How to Disable WP JSON in WordPress: UK Guide for 2026
16 August 2026
Learn how to disable WP JSON in WordPress for UK sites. Compare plugins, code snippets, and GDPR-friendly security tips for 2026.
Why Disable WP JSON? UK Security & GDPR Angle
For UK website owners, the WP JSON (REST API) endpoint can be a double-edged sword. While it powers modern WordPress features, it also exposes user data, post listings, and site structure to anyone who knows the right URL. This can be a problem under the UK GDPR and the Data Protection Act 2018, especially if you handle personal data without strict access controls. Disabling WP JSON reduces your attack surface and helps prevent automated scans that target known vulnerabilities. For small business sites and blogs that don't rely on the REST API, turning it off is a practical, low-cost security measure. However, you need to balance security with functionality—we'll show you how to do it safely and legally.
Best Plugins to Disable WP JSON (UK Users)
Several WordPress plugins let you disable WP JSON in just a few clicks, even if you're not a developer. Popular options in 2026 include 'Disable REST API', 'WP Disable', and 'Disable WordPress WP-JSON' – all of which work well on UK hosts. 'Disable REST API' is particularly useful because it lets you restrict access to logged-in users only, rather than turning everything off. 'WP Disable' goes further, removing query strings and other bloat. For UK users, it's essential to choose a plugin that's maintained and compatible with the latest WordPress version. We also recommend checking reviews targeted at UK users, as some plugins may behave differently on certain UK hosting platforms like SiteGround or Kinsta. Always back up your site before installing a new security plugin.
Disable WP JSON Without a Plugin (functions.php)
If you prefer a lighter approach – or want to avoid an extra plugin – you can disable WP JSON using a code snippet in your theme's functions.php file or a site-specific plugin. The simplest method is to use the `rest_authentication_errors` filter to return a `WP_Error` for all REST API requests unless you're logged in. Another common approach is to remove REST API links from the head via `remove_action('template_redirect', 'rest_output_link_wp_head')`. For UK users, this code-based method is ideal because it does not add any dependency and keeps your site fast. However, be careful: if you change themes, you'll lose the snippet unless you use a child theme or a code manager plugin like WPCode. Test your site thoroughly after applying the code.
What About REST API? Selective Disabling Tips
Sometimes you don't need to fully disable WP JSON – you may just want to hide sensitive endpoints or restrict access. For UK businesses, a selective approach is often better for compliance. For example, you can disable the `/wp/v2/users` endpoint to stop user enumeration, while keeping the rest of the REST API active for your theme or plugins. The 'Disable REST API' plugin allows you to choose which routes are blocked. Alternatively, you can add custom code to `rest_endpoints` filter to unset specific routes. This way, you maintain functionality like block editor features and page builders, while protecting data. Whether you're a solicitor, GP practice, or e-commerce store, this targeted method meets UK security best practices without breaking your site.
UK Hosting & Performance Considerations
UK hosting providers often have specific security setups, but disabling WP JSON can complement their measures. Many UK hosts like 123 Reg, Fasthosts, and Heart Internet offer managed WordPress plans with built-in firewalls. However, these firewalls may not hide the WP JSON endpoint. Adding a disable plugin or code snippet gives you an extra layer of protection. From a performance perspective, disabling WP JSON reduces the number of requests to the server, which can slightly improve response times – especially on shared hosting. That said, some caching plugins like WP Rocket or W3 Total Cache already block unnecessary REST API calls for anonymous users. Consider your hosting environment, review your site's current use of the REST API, and then choose the most suitable method. Always monitor your security logs after making changes.
FAQ
Yes, it is safe for most standard WordPress sites, especially if you don't use the REST API for features like the block editor or plugins. You can re-enable it anytime. However, some plugins and themes may rely on the API – test your site thoroughly after disabling to ensure nothing breaks.