How to Disable the WordPress REST API in 2026: A UK Guide
16 August 2026
Learn to disable the WordPress REST API in 2026. Step-by-step guide for UK site owners to boost security and reduce attacks.
Why Disable the WordPress REST API?
The WordPress REST API is a powerful feature that lets apps and developers interact with your site. But it can also expose sensitive data, such as user names, post data, and even private content, to unauthorised users. In recent years, hacker bots have increasingly probed REST API endpoints to find weaknesses. For UK website owners, particularly those handling personal data under GDPR, limiting this exposure is a smart security measure. Disabling the REST API for unauthorised users can prevent data leaks, brute-force attacks, and automated spam. It’s a simple step that significantly hardens your WordPress site against common threats, especially if you don’t rely on REST-based features for your daily operations.
When NOT to Disable the WordPress REST API
Before you disable the REST API, it’s crucial to understand that some modern WordPress features depend on it. For example, the Gutenberg editor, which is the default block editor since WordPress 5.0, uses REST API calls to save and update posts. Many plugins, such as WooCommerce, contact forms, and custom post type plugins, also rely on REST endpoints. If you disable the API entirely, you may break critical functionality on your site. As a UK site owner, you should only disable it if you are sure your theme and plugins don’t need it. Alternatively, you can restrict access per user role or block only specific routes, which we’ll explore below.
Method 1: Use a WordPress Plugin to Disable REST API
The easiest way to disable the WordPress REST API is to install a dedicated plugin. For UK users, we recommend ‘Disable REST API’ or ‘WP REST API Controller’ – both are lightweight and regularly updated. Simply install and activate the plugin, then go to its settings and choose the option to restrict access to logged-in users only, or completely disable the API. This method is particularly useful if you’re not comfortable editing code. Plugins also allow you to selectively disable specific user roles or routes, giving you fine-grained control without affecting your site’s core functions. Always check the plugin is compatible with your version of WordPress and your hosting environment.
Method 2: Add Code to Your Theme’s functions.php File
If you prefer a code-based solution, adding a small snippet to your active theme’s functions.php file is a popular choice. The following code strips the REST API endpoints for unauthenticated users: add_filter( 'rest_authentication_errors', function( $result ) { if ( ! is_user_logged_in() ) { return new WP_Error( 'rest_forbidden', __( 'Sorry, you are not allowed to do that.', 'text-domain' ), array( 'status' => 401 ) ); } return $result; } ); This snippet blocks all REST API requests from logged-out visitors. Add it via a child theme or using a code snippet plugin like Code Snippets to avoid wiping out changes when you update your theme. Remember to test your site thoroughly, especially login and admin functions.
Method 3: Block via .htaccess or Server-Level Config
For UK hosting environments, particularly on Apache servers, you can block REST API requests at the server level using .htaccess. This method is faster and doesn’t involve WordPress code. Add the following to your .htaccess file: <IfModule mod_rewrite.c> RewriteEngine on RewriteCond %{REQUEST_URI} ^/wp-json/ RewriteCond %{REQUEST_METHOD} !POST RewriteRule ^ - [R=403,L] </IfModule> This blocks GET and HEAD requests to the /wp-json/ endpoint but allows POST requests for logged-in users who need to save content. On Nginx servers, you’ll need to add similar rules to your server block. Before implementing, check with your hosting provider for the correct syntax, as incorrect entries can cause 500 errors.
FAQ
Yes, it’s generally safe if your site doesn’t rely on the REST API for core functionality. You can disable it for unauthorised users while keeping it active for logged-in admins. However, after disabling, test your site thoroughly – especially the admin area and any plugins that might use REST calls, such as WooCommerce or custom post types.