Disable WordPress REST API: A UK Guide for 2026
16 August 2026
Learn how to disable the WordPress REST API for security and performance. A practical UK guide with code snippets, plugins, and GDPR considerations.
Why Disable the WordPress REST API?
The WordPress REST API, introduced in 4.7, powers much of the modern block editor and lets apps interact with your site. However, it also exposes data like user names and post metadata to anyone who visits /wp-json/. For UK site owners, this can be a security headache, especially since the API is often used in brute-force attacks. Disabling it reduces your attack surface and speeds up your site by cutting unnecessary requests. But be careful: many plugins and your theme's blocks rely on it. This guide explains when disabling makes sense and how to do it without breaking functionality.
Understanding WordPress REST API Basics
Before you disable anything, it's crucial to understand what the REST API does. It’s a set of endpoints that allow third-party apps, the WordPress admin dashboard, and front-end JavaScript to retrieve and send data as JSON. For example, when you use the block editor, it interacts with the API. Many popular plugins, such as WooCommerce or contact forms, also depend on it. If you disable it completely, you might lose core features. The trick is to restrict access to the API rather than turning it off entirely. This is especially relevant in the UK, where website security and uptime are vital for businesses.
How to Disable REST API in WordPress (Code Method)
The most reliable way to disable the REST API is to add a small snippet to your theme’s functions.php file or a site-specific plugin. A common approach is to filter 'rest_authentication_errors'. This snippet returns a WP_Error for non-logged-in users while keeping it active for admins: add_filter('rest_authentication_errors', function($result) { if (!is_user_logged_in()) { return new WP_Error('rest_forbidden', 'Sorry, you are not allowed.', array('status' => 403)); } return $result; }); This blocks unauthorised access without breaking your admin dashboard. If you're not comfortable editing code, use a plugin (covered next). Always back up your site before making changes.
Best Plugins to Disable REST API for UK Websites
If you prefer a no-code solution, several plugins let you control REST API access. 'Disable REST API' is a lightweight option that lets you block all REST requests or exclude certain users. 'WP REST API Controller' offers granular control, allowing you to disable specific routes. For UK users, ensure the plugin is regularly updated and compatible with your version of WordPress. Also look for GDPR-friendly plugins that don't send data outside the UK. A plugin may be easier to manage, but it adds another dependency. Weigh the pros and cons: code snippets are faster, while plugins are simpler for non-developers.
Testing and Maintaining REST API Security
Once you've disabled or restricted the REST API, test that it's working as intended. Visit yoursite.co.uk/wp-json/ while logged out – you should see an error or a 403 page. Logged in, you should still be able to edit posts. Use tools like Postman or cURL for deeper testing. Remember that updates to WordPress or your plugins might reset your custom code, so keep your snippets in a child theme or a custom plugin. For UK compliance, document the change in your data protection procedures. Regularly audit your site's security settings to ensure no new vulnerabilities appear.
FAQ
It can, if you rely on plugins or themes that use the API for front-end features. The block editor also needs it. However, if you only disable it for non-logged-in users, most site visitors won't notice. Always test after disabling.