Install
This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.
Install straight from GitHub with WP-CLI:
wp plugin install https://github.com/carawebs/wp-secure-rest-api/archive/refs/heads/master.zipOn Packagist as carawebs/wp-secure-rest-api:
composer require carawebs/wp-secure-rest-apiNo built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Secure WordPress REST API
A super-simple plugin that disallows access to REST endpoints for users that are not logged in.
Stops the REST API from being used to enumerate users.
Usage
- Clone this repo to mu-plugins - you may need to create this directory in the designated WordPress content directory (wp-content in a standard install)
- Make sure the file is loaded
If you're using Bedrock, the built in mu-plugins autoloader will take care of loading for you.
Check it's working:
https://example.com/wp-json/wp/v2/users should return a 401 response if the user is not logged in.
Non Bedrock Loader
Add this line to a loader in the root mu-plugins directory:
~~~php
<?php
// path/mu-plugins/load.php
require WPMUPLUGINDIR.'/secure-rest-api/secure-rest-api.php';
~~~