WP REST Protect

(c) Niranjan Neegammanam Shilpa Sayura Foundation

WP REST Protect is a lightweight WordPress must-use (MU) plugin that blocks unauthenticated public access to the WordPress REST API while preserving normal REST API functionality for authenticated users according to their WordPress roles and capabilities.

It:

Blocks REST API requests from unauthenticated users with HTTP 403 Forbidden. Allows authenticated users to access the REST API. Preserves WordPress's existing role and capability checks for individual REST endpoints. Preserves existing REST authentication errors. Loads automatically as an MU plugin and cannot be accidentally deactivated through the normal Plugins screen. Provides a simple way to reduce unnecessary public exposure of the WordPress REST API.

WordPress specifically recommends restricting access with rest_authentication_errors If block public access to routes such as:

/wp-json/wp/v2/pages Accessible 200
/wp-json/wp/v2/posts Accessible 200
/wp-json/wp/v2/users Accessible 200 U

/xmlrpc.php Accessible 200 allow rss access for blogs

Unauthenticated REST API requests receive HTTP 403 Forbidden. Logged-in users continue to use the REST API normally, subject to WordPress capabilities and any other authentication or permission checks.

Why use it?

WordPress exposes REST API endpoints under /wp-json/. On sites that do not need public REST API access, administrators may prefer to prevent anonymous requests from retrieving REST-accessible site data.

WP REST Protect provides a simple global restriction at the REST authentication layer.

Important compatibility notice

This plugin blocks all unauthenticated WordPress REST API requests.

That can affect features or plugins that intentionally expose public REST endpoints, including some forms, headless front ends, mobile applications, WooCommerce integrations, Jetpack features, external services, custom JavaScript applications, and other plugins that rely on anonymous REST requests.

Test the plugin on a staging site before deploying it to production.

This plugin is not a replacement for normal WordPress security controls. Keep WordPress, themes, and plugins updated, use least-privilege accounts, protect administrator access, and maintain appropriate server and application security controls.

Installation — Must-Use Plugin

WP REST Protect is designed to be installed as a must-use plugin.

1. Download or clone this repository.

2. Locate your WordPress installation.

3. Open the directory:

   wp-content/mu-plugins/

4. If mu-plugins does not exist, create it.

5. Copy wp-rest-protect.php directly into wp-content/mu-plugins/.

6. Log in to WordPress and go to Plugins → Must-Use Plugins.

7. Confirm that WP REST Protect appears in the list.

The plugin does not require activation. WordPress automatically loads PHP files placed directly in the mu-plugins directory.

Correct installation layout

wp-content/
└── mu-plugins/
    └── wp-rest-protect.php

Do not place the PHP file only inside a nested directory unless you create a loader file in mu-plugins, because WordPress does not automatically scan subdirectories for must-use plugins.

Behaviour

For an unauthenticated request such as:

https://example.com/wp-json/wp/v2/posts

WP REST Protect returns a REST error with HTTP status 403.

Authenticated users are not blocked by this plugin. Normal endpoint-level WordPress permission checks still apply.

Testing

Test while logged out:

curl -i https://example.com/wp-json/

Expected result:

HTTP/1.1 403 Forbidden

Then test relevant site functions while logged in and logged out to make sure no required integration depends on anonymous REST access.

Uninstallation

Delete:

wp-content/mu-plugins/wp-rest-protect.php

No database tables, options, or configuration values are created.

Security design

The plugin uses WordPress's rest_authentication_errors filter. Existing authentication errors are preserved. If WordPress has not already authenticated the request and there is no logged-in user, the request is rejected with a 403 response.

Limitations

• It does not hide the existence of WordPress.
• It does not disable XML-RPC.
• It does not replace endpoint capability checks.
• It does not provide rate limiting or firewall protection.
• It may block legitimate public REST integrations.
• It does not provide an allowlist in version 1.1.0.

License

MIT Lisense