How to Block WordPress REST API in 2026: A UK Security Guide
16 August 2026
Learn how to block the WordPress REST API to boost security. Step-by-step methods, plugins, code, and UK-specific tips for 2026.
Why You Might Need to Block the WordPress REST API
The WordPress REST API, accessible via /wp-json/, lets developers interact with your site programmatically. But it also exposes user data, post details, and site structure to anyone who visits the endpoint. In the UK, where data protection rules under GDPR are strict, exposing sensitive information can land you in hot water with the ICO. Hackers often use the REST API to enumerate usernames or find vulnerable plugins. Blocking it—or at least restricting it—reduces your attack surface. If your site doesn't rely on modern block editor features or external apps, disabling the API entirely is a sensible security hardening step. We'll show you how to do it safely.
Before You Block: What the REST API Powers
Before you pull the plug, understand that the WordPress REST API isn't just for developers. The Gutenberg block editor uses it in the admin area, and many plugins (like contact forms, page builders, and live search) rely on it for front-end requests. If you're in the UK running an e-commerce or membership site, blocking everything could break checkout, login, or member dashboards. Also, popular security plugins like Wordfence use the API to perform some scans. The key is to block only what's needed—usually the unauthorised, logged-out access. Disabling the API completely can break your WordPress dashboard if you're not careful. We'll cover selective blocking methods that keep essential functions intact.
Method 1: Disable the REST API for Logged-Out Users (Recommended)
This is the best-practice method. It allows authorised admin actions to continue while preventing anonymous users from probing your site. You can add a simple code snippet to your theme's functions.php or, better, a site-specific plugin. The code checks for an authentication cookie and returns a 403 Forbidden response for unauthenticated requests to the REST API. For UK site owners, this balances usability and security—visitors still see your pages normally, but the /wp-json/ endpoint isn't readable without login. If you're not comfortable editing code, use a plugin like 'Disable REST API' or 'Blackhole for Bad Bots' which achieve the same result with a toggle. Always test after enabling.
Method 2: Full Block Using a Plugin or Code Snippet
For sites that don't use any front-end REST features, you might prefer a full block. Plugins such as 'Disable REST API' allow you to switch off all non-authenticated endpoints with one click. Alternatively, add this to your .htaccess file on Apache servers: `<IfModule mod_rewrite.c> RewriteEngine On RewriteRule ^wp-json.* - [R=403,L] </IfModule>`. On Nginx, add a location block to return 403. Remember to back up your .htaccess or server config first. UK hosting environments vary—some managed WordPress hosts restrict direct .htaccess changes. In that case, a plugin is safer. A full block can break the block editor, so if you notice issues, revert to the selective method above.
UK-Specific Considerations: GDPR and Site Security
UK businesses must comply with the UK GDPR and the Data Protection Act 2018. The REST API can leak personal data like user names and email addresses—a potential breach if unauthorised parties access it. Blocking unauthorised access is a reasonable security measure, but don't forget to document it in your data protection impact assessment (DPIA). Also, consider that many UK sites use services like Akismet or Jetpack, which may rely on the REST API for spam filtering or site backups. Review your plugin list and test after blocking. If you need guidance, the ICO's website offers practical advice on protecting personal data. A proactive approach shows good faith and reduces risk of fines.
FAQ
Yes, for most sites. Blocking the REST API for unauthenticated users is a standard security practice. It stops attackers from scanning your site and enumerating usernames. However, fully blocking it can break the Gutenberg editor and some plugins. So it's safer to disable only anonymous access.