About this plugin
3task Doorman decides who may use the REST API of your site: guests, roles, application passwords and AI agents. It shows every open door with the plugin, theme or core part that opened it, counts for two weeks what visitors really use, and then suggests rules that keep your contact forms and shops working.
Everything runs on your own WordPress. No external service, no account, no tracking.
org and arrive as language packs through the normal WordPress update system.
Why
The REST API is public by default. Without any login, /wp-json/wp/v2/users lists the login names of your authors, and /wp-json/ lists every route, and with it most of your plugins. Newer WordPress versions also bring the Abilities API, and some plugins bring an MCP server along that lets AI agents work on your site.
Many site owners do not know that these doors exist.
Doors
One click closes a door. The first four are closed after activation, because guests never need them:
- User list for guests: /wp/v2/users no longer reveals login names. The block editor keeps working.
- Route directory for guests: the REST index and the root of every namespace stay closed for guests.
- Batch endpoint for guests: /batch/v1 runs several requests in one. Guests do not need it. Every request inside a batch is checked on its own as well.
- Hide AI access from guests: MCP servers and the Abilities API are invisible to guests.
- Switch off all AI access: blocks MCP and Abilities for every machine login, you in the browser keep access.
- Application passwords: read only: apps and agents may read, but not write, delete or publish.
- Switch off application passwords, switch off XML-RPC, remove REST hints from the page head.
Who opened which door
The namespace overview lists every REST namespace with the plugin, theme or core part that registered it, the number of routes, what the current rules do with a guest request, and how often guests used it in the last 30 days.
Learning mode
Before you close the REST API for guests, the plugin counts which routes are really used: per day, route, method, kind of caller (guest, browser login, application password, other login) and outcome. No IP address, no user agent, no content. Counters older than 30 days are deleted.
After two weeks the plugin suggests an allow list for guests that you can apply with one click.
Rules for guests and roles
- Open with a block list or closed with an allow list, for guests and for every role.
- One route per line. A route without * also covers everything below it: contact-form-7/v1 covers /contact-form-7/v1/contact-forms/5/feedback. * stands for any characters.
- Administrators cannot be locked out by the role lists.
- Refusals answer with 401 or 403 and Cache-Control: no-store. A closed route does not reveal parameter names, even when the request is invalid.
Caches
LiteSpeed Cache caches REST responses by default, WP REST Cache delivers them before plugins load, and W3 Total Cache can do it when switched on. A cached answer reaches the visitor before any rule runs. The plugin detects these caches, says so on the overview, empties them after every change and keeps refusals out of the LiteSpeed cache.
In learning mode it warns that routes answered from the cache are not counted.
Moving from Disable REST API
When the settings of the plugin “Disable REST API” are found, the overview offers to take over its rules for guests and roles in one step.
Credits
io/icons), MIT license, embedded as inline SVG.