/ Plugin Category

/ Security & Privacy

/ Security Scanning & Malware Protection

/ Disable WP REST API

Disable WP REST API

By Jeff Starr

Security & Privacy / Security Scanning & Malware Protection

Disable WP REST API Review - In-Depth Analysis

Disable WP REST API for non-logged users. Protects site data from unauthorized access.

Performance Overview

WPS Score

6.83/10

User Rating

4.8/5 (based on 36+ reviews)

Active Installations

30,000+

Update Frequency

Below Average It is calculated using the weighted average of same category plugins.

Security Score

1 / 10 (Very Low Risk) It is calculated using the weighted average of all versions.

What It Does

This plugin completely disables the WordPress REST API for visitors who are not logged into WordPress. No configuration is required.

It is important to note that this plugin disables the WP REST API for visitors who are not logged in. Therefore, it is not recommended if your site needs the WP REST API for any non-logged users.

This solution is fast, simple, and prevents abuse of your site's REST/JSON API. It protects your site's REST data from all non-logged users and bots while using only 4KB of code, making it lightweight and effective.

The plugin disables REST/JSON for visitors who are not logged in, removes the REST header in HTTP responses, and disables REST links in the HTML head for all users. It is a 100% plug-and-play solution.

For logged-in users, the WP REST API works normally, while logged-out users will receive a message stating that the REST API is restricted to authenticated users. This message can be customized via a filter hook.

This plugin does not collect or store any user data, does not set cookies, and does not connect to any third-party locations. It improves user privacy by protecting potentially sensitive information.

Developed and maintained by Jeff Starr, a 15-year WordPress developer, this free plugin is supported by donations and the purchase of related books and premium plugins.

Other Notable Features

Here are a few other notable features of this free Disable WP REST API plugin.

API

Disable WP REST API

REST API protection

FAQ

Technically this plugin disables REST API only for visitors who are not logged into WordPress. With that in mind, here are some good reasons why someone would want to disable REST API for non-logged users:

The REST API may not be needed for non-logged users
Disabling the REST API conserves server resources
Disabling the REST API minimizes potential attack vectors
Disabling the REST API prevents content scraping and plagiarism

I’m sure there are other valid reasons, but you get the idea 🙂

When the user is logged in to WordPress, the normal REST API data will be displayed. When the user is not logged in, this is the default message:

{"code":"rest_login_required","message":"REST API restricted to authenticated users.","data":{"status":401}}

By default the plugin displays a message for unauthenticated users: “REST API restricted to authenticated users.” To customize that message to whatever you want, add the following code via functions.php or simple custom plugin:

function disable_wp_rest_api_error_custom($message) {      return 'Customize your message here.'; // change this to whatever you want  } add_filter('disable_wp_rest_api_error', 'disable_wp_rest_api_error_custom');