How to Disable WP JSON in WordPress (2026 Guide)
16 August 2026
Learn how to disable WP JSON (REST API) in WordPress for better security and performance. Step-by-step methods for UK site owners in 2026.
What Is WP JSON and Why Disable It?
WP JSON, also known as the WordPress REST API, is a powerful feature that lets developers interact with your site programmatically. It returns data in JSON format, which is great for building apps or headless WordPress setups. However, for many standard UK business websites, it's an unnecessary attack surface. Hackers often probe the REST API endpoint (e.g., /wp-json/) to find usernames or attempt unauthorized access. By disabling it, you reduce the risk of malicious attacks, slow down bot probes, and can even improve performance by reducing server load. In 2026, with cyber threats increasing, many UK site owners choose to disable this feature entirely unless they actively use it.
Method 1: Using a Security Plugin
The easiest way to disable WP JSON is to use a reputable security plugin. Popular options in the UK include Wordfence, Sucuri, and iThemes Security. Each offers a simple toggle to block REST API calls. For example, in Wordfence, go to 'All Options' and look for 'REST API' settings. You can choose to restrict access to logged-in users or disable it entirely. This plugin-based approach is ideal for beginners or those who prefer not to edit code. It also ensures you get regular updates and support. When choosing a plugin, check that it complies with UK data protection laws and offers features beyond REST API management, such as firewall protection and malware scanning.
Method 2: Adding Code to functions.php
If you prefer a lightweight, code-based method, you can add a simple snippet to your theme's functions.php file (or better, a child theme). Here's a common snippet: add_filter('rest_authentication_errors', function($result) { if (!is_user_logged_in()) { return new WP_Error('rest_not_logged_in', 'REST API requires authentication.', array('status' => 401)); } return $result; }); This disables the REST API for unauthenticated users, which covers the vast majority of attacks. Many UK site owners choose this method because it doesn't require installing extra plugins. To implement it, go to Appearance → Theme File Editor, find functions.php, and paste the code at the end. Ensure you have a backup first. Note: this snippet still allows logged-in users (e.g., admins) to access the API, which is useful if you use Gutenberg or plugins that rely on it.
Method 3: Restrict Access by User Role
Sometimes you need the REST API for certain features (like a mobile app or custom integrations) but still want to lock it down. In this case, you can restrict access based on user roles. For instance, you can allow only administrators to access /wp-json/ while denying all other users. Many UK businesses use this approach to keep the API functional for their own developers while blocking external bots. You can achieve this by adding a role check inside the filter: if (!current_user_can('administrator')) { return new WP_Error(...); } Alternatively, plugins like 'WP REST API Controller' offer fine-grained control. This method is ideal for e-commerce sites that need the API for payment gateways or inventory management.
Considerations for UK GDPR Compliance
Disabling WP JSON can actually help with GDPR compliance in the UK. The REST API can expose user data (like usernames or post details) to unauthenticated requests. That's a potential data protection risk under the UK GDPR. By restricting access, you reduce the chance of unauthorised data exposure. However, be careful: if you use plugins or services (e.g., contact forms, analytics) that rely on the REST API, disabling it entirely may break them. In 2026, the UK Information Commissioner's Office (ICO) continues to emphasise data minimisation. Therefore, review your site's functionality and use a plugin that logs API requests if you're concerned about compliance. Always document your decision and keep your WordPress core, themes, and plugins updated.
FAQ
Yes, it's safe for most standard websites that don't rely heavily on the REST API. Disabling it reduces attack surface and server load. However, some plugins and themes use the API for admin functionality, so test thoroughly. For UK sites, it's a common security hardening step.