by Melih Birim 0 (0 reviews)

Birim REST Lock

Name: Birim REST Lock
Author: Melih Birim

Lock the WordPress REST API for logged-out visitors. Allowlist routes, stop username enumeration, import from Disable REST API.

Birim REST Lock ranks #60,284 among WordPress.org plugins with 0+ active installations, is #3,858 of 5,058 in the Security category, and was last updated Oct 30, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1.4

v1.0.0 Current Version v1.0.0

Updated 2 days ago Last Update on 30 Oct, 2026

Refreshed 2 days ago Last Refreshed on

#3,858 of 5,058 in Security Actively maintained

View on WordPress.org

Rank

#60,284

— No change

Active Installs

— No change

KW Avg Position

138

— No change

Downloads

+10 today

Support Resolved

— No change

Rating

Review 0 out of 5

0 (0 reviews)

Next Milestone 10

Total Progress 20%

0+ 10+

32,716

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 8 more installs to reach 10+

Rank Changes

Current #60,284

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

0.0

0 reviews

Overall 0%

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 1.0.0
Last Updated: Oct 30, 2026
Requires WP: 6.0+
Tested Up To: 7.1.4
PHP Version: N/A
Author: Melih Birim

Support & Rating

Rating: ☆ ☆ ☆ ☆ ☆ 0
Reviews: 0
Support Threads: 0
Resolved: 0%

Keywords

JSON disable REST API rest-api security user enumeration

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

Akismet Anti-spam: Spam Protection

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

5M+ installs

#11

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

View all Security-and-spam-protection plugins

Frequently Asked Questions

Common questions about Birim REST Lock

Open https://yoursite.com/wp-json/wp/v2/users in your browser. You should get a 401 error. This happens even while you are logged in: WordPress treats a browser visit to /wp-json/ without a security nonce as logged out. The block editor and admin screens send the nonce, so they keep working. A plugin stopped working for visitors. That plugin calls the REST API for logged-out visitors. Settings > REST Lock lists the namespaces on your site. Add the plugin's namespace (for example /my-plugin/v1) to the allowlist.

No. It controls routes registered with the WordPress REST API only. I'm moving from Disable REST API. Activate REST Lock and open Settings > REST Lock. Click "Import from Disable REST API", review the result, then deactivate Disable REST API. The import copies the logged-out allowlist and turns roles you managed there into restricted roles. Per-role route lists are not copied; restricted roles share the logged-out rules.

No. Administrators are never blocked, and other logged-in users are only restricted if you choose their role. Do not restrict roles that write posts.

Please email security@birim.one instead of posting in the forum. See https://birimone.pages.dev/security/ for the full policy.