How to Remove WP JSON in WordPress: A 2026 UK Guide
16 August 2026
Learn how to disable the WordPress REST API (WP JSON) for security and speed. A step-by-step UK guide for 2026.
What Is WP JSON and Why Remove It?
WP JSON refers to the WordPress REST API, which exposes your site's data via JSON endpoints like /wp-json/. By default, this is enabled on every WordPress site and returns the full site structure, including post titles, authors, and registered routes. While this is useful for developers building headless websites or integrating with third-party apps, many UK site owners see no benefit. Leaving it exposed can reveal sensitive information about your plugins and user enumeration, which malicious bots frequently probe. Removing or restricting WP JSON reduces your attack surface and can improve your site's perceived speed. If you run a small business site or blog without a custom application needing the API, disabling it is a prudent security measure.
Security Concerns with the WordPress REST API
The main danger with WP JSON is unauthorised access to user data. Tools like user enumeration can exploit the /wp-json/wp/v2/users endpoint to discover valid usernames, which then become targets for brute-force attacks. Even if you hide your login page, the REST API can still leak your admin's username. Additionally, undisclosed vulnerabilities in plugins or themes may be accessed through the API, giving attackers another route in. Under the UK GDPR, exposing personal data of your users without consent could lead to fines. To strengthen your site's defence, UK hosting providers often recommend disabling or locking down the REST API. It's a simple step that closes off a commonly targeted vector, especially for smaller sites that don't use the API for legitimate purposes.
Methods to Disable WP JSON (with Code and Plugins)
You can remove WP JSON by adding a snippet to your theme's functions.php file. A common method is to filter 'rest_authentication_errors' to return a WP_Error for all unauthenticated requests. Alternatively, you can use the 'rest_endpoints' filter to remove specific routes. For a more complete block, place this code in a site-specific plugin. If you prefer a no-code approach, plugins like 'Disable REST API' or 'WPS Hide Login' offer toggles to restrict access. For UK users on managed WordPress hosting like Kinsta or WP Engine, you may also use their server-level firewall rules to block /wp-json/. Whichever method you choose, always test on a staging site first to ensure you don't break functionality.
How to Keep the WP JSON Endpoint Active for Authenticated Users Only
A balanced approach is to allow WP JSON only for logged-in users, including admins and editors. This ensures your backend functions correctly — for example, Gutenberg editor saves and plugin updates often rely on the REST API. To achieve this, add a code snippet that checks if the current request is from an authenticated user and returns an error otherwise. This way, public visitors cannot access any JSON data, but your own dashboard remains fully operational. UK site owners who use plugins like WooCommerce should follow this method because front-end features such as mini-cart updates may depend on the API. Restricting access rather than outright disabling gives you the best of both worlds — security without sacrificing functionality.
Testing Your Changes and UK-Specific Considerations
After removing or restricting WP JSON, you must verify that your site still works. Visit yourdomain.co.uk/wp-json/ in a private browsing window — you should see an error or a JSON 'forbidden' message. Then log into your WordPress admin and check if posts, pages, and plugins behave normally. UK-specific considerations include GDPR compliance: if you use the API to serve personal data, you must ensure it's fully protected. Also, UK hosts like SiteGround or 123 Reg may have query string filtering — test whether those interfere with your rules. Remember to clear site cache and CDN caches (e.g., Cloudflare) after making changes. Document your modifications and keep a child theme or custom plugin to avoid losing them during core updates.
FAQ
Not necessarily. If your site doesn't rely on the REST API for front-end features or external integrations, removing it reduces security risks. However, you must test everything after removal because some plugins, page builders, and the block editor depend on WP JSON for admin functionality. A safer option is to restrict it to authenticated users only.