WordPress REST API Lockdown: The 2026 UK Security Guide
16 August 2026
Learn how to lock down the WordPress REST API in 2026 to protect UK sites from data leaks and brute force attacks. Step-by-step guide.
Why Lock Down the WordPress REST API?
The WordPress REST API is a powerful feature that lets developers interact with your site remotely. However, by default it exposes a surprising amount of data to anyone who sends a request to /wp-json/. For UK businesses, this is a serious concern under GDPR, as customer names, email addresses, and post excerpts can be harvested without authorisation. The Information Commissioner’s Office (ICO) can issue fines for data breaches, so taking steps to secure your API isn’t just good practice — it’s a legal obligation. Locking down the REST API reduces your attack surface, prevents user enumeration attacks, and helps you maintain control over who can access sensitive data. In 2026, with automated bots scanning every WordPress site, leaving your API wide open is a risk you cannot afford.
What the REST API Exposes by Default
Out of the box, the WordPress REST API reveals a range of endpoints that can be probed by attackers. The most notorious is /wp-json/wp/v2/users, which returns a list of all registered usernames. This makes it trivial for hackers to launch brute force login attempts. Similarly, /wp-json/wp/v2/posts and /wp-json/wp/v2/comments can expose draft content, author metadata, and even private comments if your site is misconfigured. Even seemingly harmless endpoints like /wp-json/wp/v2/media can reveal file URLs and upload timestamps. For UK site owners, this is especially problematic if you run an e-commerce or membership site, as customer data could leak through custom post types. Understanding what’s exposed is the first step towards building an effective lockdown strategy.
How to Restrict REST API for Logged-Out Users
The most straightforward lockdown method is to block all REST API requests from users who aren’t logged into your WordPress admin. You can do this by adding a small snippet to your theme’s functions.php file or a custom plugin. The key hook is ‘rest_authentication_errors’. By returning a WP_Error object when a user is not logged in, you effectively quarantine the API. Here’s an example: add_filter( 'rest_authentication_errors', function( $result ) { if ( ! is_user_logged_in() ) { return new WP_Error( 'rest_forbidden', 'Sorry, you are not allowed to access this API.', array( 'status' => 401 ) ); } return $result; } ); This simple measure blocks data scraping, user enumeration, and unauthorised content access. Always test in a staging environment first, and be aware that some plugins rely on the public API — you may need to whitelist specific routes as described below.
Using a Whitelist Approach for Specific Endpoints
A full lockdown can break legitimate features such as contact forms, live search, or payment callbacks. In 2026, most UK WordPress sites use plugins like Contact Form 7 or WPForms, which rely on the REST API for form submission. Instead of blocking everything, you can whitelist specific endpoints. Inside the same ‘rest_authentication_errors’ filter, you can inspect the route with the ‘rest_get_server’ function or use the global ‘$wp’ object to check the request path. For example, if you need to allow /wp-json/contact-form-7/v1/contact-forms, you can conditionally permit access for that route while blocking others. This approach gives you granular control, ensuring your site remains functional without exposing user data. It’s also wise to limit access to the API by IP address using server-level rules if you have a fixed IP for your development team.
Testing and Maintaining Your Lockdown
Once you’ve implemented your REST API lockdown, testing is crucial. Use tools like curl from the command line to simulate logged-out requests and verify that you receive a 401 error. You can also use browser developer tools to check network responses. Remember to test any plugins that depend on the API, especially those used for forms or headless CMS functionality. In the UK, reputable hosting providers like Krystal or 34SP.com offer staging environments where you can safely test changes. You should also monitor your site’s error logs for blocked requests, as this can highlight potential attack attempts. Finally, review your lockdown policy regularly — WordPress updates, new plugins, and changes in your site’s architecture can all affect how the API behaves. Incorporating REST API checks into your monthly security audit is a smart habit for 2026.
FAQ
Not necessarily. Many typical front-end functions, like displaying posts or comments, work without the REST API because WordPress renders them server-side. However, some modern themes and plugins (such as Gutenberg blocks and page builders) rely on the API for editing. Locking it down for logged-out users usually has no impact, as admin editing is done while logged in. If you use a headless WordPress setup or third-party apps, you’ll need to whitelist specific endpoints to keep those features working.