How to Disable the WordPress REST API for Logged Out Users in 2026
16 August 2026
Learn how to disable the WordPress REST API for logged-out users in 2026. Step-by-step guide, code snippets, and security tips for UK sites.
Why Disable the REST API for Logged-Out Users?
WordPress's REST API is a powerful feature that allows external applications and third-party services to interact with your site. However, by default, many endpoints are publicly accessible to logged-out users, which can expose sensitive data such as author usernames, post metadata, and even user lists. This is a common target for brute-force attacks and unauthorised data scraping. In the UK, the General Data Protection Regulation (GDPR) imposes strict obligations on data controllers, and failing to protect personal data can lead to heavy fines. Disabling the REST API for logged-out visitors is a simple yet effective way to reduce your site's attack surface, enhance privacy, and align with UK data protection expectations, all without affecting the experience of logged-in administrators or editors.
Understanding the WordPress REST API and User Authentication
Before making changes, it's important to grasp how the REST API handles authentication. When a user logs into WordPress, a set of cookies is set, and the REST API uses those cookies for authentication, allowing that user to perform actions they're authorised for. For logged-out users, requests are treated as unauthenticated, meaning they can only access public endpoints. The issue is that many endpoints, such as /wp-json/wp/v2/users, reveal usernames and other information that should not be public. By disabling the REST API for logged-out users, you ensure that only authenticated requests are processed, significantly reducing the information available to potential attackers. This is particularly relevant for UK businesses that handle customer data and need to demonstrate compliance with data security best practices.
Method 1: Using a Plugin to Disable REST API for Guests
For non-developers, the quickest solution is to install a security plugin that includes an option to restrict REST API access. Popular plugins like 'Disable REST API' or 'Restrict Content Pro' offer settings to block all anonymous REST API requests with a few clicks. After installing and activating the plugin, navigate to its settings panel, find the REST API section, and choose to disable it for unauthenticated users. Many plugins also allow you to keep specific endpoints enabled if needed. This method is ideal for site owners who prefer a user-friendly interface and want to avoid editing code. Remember to test your site thoroughly after enabling this feature, as some plugins, themes, or integrated services might rely on the public REST API – a quick check with your existing tools will ensure nothing breaks.
Method 2: Adding Code to functions.php to Restrict REST API
If you're comfortable with coding, adding a custom function to your theme's functions.php file gives you complete control. The following snippet intercepts all REST API requests and returns an authentication error if the user is not logged in. Add this code to your child theme's functions.php or a custom plugin: add_filter('rest_authentication_errors', 'pc_restrict_rest_api_to_logged_in'); function pc_restrict_rest_api_to_logged_in($result) { if (!is_user_logged_in()) { return new WP_Error('rest_not_logged_in', 'Sorry, you are not allowed to access the REST API.', array('status' => 401)); } return $result; } This approach ensures that any unauthenticated request to /wp-json/ receives a 401 error, protecting your site while allowing logged-in users to continue using the admin dashboard and any legitimate authenticated API integrations.
Testing and Verifying That the REST API Is Disabled
After implementing either method, it's vital to test that the REST API is properly disabled for anonymous users while still functioning for authenticated users. You can visit yourdomain.co.uk/wp-json/ in your browser while logged out – you should see a JSON error response instead of the usual route list. Alternatively, use a command-line tool like curl: curl -X GET http://yourdomain.co.uk/wp-json/wp/v2/users – this should return a 401 status code. Also, log into your WordPress admin and ensure the dashboard loads normally; some admin screens rely on REST API calls. Finally, test any plugins or third-party services that might depend on the API, such as contact forms or analytics, to ensure they aren't broken. Regular checks after updates or changes to your site are good practice.
FAQ
No, it's generally good for security. However, some plugins and themes rely on the REST API for non-logged-in features, like front-end forms or live search. If you disable it entirely, those features may stop working. You can always whitelist specific routes later if needed, but for most sites, disabling anonymous access won't cause issues.