How to Block WP JSON in WordPress: A UK Guide for 2026
16 August 2026
Learn effective ways to block WP JSON REST API in WordPress to boost security and comply with UK GDPR. Step-by-step for 2026.
What Is WP JSON and Why Should UK Site Owners Block It?
WP JSON refers to the WordPress REST API endpoint, typically located at /wp-json/, which exposes your site's data in a structured JSON format. While this API is useful for developers and powers the block editor, it can also reveal sensitive information such as usernames, post authors, and plugin versions to anyone who visits the endpoint. For UK website owners, this can be a serious security concern, especially if your site handles customer data or is subject to GDPR. Blocking WP JSON reduces your attack surface by preventing automated bots and malicious actors from harvesting information about your site's underlying code, themes, and user accounts. In this guide, we'll explore practical and legal ways to lock down this endpoint while ensuring your site remains functional.
Legal Considerations: UK GDPR and Data Exposure
Under the UK GDPR and the Data Protection Act 2018, you are required to implement appropriate technical measures to protect personal data. The default WP JSON endpoint can inadvertently expose usernames and other personal information of registered users, which may be considered a data breach risk. The Information Commissioner's Office (ICO) expects website operators to minimise unnecessary data exposure. Blocking or restricting access to WP JSON is a straightforward step that demonstrates good data stewardship. However, be careful to ensure that blocking does not break functionality that relies on the REST API, such as contact forms or payment gateways. Review your site's dependencies before applying a blanket block. In some cases, you may only need to disable the endpoint for unauthenticated users, which still allows logged-in users to access necessary features while protecting public-facing data.
Method 1: Using a Plugin to Disable WP REST API
The easiest way to block WP JSON is with a dedicated WordPress security plugin. Many popular plugins such as Wordfence, iThemes Security, and Sucuri include options to disable or restrict the REST API. They also provide granular controls, allowing you to block the endpoint for everyone except authenticated users or specific IP addresses. For UK site owners, choosing a plugin that is regularly updated and complies with current data protection standards is essential. When using a plugin, you can typically find the setting under the 'REST API' or 'API Security' section. Enable the option to 'Block REST API for unauthenticated users' and save changes. The advantage of this method is that you don't need coding knowledge, and the plugin handles all the technical implementation. Always test your site thoroughly after activation to ensure no critical functions break.
Method 2: Code Snippets for Blocking WP JSON
If you prefer a lightweight solution without installing an additional plugin, you can add a code snippet to your theme's functions.php file or a custom plugin. A common approach is to hook into the 'rest_authentication_errors' filter to return a WP_Error object when a request is made by an unauthenticated user. Alternatively, you can use .htaccess (if using Apache) to block direct requests to /wp-json/ via IP-based rules. For Nginx servers, you can add a location block to deny access. While these methods are effective, British site owners should be cautious and ensure they don't inadvertently block legitimate requests from services like post updates or theme checks. Always back up your site before making code changes. If you are not confident with coding, consult a developer who understands both WordPress and UK server environments.
Potential Downsides and Best Practices
Blocking WP JSON can break certain WordPress features, including the block editor, anonymous commenting, and third-party integrations that rely on the REST API. For example, if you use a GDPR-compliant cookie plugin that fetches data via AJAX, it might stop working. To mitigate these issues, we recommend blocking the endpoint only for unauthenticated users, as this preserves functionality for logged-in admins and editors. Additionally, you can whitelist specific IP addresses or user agents that need access. For UK site owners, it's also wise to monitor your server logs for any blocked attempts and adjust your settings based on real-world usage. Remember that blocking WP JSON is not a silver bullet; you should combine it with strong passwords, regular updates, and a web application firewall to ensure comprehensive security. Always document your configuration changes for compliance purposes.
FAQ
Yes, it is entirely legal to block WP JSON on your WordPress site. Under UK GDPR, you are encouraged to minimise data exposure. Blocking this endpoint for unauthorised users is a security measure that helps protect personal data. Just ensure you don't break any compliance-related features that rely on the REST API, such as cookie consent records.