Disable the WordPress REST API: A UK Guide for 2026
16 August 2026
Learn how to disable the WordPress REST API for better security and GDPR compliance. Step-by-step instructions for UK site owners.
What Is the WordPress REST API?
The WordPress REST API is a powerful interface that allows external applications to interact with your site's data. Introduced in WordPress 4.4, it enables developers to create, read, update, and delete content via standard HTTP requests. For most UK site owners, it powers features like the block editor, mobile apps, and third-party integrations. However, it also exposes information about your site, including user names, post content, and metadata, which can be a security concern if you don't need these features. Understanding what the API does is the first step to deciding whether disabling it is right for your UK WordPress site.
Why You Might Want to Disable It in the UK
In the UK, data protection is governed by the UK GDPR and the Data Protection Act 2018. The REST API can inadvertently leak personal data, such as usernames, emails, and other metadata, to unauthenticated users. This can lead to brute-force attacks or data breaches, which can result in heavy fines from the Information Commissioner's Office (ICO). Disabling the REST API can reduce your site's attack surface and help you meet your data protection obligations. Many UK website owners also disable it to improve performance and prevent unauthorised access, especially on custom builds where the API isn't essential. It's a proactive step toward hardening your site.
How to Disable the REST API via a Plugin
The easiest method for UK users is to use a security plugin that includes a REST API disabling feature. Popular options include Wordfence, iThemes Security, and the dedicated 'Disable REST API' plugin. With Wordfence, you can go to 'All Options' and find the 'Disable WordPress REST API' setting. The dedicated plugin offers instant disables for non-authenticated users via a simple checkbox. These plugins are ideal if you're not comfortable editing code. Always choose a well-maintained plugin and update it regularly. Also, ensure the plugin is compatible with the latest WordPress version. After activation, test your site thoroughly to ensure nothing breaks.
How to Disable the REST API with Code
If you prefer a more hands-on approach, you can disable the REST API by adding a code snippet to your child theme's functions.php file or a custom plugin. The most common method is to hook into 'rest_authentication_errors' and block requests from users who are not logged in. Here's a simple snippet: add_filter('rest_authentication_errors', function($result) { if (!is_user_logged_in()) { return new WP_Error('rest_api_disabled', 'The REST API has been disabled.', array('status' => rest_authorization_required_code())); } return $result; }); This code ensures only authenticated users can access the API. Remember to use a child theme to avoid losing modifications during updates. Always back up your site before making changes.
Testing and Troubleshooting Your Setup
After disabling the REST API, you need to verify that it's truly blocked. You can do this by visiting /wp-json/ in your browser. If you're logged out, you should see an error message or a 'rest_cannot_access' JSON error. Also, check that your WordPress admin and front-end still load correctly. Some plugins, like WooCommerce, rely on the REST API for functionality – if you notice broken features, you'll need to allow specific routes or exceptions. Use tools like Browser DevTools or Postman to send requests to the API and confirm they're rejected. If you encounter issues, consider using a plugin that offers more granular control, such as allowing certain endpoints while blocking others.
FAQ
Yes, it is generally safe for most UK sites, but it can break features that rely on the API. Disabling it blocks unauthenticated access, which improves security. However, if you use the block editor or plugins like WooCommerce, you must allow certain endpoints. Use a plugin that gives you control over which routes are disabled to avoid issues.