Disable WP REST API

82 Quality Score

Active Installs

20/30

With 20,000 active installs, this is a moderately popular plugin that serves a specific niche rather than a broad audience, reflected in the capped 64/30 score.

Update Freshness

25/25

The plugin was last updated in April 2026 and is tested with WordPress 7.0, signalling active and current maintenance that earns a perfect 100/25.

User Rating

14/15

A 96/100 rating across 36 reviews indicates very high user satisfaction from a small but engaged user base.

Support Health

8/15

With zero support threads and zero resolved, there is no track record of responsive support help, which is acceptable for such a simple plugin but still caps the score at 50/15.

WP Compatibility

15/15

Tested with WordPress 7.0 and requiring only PHP 5.6.20 and WordPress 4.7, compatibility is exceptionally broad and earns a perfect 100/15.

Scores higher than 87% of indexed plugins

About

Disables the WP REST API for visitors not logged into WordPress.

Active Installs 30k+

Rating ★★★★½ 4.8/5

Last Updated 2026-08-10 3:28pm GMT

Requires WordPress 4.7+

Tested Up To 7.1

Requires PHP 5.6.20+

✓ No known vulnerabilities

What It Does

Disable WP REST API blocks all unauthenticated requests to the WordPress REST API endpoints, returning an authentication error to visitors who are not logged in. It effectively hides your posts, pages, custom post types, and user data from anyone probing the JSON endpoints at /wp-json/. The plugin requires zero configuration and works immediately upon activation.

Who It's For

This plugin is well suited for site owners who do not use the REST API for any public-facing functionality, such as headless frontends, mobile apps, or block editor features that rely on it. It fits small businesses, membership sites, and content creators who want a simple way to reduce data scraping and limit what bots can pull from their WordPress install. It is particularly useful for sites on older or shared hosting where reducing unnecessary endpoint hits is a priority.

Who Should Skip It

Anyone running a headless WordPress site, relying on the block editor's preview features, or using plugins that depend on the REST API (such as WooCommerce, Yoast, or any block-based theme) should not install this. If your site uses the Site Editor or Full Site Editing, this plugin will break significant functionality.

The Bottom Line

Disable WP REST API is a lightweight, well-maintained plugin that does exactly what its name promises with no configuration needed. Its overall quality score of 81.16/100 reflects strong maintenance and compatibility, offset by moderate popularity and an unproven support history. For site owners who genuinely do not need the REST API, it is a clean and effective solution.

Related Plugins

Classic Widgets 89/100

Choose Classic Widgets if your primary concern is restoring the classic widget interface rather than restricting REST API access.

Disable Emojis (GDPR friendly) 84/100

Pick Disable Emojis if you want to remove the external emoji script for GDPR compliance, which is a different optimization goal.

Disable Everything 83/100

Choose Disable Everything if you want broader control over multiple WordPress features beyond just the REST API.

Export All URLs 82/100

Pick Export All URLs if your actual need is to extract URLs from your site rather than lock down the REST API.

WPGraphQL 82/100

Choose WPGraphQL if you want to replace or extend the REST API with a GraphQL endpoint, the opposite of disabling it.