How to Disable WordPress REST API Without a Plugin
17 August 2026
Learn how to disable the WordPress REST API without a plugin in 2026. Step-by-step code snippets and FAQs for UK website owners.
What Is the WordPress REST API and Why Disable It?
The WordPress REST API lets apps, themes, and plugins interact with your site's data. While handy, it's also a common target for attackers and bots. For UK site owners, reducing your attack surface can improve security and cut down on unwanted requests. However, blocking it entirely can break the block editor and other features, so it's important to understand what you're disabling. Many UK businesses prefer a code-based approach to avoid plugin bloat and keep their install clean. This guide shows you safe, effective methods to disable the API without installing an extra plugin.
Method 1: Disable REST API for Logged-Out Users
The most common approach is to block anonymous requests while keeping the API available for logged-in users. Add this snippet to your theme's functions.php file: add_filter( 'rest_authentication_errors', function( $result ) { if ( ! is_user_logged_in() ) { return new WP_Error( 'rest_forbidden', __( 'Sorry, you are not allowed to access this API.' ), array( 'status' => 401 ) ); } return $result; } ); This uses the built-in filter to return a 401 error for anyone not logged in. It's the safest method because it doesn't break the Gutenberg editor or any admin tooling. UK site owners with a membership area or private content often choose this as a balanced solution.
Method 2: Fully Disable REST API via Code
If you want to switch off the API completely, you can use the init hook to detect REST requests and exit with a 403 status. Here's a snippet: add_action( 'init', function() { if ( defined( 'REST_REQUEST' ) && REST_REQUEST ) { http_response_code( 403 ); exit; } } ); Be aware: this will break the block editor, the customiser, and any plugins that rely on the REST API. You should only use it if your site is a simple brochure site with no interactive features. In the UK, this approach is popular for static-looking business sites where the client never logs in and content is edited through a separate system.
Method 3: Restrict REST API by User Role or IP
Sometimes you need to allow only administrators or specific IP addresses. The rest_authentication_errors filter gives you full control. For example, to allow only admins: add_filter( 'rest_authentication_errors', function( $result ) { if ( ! current_user_can( 'manage_options' ) ) { return new WP_Error( 'rest_forbidden', __( 'Access denied.' ), array( 'status' => 403 ) ); } return $result; } ); Alternatively, you can use .htaccess rules to block specific IPs or IP ranges from reaching /wp-json/. This is handy for UK agencies that host sites on shared servers and want to lock down the API without touching PHP. Always test your own IP first to avoid locking yourself out.
Test Your Changes and Avoid Breaking Your Site
After adding any snippet, test your site thoroughly. Visit the frontend, log in to the admin area, and try to access /wp-json/ in a private browser window. If you see a 401 or 403 error, the API is disabled as intended. Also check that your theme's customisation options and any contact forms still work. For UK site owners, it's wise to keep a backup of functions.php before editing. If something goes wrong, you can revert immediately. Many UK web hosts offer staging environments – use them to test the code safely before pushing live.
FAQ
It can reduce server load by blocking malicious requests, but the performance gain is usually minimal unless you're under a bot attack. For UK sites, the main benefit is reducing exposure to API-based vulnerabilities.