Disable WP JSON UK: The 2026 Security Guide
16 August 2026
Learn how to disable WP JSON in the UK to improve WordPress security and performance. Step-by-step methods for 2026.
What Is WP JSON and Why UK Sites Disable It
WordPress exposes a built-in REST API via the /wp-json/ endpoint, which allows apps and plugins to interact with your site. However, this same endpoint is frequently probed by automated bots and malicious actors looking for user data, plugin vulnerabilities, or login credentials. Many UK site owners choose to disable WP JSON to reduce the attack surface and tighten security. In this guide, we’ll explain what this means for your WordPress site and walk you through safe, UK-friendly methods to disable or restrict it—without breaking essential functionality.
UK-Specific Reasons: GDPR, Security, and Performance
For UK WordPress sites, data protection is a top priority under the UK GDPR, enforced by the Information Commissioner’s Office (ICO). Leaving /wp-json/ wide open can expose usernames, author archives, and even draft post data to unauthorised users. That’s a compliance risk. Additionally, performance is critical: every request to /wp-json/ consumes server resources, and on shared UK hosting this can slow your site. By disabling or restricting the endpoint, you reduce unnecessary load and keep your site lean—a practice we recommend for all UK-based WordPress deployments.
Method 1: Disable WP JSON with a Plugin
The easiest way to disable WP JSON on your UK WordPress site is to use a well-crafted plugin. Popular options include “Disable REST API”, “WP REST API Controller”, and “Disable WP REST API”. These plugins let you switch off the endpoint entirely or only for logged-out users. They work flawlessly on Bluehost, Kinsta, SiteGround, and other UK hosting providers. Simply install and activate the plugin, then check the settings to choose your preferred level of blocking. No coding required. Always ensure the plugin is actively maintained and compatible with WordPress 6.x.
Method 2: Disable WP JSON via functions.php (Code Snippet)
If you prefer a lightweight solution without an extra plugin, you can add a code snippet to your child theme’s functions.php file. This example restricts access to /wp-json/ for unauthenticated visitors, returning a 401 error for unauthorised requests. Add the following to your theme: add_filter('rest_authentication_errors', function($result) { if (!is_user_logged_in()) { return new WP_Error('rest_not_logged_in', 'You are not logged in.', array('status' => 401)); } return $result; }); Create a child theme before editing, then test your site thoroughly. Consider using a snippet plugin to avoid breaking your site.
What You Lose (and How to Keep Important REST API Features)
Disabling WP JSON means some features may stop working—for example, the block editor (Gutenberg) relies on the REST API for saving posts. However, if you only disable the endpoint for logged-out users (as in the code above), admin functionality remains intact. Mobile apps and external integrations may also break if they depend on the public API. To balance security and usability, we recommend blocking only unauthenticated access. This way, you protect your UK site from bots and scrapers while keeping admin functions and authorised API consumers operational. Always monitor your site’s logs after making changes.
FAQ
Yes, disabling or restricting WP JSON is perfectly legal in the UK. It’s your server and your data. As long as you don’t break the accessibility of your site for legitimate users, you can configure your WordPress installation as you see fit. It’s actually a recommended security measure aligned with the UK GDPR’s confidentiality principle.