Turn Off REST APIv1.1.4
Disable the WordPress REST API for logged out visitors and lock down your /wp-json endpoints, with a per route allow list so you stay in control.
Alternatives to Disable Permanently REST API
Plugins below are selected for functional relevance and current directory signals. Active-install counts do not affect this ranking.
Relevant replacements
WordPress plugins with similar use cases
Compatibility and update metadata provide context, not a quality guarantee. Review each plugin’s details for your site.
Birim REST Lockv1.0.0
Lock the WordPress REST API for logged-out visitors. Allowlist routes, stop username enumeration, import from Disable REST API.
REST API and MCP access control: disable REST API routes for guests, limit AI agents and application passwords, see which plugin opened each door.
Import post content from the Wordpress REST API on another Wordpress site
REST API blocksv2.0.0
Add gutenberg blocks data into the post / page REST API endpoints.
Expose Advanced Custom Fields in the WordPress REST API with proper access control.
Restrict user profile editing with granular role-based controls, additional wp-admin page restrictions, REST API protection, and custom redirects.
WP-API JSON Feedv1.1.1
Implements JSON feeds following the official JSON feed specification by using the WordPress REST API.
EndPointy Menusv1.3.1
Expose WordPress menus via a custom REST API endpoint for headless and external applications.
Hides the list of user accounts that the WordPress REST API shows to visitors who are not logged in, which helps prevent user enumeration.