WordPress REST API Disable: A UK Site Owner's Guide
16 August 2026
Learn how to disable the WordPress REST API safely. Step-by-step UK guide with plugins, code snippets, and .htaccess methods.
What Is the WordPress REST API and Why Disable It?
The WordPress REST API is a set of endpoints that allow external apps and services to interact with your site's data. It powers the block editor, admin screens, and many plugins. However, by default, it exposes user information, post data, and other details to anyone who knows the right URLs. For UK site owners, this can be a security concern, especially if you're running a small business site and want to reduce the attack surface. Disabling the API—or restricting it to logged-in users—can prevent automated bots from enumerating your users or pulling content without permission. It's a common hardening step recommended by UK WordPress security consultants.
When Should You Keep the REST API Enabled?
Before disabling the REST API wholesale, consider what depends on it. The Gutenberg block editor uses the REST API to save your content, so disabling it entirely will break your ability to edit posts from the dashboard. Many popular plugins—including WooCommerce, Jetpack, and Yoast SEO—also rely on REST endpoints for core functionality. If you use a page builder or e-commerce features, you'll need to keep the API active. The sensible compromise is to disable it for logged-out users only, or to selectively block specific endpoints like /wp-json/wp/v2/users. This way, your admin workflows stay intact while external visitors and bots lose access. We'll show you how to do this safely.
How to Disable the REST API Using a Plugin
For UK site owners who prefer a no-code solution, plugins are the quickest route. Search for 'Disable REST API' in your WordPress dashboard and you'll find several well-rated options. Plugins like 'Disable REST API' or 'WP Security Hardening' allow you to turn off the API for users who aren't logged in, or block specific routes. They also provide toggles for disabling user enumeration—a common security risk. Once activated, the plugin will intercept REST requests and return a 403 error for unauthorised users. This method is ideal if you're not comfortable editing functions.php or if you want an easy way to reverse the change. Always choose a plugin that's actively maintained and compatible with your WordPress version.
How to Disable the REST API via Code (functions.php)
If you prefer a lightweight approach without installing another plugin, add a code snippet to your child theme's functions.php. The following filter restricts REST API access to logged-in users only, while leaving admin functionality intact: add_filter('rest_authentication_errors', function($result) { if (!is_user_logged_in()) { return new WP_Error('rest_forbidden', __('Sorry, you are not allowed to access the API.', 'textdomain'), array('status' => 401)); } return $result; });. This snippet works because WordPress runs the authentication filter before processing any REST request. For UK users, we recommend adding this via the Code Snippets plugin to avoid breaking your site. Always back up your file first and test on a staging site if possible.
How to Disable via .htaccess (Apache and Nginx)
If you're on UK shared hosting, you likely use Apache, meaning you can block REST API requests at the server level. Add this to your .htaccess file: <IfModule mod_rewrite.c> RewriteEngine On RewriteCond %{REQUEST_URI} ^/wp-json/ RewriteCond %{REQUEST_METHOD} GET RewriteCond %{QUERY_STRING} !rest_route= [OR] RewriteCond %{REQUEST_URI} !rest_route= RewriteRule ^ - [F] </IfModule>. This returns a 403 Forbidden for all external requests to /wp-json/ except those with a valid nonce. For Nginx servers, you'll need to add a 'location /wp-json/' block with a deny rule. Server-level blocking is effective but can break plugins, so test thoroughly. If you're unsure, consult your UK hosting provider's support team for guidance.
FAQ
No, disabling the REST API for public users does not directly harm SEO. Search engines like Google do not use the REST API to index content; they rely on HTML. However, if you're using REST endpoints for performance reasons (like headless WordPress), disabling it would hurt. For standard WordPress sites, it's safe. Yoast SEO uses the API for content analysis in the editor, but only for logged-in admins, so it won't break.