require REST API for functionality

Who Should Use This?

Best for

Site owners seeking a straightforward, no-fuss way to disable the WordPress REST API to improve privacy and reduce potential attack vectors.

Not ideal for

Users who rely on plugins or themes that require REST API access, such as Contact Form 7, or those needing granular control over REST API endpoints.

Pricing & Value

Free version includes

The free version provides essential functionality to disable the REST API site-wide with minimal configuration.

Pro version

Offers advanced features such as selective endpoint disabling, user role-based access control, and enhanced compatibility options.

Final Verdict

Disable WP REST API is a highly rated plugin that delivers on its promise of simplifying REST API restrictions with minimal impact on site performance. Its ease of use and lack of security vulnerabilities make it a solid choice for users prioritizing privacy.

However, users should be cautious if their site depends on REST API functionality for plugins like Contact Form 7, as it may cause conflicts. Alternatives with more granular control might be better suited for complex needs.

Other Notable Features

Here are a few other notable features of this free Disable WP REST API plugin.

API

Disable WP REST API

REST API protection

FAQ

Technically this plugin disables REST API only for visitors who are not logged into WordPress. With that in mind, here are some good reasons why someone would want to disable REST API for non-logged users:

The REST API may not be needed for non-logged users
Disabling the REST API conserves server resources
Disabling the REST API minimizes potential attack vectors
Disabling the REST API prevents content scraping and plagiarism

I’m sure there are other valid reasons, but you get the idea 🙂

When the user is logged in to WordPress, the normal REST API data will be displayed. When the user is not logged in, this is the default message:

{"code":"rest_login_required","message":"REST API restricted to authenticated users.","data":{"status":401}}

By default the plugin displays a message for unauthenticated users: “REST API restricted to authenticated users.” To customize that message to whatever you want, add the following code via functions.php or simple custom plugin:

function disable_wp_rest_api_error_custom($message) {      return 'Customize your message here.'; // change this to whatever you want  } add_filter('disable_wp_rest_api_error', 'disable_wp_rest_api_error_custom');