How to Disable the WordPress REST API in 2026 (UK Guide)
17 August 2026
Learn how to disable the WordPress REST API safely in 2026. UK-specific advice for GDPR, security, and site performance. Step-by-step methods.
What is the WordPress REST API and Why Disable It?
The WordPress REST API is a set of endpoints that allow external applications to interact with your site's content and data. Introduced in WordPress 4.7, it powers the block editor and enables headless WordPress setups. However, many site owners in the UK choose to disable it for two main reasons: security and privacy. By default, the REST API exposes user information, post data, and even comments to anyone who knows the right URL. If you don't use external applications or a decoupled frontend, you're likely carrying unnecessary risk. Disabling it reduces your attack surface and helps you comply with UK GDPR obligations around minimal data exposure.
Security Risks and UK Data Protection (GDPR)
In the UK, the Data Protection Act 2018 and the UK GDPR require you to process personal data only when necessary. The REST API often exposes usernames, email addresses, and author archives without authentication. This can lead to unauthorised data collection and increase the likelihood of brute-force attacks. For example, an attacker could use the API to retrieve a list of all registered users and then target them with phishing emails. Disabling the REST API for unauthenticated requests helps you limit data exposure and demonstrate compliance. Remember, if your site stores personal data, you must take appropriate technical measures to protect it. Disabling unused APIs is a simple but effective step in your UK security toolkit.
Method 1: Disable REST API via Code (functions.php)
The most direct method is to add a filter to your theme's functions.php file or a custom plugin. You can block all REST API requests for logged-out users by hooking into the 'rest_authentication_errors' filter. A simple snippet: add_filter('rest_authentication_errors', function($result){ if (!is_user_logged_in()) { return new WP_Error('rest_not_logged_in', 'You are not authorised.', array('status' => 401)); } return $result; }). This allows logged-in users to continue using the API (useful for the admin dashboard) while preventing public access. Remember to use a child theme or standalone plugin to avoid losing changes during updates. Always test on a staging site first, as some plugins may rely on the API for functionality.
Method 2: Using a Plugin to Disable REST API
If coding isn't your strength, there are reliable plugins available. For UK users, we recommend 'Disable REST API' or 'WP Security & Firewall' plugins that include REST API control. These plugins let you selectively disable the API or restrict it to authenticated users. When choosing a plugin, verify it is compatible with your WordPress version and has good support. Some plugins also offer additional security features like login limits and IP blocking, which are valuable for UK sites under constant attack. Always read the reviews and check the last update date. Using a well-coded plugin is safer than modifying core files, and it gives you a user-friendly interface to manage REST access without touching code.
Best Practices for UK WordPress Site Owners
Before disabling the REST API, assess whether your site actually uses it. Popular plugins like Jetpack, WooCommerce, and contact forms rely on REST endpoints. If you need some endpoints but not others, consider a more granular approach. Use a security plugin that lets you whitelist specific routes. Also, monitor your site logs after disabling to catch any broken functionality. For UK compliance, maintain a record of why you disabled the API as part of your GDPR documentation. Finally, keep your WordPress core, themes, and plugins updated – disabling the API is not a silver bullet, but it's a sound step alongside regular backups and a robust security policy.
FAQ
Yes, it's safe for most sites that don't use headless WordPress or third-party applications. Disabling the API for unauthenticated users reduces your exposure to attacks. However, you may break functionality in plugins or the block editor if you block all requests. Always test thoroughly.