Disable WP JSON in WordPress: A UK Guide for 2026
16 August 2026
Learn how to disable the WP JSON REST API in WordPress to improve security and performance. Step-by-step UK guide for 2026.
What is the WP JSON REST API and Why Disable It?
The WP JSON REST API, accessible via /wp-json/, is a core WordPress feature that allows external applications to interact with your site. It powers the Gutenberg block editor, mobile apps, and countless plugins. However, it also exposes user names, post content, and other metadata to anyone who makes a request. For UK website owners, this can be an unnecessary security risk, especially if your site doesn't rely on these external connections. Disabling the endpoint reduces your attack surface, helping to prevent user enumeration, brute-force attacks, and data scraping. Before proceeding, always check that your themes and plugins don't depend on the API for critical functionality.
UK Security and GDPR: Why You Should Consider Disabling
UK GDPR compliance demands that you protect personal data from unauthorised access. The WP JSON API can inadvertently leak usernames and email addresses, which are considered personal data under GDPR. By disabling the REST API, you limit this exposure, making it easier to demonstrate that you take data protection seriously. Additionally, UK cybersecurity guidance from the NCSC recommends minimising features that aren't essential. Disabling WP JSON is a simple hardening step that many UK WordPress agencies now incorporate into their security checklists. However, remember that the API also powers legitimate features like admin AJAX and user authentication, so you should implement a targeted approach rather than a blanket block.
Method 1: Disable WP JSON Using a Plugin (Beginner-Friendly)
For most UK site owners, using a plugin is the safest and easiest way to disable WP JSON. Plugins like 'Disable REST API' or 'WP Rest API Disable' allow you to switch off the API for logged-out users while keeping it functional for admins. To do this, install the plugin from the WordPress dashboard, activate it, and navigate to the settings page. Choose the option to disable all REST API routes for unauthenticated users. This method is ideal if you're not comfortable editing code. We recommend selecting a plugin that's regularly updated and compatible with the latest WordPress version in 2026. Always back up your site before making changes, and check your front-end and admin areas afterwards.
Method 2: Disable WP JSON via functions.php (No Plugin)
If you prefer a code-based solution, add a snippet to your child theme's functions.php or a custom plugin. The following code returns a 401 error for all REST API requests when the user isn't logged in: add_filter('rest_authentication_errors', function($result) { if (!is_user_logged_in()) return new WP_Error('rest_not_logged_in', 'Unauthorized', array('status' => 401)); return $result; }); This method keeps the API available for authenticated users, so the block editor works as normal. We strongly advise using a child theme to avoid losing changes during theme updates. If you're on a managed UK WordPress host, you can add this code via its custom code feature. Always test thoroughly on a staging site first.
Method 3: Block WP JSON via .htaccess (For UK Apache Hosting)
If your UK hosting uses Apache, you can block WP JSON requests at the server level using .htaccess. Add the following code to your .htaccess file: <IfModule mod_rewrite.c> RewriteEngine On RewriteRule ^wp-json - [F,L] </IfModule> This returns a 403 Forbidden for any request containing /wp-json/. It's a quick fix but also blocks the API for logged-in users, which may break the block editor. Some other plugins use the API for AJAX calls, so test thoroughly. For Nginx hosting, you'll need a different rule. Before editing .htaccess, save a backup and ensure you have FTP or file manager access. After applying, visit /wp-json/ to confirm it's blocked, then check your site's front and back end for issues.
FAQ
Disabling WP JSON for logged-out users generally won't affect your admin because admins are authenticated. However, the Gutenberg editor and some plugins may rely on REST API calls even for logged-in users. If you block it entirely via .htaccess, you may encounter issues. The safest approach is to disable only for logged-out users.