by Jeff Starr 4.8 (36 reviews)

Disable WP REST API

Name: Disable WP REST API
Rating: 4.8 (36 reviews)
Author: Jeff Starr

Disables the WP REST API for visitors not logged into WordPress.

Disable WP REST API ranks #983 among WordPress.org plugins with 30,000+ active installations, a 4.8/5 rating from 36 reviews, and was last updated Aug 10, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1

v2.6.9 Current Version v2.6.9

Updated 1 month ago Last Update on 10 Aug, 2026

Refreshed 12 hours ago Last Refreshed on

Top 5% by installs Downloads -38.7% this week

View on WordPress.org

Rank

#983

— No change

Active Installs

30K+

-15.4%

KW Avg Position

20.4

— No change

Downloads

367.5K

+73 today

Support Resolved

— No change

Rating

96%

Review 4.8 out of 5

4.8 (36 reviews)

Next Milestone 40K

Total Progress 61.7%

30K+ 40K+

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 3,826 more installs to reach 40K+

Rank Changes

Current #983

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

4.8

36 reviews

Overall 96%

34 (94%)

0 (0%)

1 (3%)

0 (0%)

1 (3%)

Security History

Source: WPVulnerability

No known vulnerabilities on record for Disable WP REST API. Checked 1 week ago.

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 2.6.9
Last Updated: Aug 10, 2026
Requires WP: 4.7+
Tested Up To: 7.1
PHP Version: 5.6.20 or higher
Author: Jeff Starr

Support & Rating

Rating: ★ ★ ★ ★ ★ 4.8
Reviews: 36
Support Threads: 0
Resolved: 0%

Keywords

JSON api disable rest rest-api

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,752

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,007

TL;DR

AI summary of the plugin's readme

This plugin is for WordPress site owners who want to restrict access to their site's REST API. It solves the problem of unauthenticated users and bots abusing or accessing REST/JSON data by disabling the API for anyone not logged into WordPress.

Disables REST/JSON for logged-out visitors
Disables REST header in HTTP response
Disables REST links in HTML head
Plug-and-play, no configuration needed
Customizable error message via filter hook
Allows REST API for logged-in users

Frequently Asked Questions

Common questions about Disable WP REST API

Technically this plugin disables REST API only for visitors who are not logged into WordPress. With that in mind, here are some good reasons why someone would want to disable REST API for non-logged users: The REST API may not be needed for non-logged users Disabling the REST API conserves server resources Disabling the REST API minimizes potential attack vectors Disabling the REST API prevents content scraping and plagiarism I'm sure there are other valid reasons, but you get the idea :)

{"code":"rest_login_required","message":"REST API restricted to authenticated users.","data":{"status":401}}

Testing is easy: Log out of WordPress Using a browser, request https://example.com/wp-json/ If you see the following message, REST is disabled: "rest_login_required: REST API restricted to authenticated users." Then if you log back in and make a new request for https://example.com/wp-json/, you will see that REST is working normally.

Yes. If the user is NOT logged in, this plugin disables ALL endpoints that are registered with the WP REST API. Otherwise, if the user IS logged in, then this plugin does not block anything.

Yes. It works the same regardless of which editor (Classic or Block) you are using.

By default the plugin displays a message for unauthenticated users: "REST API restricted to authenticated users." To customize that message to whatever you want, add the following code via functions.php or simple custom plugin: function disable_wp_rest_api_error_custom($message) { return 'Customize your message here.'; // change this to whatever you want } add_filter('disable_wp_rest_api_error', 'disable_wp_rest_api_error_custom');

As explained in this thread, the plugin Contact Form 7 requires REST API access in order for the contact form to work. To allow for this, follow this guide.

Send any questions or feedback via my contact form