What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
You generally should not disable the WordPress REST API outright: WordPress Admin features depend on it. If your aim is to stop visitors who are not logged in from making API requests, require authentication with the rest_authentication_errors filter instead. That blocks anonymous requests; it does not turn off the API.
Why disabling the REST API is usually the wrong fix
The WordPress REST API serves site resources as JSON through routes such as /wp-json/. Much of a site’s already-public content can also be read anonymously through the API; that alone is not evidence of a security flaw. Private data and privileged actions should instead be protected by authentication and appropriate permissions.
WordPress says not to disable the API because Admin functionality depends on it. The API also underpins the Block Editor and lets themes, plugins, and applications interact with site data. See the REST API FAQ and the REST API Handbook.
Require authentication for API requests
WordPress documents rest_authentication_errors as the way to require API consumers to authenticate, which effectively prevents anonymous external access. Add the following to a site-specific plugin or a child theme’s functions.php; avoid editing a parent theme, where an update can replace the change.
#1 Best Overall
add_filter( 'rest_authentication_errors', function ( $result ) {
if ( true === $result || is_wp_error( $result ) ) {
return $result;
}
if ( ! is_user_logged_in() ) {
return new WP_Error(
'rest_not_logged_in',
__( 'You are not currently logged in.', 'your-text-domain' ),
array( 'status' => 401 )
);
}
return $result;
} );This follows WordPress’s documented pattern: retain an earlier successful authentication result or an existing error, and require a logged-in user only when no method has decided the result. The filter can receive null (no authentication decision yet), true (authentication succeeded), or a WP_Error (authentication failed). Do not overwrite those existing success or failure results. See the hook reference and the FAQ example.
The example uses WordPress’s logged-in-user check. It is a broad site-wide policy, not a per-route permission system; validate it with the authentication methods and clients your site actually uses.
Check what may break before applying a site-wide rule
A global login requirement can disrupt legitimate clients that need anonymous access. Before enabling it, inventory the Block Editor, plugins, themes, mobile or external applications, and public front-end code that call the API. Documentation establishes that these uses exist, but only inspection and testing of your own site can show whether a particular feature relies on anonymous requests.
- Apply the change on a staging site or in a controlled maintenance window.
- Test editing and publishing in the Block Editor, public pages, plugin and theme features, and each API-consuming application.
- For external clients, confirm they can authenticate using a supported method before enforcing the policy.
- If a required feature fails, identify its route and access needs; prefer a narrower permissions rule or a supported exception over disabling the API.
Choose the narrowest access control that solves the problem
| Approach | Scope and effect | Use when |
|---|---|---|
| Require authentication globally | Blocks anonymous API requests broadly and may affect public clients and features that expect them. | You have confirmed that legitimate consumers can authenticate and want a site-wide login requirement. |
| Protect a specific endpoint or data | Applies access checks to the relevant resource or action while leaving unrelated API routes available. | The concern is particular private data or a privileged operation, rather than anonymous access to the whole API. |
For custom routes, register a permission callback that checks the capability or access rule appropriate to the data and action. WordPress identifies permission callbacks as important for endpoint security, especially where private data is involved; see Routes and Endpoints. Authentication by itself does not establish that every logged-in user is authorized to perform every action.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchUse the right authentication method for each client
Cookie authentication is intended for logged-in use within WordPress and relies on REST nonces to help prevent cross-site request forgery (CSRF). WordPress documents Application Passwords for external clients communicating over HTTPS. Choose the method the client supports; neither requires making all API endpoints public. Details are in the Authentication handbook.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Do not use obsolete filters or CORS as a substitute
The old rest_enabled filter is not the modern way to restrict access: WordPress deprecated it in version 4.7.0 and points developers to rest_authentication_errors instead. See the rest_enabled hook reference.
Stricter CORS headers do not disable the API and are not a replacement for authentication or endpoint permissions. WordPress’s FAQ also cautions that CORS restrictions can interfere with authentication methods. Hiding the /wp-json/ route or preventing a browser from reading a response does not, by itself, secure sensitive data or actions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
