Is it legal to disable the REST API under UK GDPR?

Yes, disabling the REST API is a legitimate security measure under the UK GDPR. The regulation requires you to protect personal data using appropriate technical measures. Blocking public access to the API helps prevent data breaches and unauthorised access. However, make sure you don't break any user rights, such as the ability to request a copy of their data via the API. You can keep GDPR-specific endpoints active while disabling the rest.

How do I disable the REST API for non-logged-in users only?

You can achieve this by adding a filter to your theme's functions.php file. The code checks if the user is logged in and returns an error if not. For example: add_filter('rest_authentication_errors', function() { if (!is_user_logged_in()) { return new WP_Error('rest_forbidden', 'REST API blocked for guests.', array('status' => 401)); } return true; }); This keeps the API available for admins and authenticated users while blocking public access.

What plugins work best for disabling the REST API on UK WordPress sites?

Popular plugins include Disable REST API, WP Security, and iThemes Security. For UK sites, we recommend plugins that are updated regularly and offer GDPR-friendly settings. Look for options that let you disable API for guests but keep it for logged-in users, and those that provide logging features. Avoid plugins with poor translations or ones that haven't been tested with the latest WordPress version. Always check user reviews for any UK-specific issues.

Can I still use the Gutenberg block editor after disabling the REST API?

If you completely disable the REST API, the Gutenberg editor will stop working because it relies on API calls. To preserve the editor, you should either restrict the API to logged-in users or use a selective disabling method. For example, you can block the wp/v2/users endpoint while keeping other routes active. This way, you can maintain an editor experience for admins while securing user data from public access.

How to Disable WordPress REST API for UK-Based Websites (2026)

16 August 2026

Learn how to disable WordPress REST API for UK websites to enhance security, comply with GDPR, and boost performance. Step-by-step guide.

Read this page in: Deutsch

Why Disable WordPress REST API? UK Security and Privacy Concerns

The WordPress REST API is a powerful feature, but it can also expose sensitive data to attackers. For UK website owners, the risks are particularly acute due to the UK GDPR and the Investigatory Powers Act. By default, the API allows anyone to fetch user data, post metadata, and even brute-force login attempts. Disabling it reduces your site's attack surface and helps you comply with data protection laws. Additionally, with the rise of bot traffic targeting UK sites, limiting API access can improve performance and prevent unauthorised data scraping. This is especially important for e-commerce and membership sites that process personal data of UK citizens.

Method 1: Disable WordPress REST API Using a Plugin (UK-Friendly Options)

For most UK site owners, using a plugin is the safest and simplest method. Popular security plugins like WP Security, Disable REST API, and iThemes Security offer one-click toggles to disable the REST API for non-logged-in users. Many of these plugins are developed with EU and UK GDPR compliance in mind, so they allow you to keep essential endpoints active while blocking the rest. Look for plugins that are regularly updated and have support for British English. Always choose a plugin from the official WordPress repository to ensure it meets UK accessibility standards and has no hidden backdoors. After installing, test your site thoroughly to ensure no critical functions break.

Method 2: Disable REST API via Code in functions.php (Developer Guide)

If you prefer a code-based approach, you can add a snippet to your theme's functions.php file. This gives you full control and avoids plugin overhead. The most common method is to filter the rest_authentication_errors hook: function restrict_rest_api_to_logged_in_users() { if ( ! is_user_logged_in() ) { return new WP_Error('rest_authentication_error', 'Sorry, you cannot access the REST API.', array('status' => 401)); } return true; } add_filter('rest_authentication_errors', 'restrict_rest_api_to_logged_in_users'); This blocks all unauthenticated API requests. For a UK site, you might also want to block requests from non-EU countries using geolocation, but that requires extra configuration. Always use a child theme and test on a staging site first.

UK-Specific Considerations: GDPR, ICO, and British Hosting

When disabling the REST API for a UK website, you must consider your obligations under the UK GDPR and the Data Protection Act 2018. The ICO (Information Commissioner's Office) expects you to implement appropriate technical measures to protect personal data. Disabling the REST API is a legitimate security measure, but it must not break user-facing features that rely on it, such as contact forms or live search. If you host your site with a UK-based provider like Krystal or 34SP.com, check whether they offer server-level protections that complement API disabling. Also, ensure your privacy policy reflects any changes to how data is processed. Keeping an access log of API requests can help with ICO compliance.

What Breaks When You Disable REST API? Alternatives and Best Practices

Disabling the REST API entirely can break the Gutenberg block editor, plugin updates, and features like the customizer. Before disabling, consider alternatives: restrict API access to logged-in users only, or selectively disable specific routes via filters. For UK sites, it's wise to keep the API active for authenticated admin users but block public access. This way, you maintain functionality while securing your data. If you must disable it fully, you'll need to replace lost functionality with server-side rendering or traditional admin-ajax calls. Always test under a staging environment and monitor your site's error logs after deployment. With careful planning, you can enjoy better security without hurting your UK visitors' experience.

FAQ

Disabling the REST API can slightly improve performance because it reduces the number of PHP requests from bots and malicious traffic. However, if you keep the API enabled for logged-in users, the impact is minimal for genuine visitors. For UK users, this is especially beneficial because it lowers server load on shared hosting plans. You'll notice a reduction in spam and unauthorised data fetching, which indirectly speeds up your site.

disable wordpress rest api wordpress security plugins uk uk gdpr wordpress compliance

Latest guides

Gcse stress management — Best Options in the UK (2026)Javascript operator — Best Options in the UK (2026)Javascript error logging and monitoring uk — Best Options in the UK (2026)Azure ad wordpress login — Best Options in the UK (2026)Wordpress azure ad sso — Best Options in the UK (2026)Fix woocommerce gateway timeout — Best Options in the UK (2026)