/ Plugin Category

/ Security & Privacy

/ Security Scanning & Malware Protection

/ Disable REST API

Disable REST API

By Dave McHale

Security & Privacy / Security Scanning & Malware Protection

Disable REST API Review - In-Depth Analysis

Disable the REST API on your WordPress site for users. Control access with user role support.

Performance Overview

WPS Score

6.91/10

User Rating

4.8/5 (based on 38+ reviews)

Active Installations

90,000+

Update Frequency

Below Average It is calculated using the weighted average of same category plugins.

Security Score

1 / 10 (Very Low Risk) It is calculated using the weighted average of all versions.

What It Does

This plugin provides comprehensive control over access to the WordPress REST API. It is designed for easy installation and activation, making the REST API inaccessible to general site visitors.

If you need to allow access to certain endpoints, you can easily whitelist them through the Settings page. This whitelisting can be done for individual endpoints or entire branches of the REST API.

Moreover, you can manage access on a per-user-role basis, allowing different rules for unauthenticated users, WooCommerce customers, Subscribers, Editors, and Admins. By default, all defined user roles have full access to the REST API until you adjust these settings.

Comparing to Alternatives

Disable REST API stands out by allowing selective control over REST API routes, unlike other plugins that block the API entirely.

Top alternatives

Disable REST API

Strengths

Selective enabling of REST API routes
Simple and effective interface
Continues to work with latest WordPress versions
Helps secure sites while allowing necessary API access

Weaknesses

Lack of recent plugin updates
Limited to REST API control without additional security features
No official pro version or premium support options

User Sentiment Analysis

Users appreciate the plugin's focused functionality and reliability, though some note the lack of updates.

Positive highlights

'Allows locking the WP API behind auth and selectively allowing it where needed.' - Ronny Adsetts
'Still works for me on WordPress 6.2.' - mw815371
'A must have on all sites.' - ucsendre
'Does exactly what it's supposed to do.' - graphicvision1
'Perfect for securing site while enabling analytics.' - Ben Sibley

Common complaints

Lack of recent updates
No premium or extended features
Limited scope to REST API only

Weaknesses

No official support channel
No additional security features beyond API control

Who Should Use This?

Best for

Website owners and developers who need to secure their WordPress REST API by selectively enabling routes while blocking others.

Not ideal for

Users looking for a comprehensive security plugin or those who require frequent updates and premium support options.

Pricing & Value

Free version includes

The free version provides essential functionality to disable or selectively enable REST API routes, offering valuable control without cost.

Final Verdict

Disable REST API is a straightforward and reliable plugin for managing REST API access in WordPress, favored for its selective control capabilities.

While it lacks recent updates and premium features, it remains a valuable tool for users needing focused REST API security without additional complexity.

Other Notable Features

Here are a few other notable features of this free Disable REST API plugin.

REST API

API control

user role support

Screenshots

FAQ

While logged into WordPress as any user, the REST API will function as intended. Because of this, you must use a new browser – or Chrome’s incognito mode – to test your website with a clean session. Go to yourdomain.com/wp-json/ (or yourdomain.com/?rest_route=/ if you have pretty permalinks disabled) while NOT LOGGED IN to test the results. You will see an authentication error returned if the plugin is active. “DRA: Only authenticated users can access the REST API.”