Disable WordPress REST API in the UK: A Practical 2026 Guide
16 August 2026
Learn how to disable WordPress REST API for UK sites. Step-by-step code, plugins, and security tips to protect your website.
What Is the WordPress REST API and Why Disable It?
The WordPress REST API allows external apps and scripts to interact with your site’s data through simple HTTP requests. It powers the block editor, mobile apps, and third-party integrations. However, it also exposes user names, post content, and comment data to anyone who queries your site. Many UK site owners choose to disable it for security or privacy reasons. Attackers often probe /wp-json/ for vulnerable endpoints or user enumeration. Disabling the REST API can reduce your attack surface considerably, especially if you don't rely on external services that need it. That said, you should understand exactly what you’re turning off before flipping the switch.
UK-Specific Threats: Bots, Scraping, and Data Exposure
In the UK, WordPress sites face automated bot traffic that scans for common vulnerabilities. The REST API is a favourite target because it can reveal registered user slugs, post revisions, and author archives. These details enable targeted phishing or brute-force attacks against admin accounts. Moreover, the UK's Data Protection Act 2018 and UK GDPR impose strict obligations on personal data. Exposing unpublished content or user information through unauthenticated REST API endpoints can lead to serious compliance issues. By disabling or locking down the REST API, you limit unintended data leakage and help protect the personal data of your visitors and users. This proactive step is often recommended by UK WordPress security consultants.
Method 1: Disable REST API via Code (functions.php)
The most lightweight method is adding a filter to your active theme’s functions.php file or a site-specific plugin. For unauthenticated requests, you can simply return an error. Here’s a commonly used snippet: add_filter('rest_authentication_errors', function($result) { if (!is_user_logged_in()) { return new WP_Error('rest_disabled', 'REST API disabled for this site.', array('status' => rest_authorization_required_code())); } return $result; }); This blocks all REST API access for visitors, while logged-in administrators and editors can continue using the block editor and dashboard. Remember to use a child theme so your changes aren't lost during updates. Always backup your functions.php file before editing and test in a staging environment first.
Method 2: Disable REST API Using WordPress Plugins
For non-coders, a plugin can simplify the process. Popular options include “Disable REST API,” “WP Security Headers,” and all-in-one security plugins like Wordfence or iThemes Security, which offer REST API controls. These plugins let you block the API completely, restrict it to authenticated users, or allow only specific routes. Many UK sites already use Wordfence for firewall protection, so enabling its REST API rules adds minimal overhead. Check the plugin settings carefully: some allow you to keep certain endpoints active, such as those needed for contact forms or theme customisers. If you’re using a caching plugin, remember to clear caches after making changes so the new headers take effect.
Best Practices for UK Site Owners: Selective Disabling and GDPR
Instead of a full shutdown, consider selective disabling. The REST API is essential for the block editor and many modern plugins. Blocking it for everyone may break functionality. For UK compliance, you should audit which endpoints your site actually uses. You can disable user enumeration endpoints while keeping the core API intact. Use a security scanner to test your /wp-json/ endpoints and see what’s exposed. Also, update your privacy policy to mention any remaining API routes. If you process personal data through forms, authorise specific routes only. Combine REST API restrictions with rate limiting, two-factor authentication, and regular core updates. This layered approach keeps you secure without creating a brittle site.
FAQ
Yes, it is generally safe if you don’t rely on external apps that need the API. The WordPress admin and front end work fine without it for most sites. However, some plugins and themes may use REST API for features like live previews. Always test after disabling and check your error logs.