How to Disable the WordPress REST API: Best Plugins and UK-Specific Tips
17 August 2026
Looking to disable the WordPress REST API? Explore the best plugins for UK sites, improve security, and comply with UK GDPR. Step-by-step guide.
Why Disable the WordPress REST API?
The WordPress REST API is a powerful feature that lets developers interact with your site remotely. However, it also exposes data such as usernames, post information, and other metadata to anyone who sends a request to /wp-json. For UK site owners, this can be a security concern, especially if you run a local business, e-commerce store, or blog with a limited team. Attackers often use the REST API to enumerate users and launch brute-force attacks. Disabling it for unauthenticated visitors reduces your attack surface, protects personal data, and helps you comply with UK data protection principles under the UK GDPR.
Top Plugins to Disable the REST API (Updated for 2026)
There are several reliable plugins designed to disable or restrict the REST API. The 'Disable REST API' plugin by WP Guru is a lightweight option that instantly blocks all REST API requests from non-admin users. For more advanced protection, 'WP Cerber Security' includes a REST API manager as part of its firewall suite. Similarly, 'Wordfence Security' and 'iThemes Security' offer options to block REST API access selectively. In 2026, make sure your plugin is regularly updated and compatible with the latest WordPress version. Always choose a plugin with good UK support and clear documentation to avoid breaking features like Gutenberg or other plugins that rely on the API.
How to Disable REST API Without a Plugin (For Developers)
If you prefer a code-based approach, you can disable the REST API entirely by adding a simple hook to your theme's functions.php file. For example, you can use the 'rest_authentication_errors' filter to return a WP_Error for all unauthenticated requests. To allow access for logged-in admins only, you can check current_user_can('manage_options'). A more granular approach is to disable only specific routes or to block REST API access for logged-out users. This is ideal for UK developers who want tight control over their WordPress build, but be careful to test your site thoroughly—some plugins and theme features rely on the REST API for functionality.
UK-Specific Data Protection and REST API Considerations
The UK GDPR and the Data Protection Act 2018 require you to process personal data lawfully and securely. The WordPress REST API can unintentionally expose personal data, such as user display names, avatars, and post revisions, to anyone without authentication. For UK website owners, this can create a compliance headache, especially if you handle customer data. By disabling the REST API for unauthenticated users, you limit the risk of data mining and unauthorised access. This helps you meet the 'security of processing' principle under Article 32 of the UK GDPR. It also demonstrates to the ICO that you take data protection seriously. Remember to document your decision and keep logs for audit purposes.
Testing Your Site After Disabling the REST API
After you disable the REST API, it is essential to test your site thoroughly to ensure nothing is broken. Start by visiting /wp-json/ in your browser—if you are logged out, you should see an error or a blank page. Then, log in as an admin and confirm that the REST API still works for authenticated requests, as many dashboard features rely on it. Use tools like Postman or cURL to simulate different user roles. Check your front-end forms, page builders, and any e-commerce plugins to ensure they don't make unauthenticated REST API calls. If you notice issues, you can enable the API for specific routes or whitelist certain IP addresses. Testing is crucial for both security and usability.
FAQ
Yes, for most standard websites it is safe to disable the REST API for unauthenticated users. It reduces the risk of user enumeration and data exposure. However, features like the block editor (Gutenberg) and many plugins depend on the REST API for logged-in users, so you should only block it for anonymous visitors.