WP JSON Security: A UK Guide to Securing Your WordPress REST API
16 August 2026
Protect your WordPress site from WP JSON data leaks and user enumeration. UK-specific advice for securing the REST API in 2026.
What Is WP JSON and Why Does It Matter for UK Sites?
WP JSON is the WordPress REST API, a powerful interface that allows external apps, plugins, and themes to interact with your site. By default, it exposes endpoints like /wp-json/wp/v2/users, which can reveal usernames and post data. For UK website owners, this is not just a technical concern—it's a legal one. Under the UK GDPR and the Data Protection Act 2018, exposing personal data without a lawful basis can lead to ICO investigations and fines. Understanding WP JSON is the first step to controlling what your site reveals to the public. In 2026, the default API remains a common vector for automated attacks, and securing it is essential for any UK business.
Common WP JSON Vulnerabilities You Need to Know
The most exploited WP JSON issue is user enumeration. By visiting /wp-json/wp/v2/users, attackers can see all usernames, which they then use for brute-force login attempts. Another risk is unrestricted access to post and comment metadata, which can leak drafts, private content, or IP addresses. On some misconfigured sites, the API also allows unauthenticated code execution if plugins add insecure custom endpoints. For UK e-commerce and membership sites, this can mean exposure of customer PII (names, emails, addresses) through the API. Even simple blogs are at risk, as leaked admin usernames enable targeted attacks. Recognising these vulnerabilities is critical so you can implement the right fixes.
How to Restrict or Disable WP JSON Endpoints Securely
You don't have to disable the entire REST API to stay secure—many plugins rely on it. Instead, block the endpoints you don't need. For user enumeration, add a code snippet to your theme's functions.php or a security plugin: add_filter('rest_endpoints', function($endpoints){ if (is_user_logged_in()) { return $endpoints; } unset($endpoints['/wp/v2/users']); unset($endpoints['/wp/v2/users/(?P<id>[\d]+)']); return $endpoints; }); This keeps the API functional for logged-in admins while hiding user data from visitors. For more granular control, use a plugin like Disable REST API or restrict access by IP. For UK sites with stricter privacy needs, you can also block whole API responses with a .htaccess rule, but remember to whitelist legitimate services.
UK GDPR Compliance: Your Legal Obligation to Secure Data
Under the UK GDPR, you are required to implement appropriate technical measures to protect personal data. The WP JSON API can expose personal data such as names and email addresses in plain sight, which could be a breach of the data minimisation principle. The UK ICO expects you to assess and mitigate risks like user enumeration. If your site leaks user data via /wp-json, you may face fines up to £17.5 million or 4% of global turnover. Even if you are a small business, the ICO can investigate and issue enforcement notices. Therefore, securing WP JSON is not just an IT task—it's a compliance requirement. Document your security measures and conduct regular privacy impact assessments, especially if your site processes customer data.
Monitoring and Best Practices for Ongoing WP JSON Security
Securing WP JSON is not a one-off task. In 2026, automated scanners continuously probe for exposed endpoints. Start by regularly auditing your site with online tools or a security plugin that checks for JSON exposure. Keep WordPress core, themes, and plugins updated, as updates often patch API vulnerabilities. Also, implement a web application firewall (WAF) that can block suspicious API requests from unknown IPs. Monitor your server logs for unusual patterns, like repeated requests to /wp-json/wp/v2/users. For high-security UK sites, consider using a security plugin that allows you to require authentication for all REST API requests. Finally, educate your team about the risks of enabling insecure plugins that create public endpoints. Proactive monitoring is your best defence.
FAQ
Not always. The REST API is used by many essential plugins and security tools. Instead, restrict it to authenticated users or block specific risky endpoints like the users route. Complete disabling can break functionality and lead to other issues. For most UK sites, a targeted approach is safer and more practical.