Summarize with AI:

Disable REST API

Block anonymous access to WordPress core REST endpoints (users, settings, themes, and similar) while leaving logged-in staff and third-party plugin REST routes untouched.

Overview

Blocks anonymous access to WordPress core REST endpoints (users, settings, themes, and similar). Default mode disable_public leaves logged-in staff and third-party plugin REST routes untouched. Optional disable_completely is specialist and can break the block editor/apps—use with care. Can remove REST discovery links from head. Soft pair with SEO author-enumeration modules and Disable Application Passwords.

Who is this for?

Sites reducing user enumeration via /wp/v2/users
Hardened brochure installs
Not heavy headless setups that need anonymous core REST (especially “completely” mode)

Features

Public-disable mode (default)

Block anonymous core REST; keep logged-in and plugin routes.

Complete-disable mode

Harder lockdown for specialist cases (can break editor/apps).

Discovery link removal

Optional head cleanup for REST discovery.

Allowlist filter

Developers can allow specific routes when needed.

Honest defaults

Public-only is the marketing and product default.

Use Cases

User enumeration hardening
Block anonymous users endpoint scraping.

Brochure site baseline
Public REST off; staff still work logged in.

Agency security packs
Ship public-disable on every non-headless client.

Frequently Asked Questions

What does Disable REST API do in WP PowerSuite?
It blocks anonymous access to WordPress core REST endpoints while leaving logged-in staff and third-party plugin REST routes untouched (in the default mode).
How do I enable Disable REST API in WP PowerSuite?
Enable the module, keep disable public unless you truly need complete mode, and save.
Who should use Disable REST API?
Sites that want less anonymous core REST exposure—especially user enumeration.
Will it break the block editor?
Not in default public-disable mode for logged-in editors. Complete mode can break the editor and apps—avoid unless you know you need it.
Is Disable REST API a free or Pro module in WP PowerSuite?
It is included (free) with WP PowerSuite.

Related Modules

Security Headers

Tell modern browsers to enforce sensible safety rules—like blocking sneaky scripts and iframe tricks—with strong defaults you can tighten further for HSTS...

Security

Disabled

Simple CAPTCHA

Ask a quick math question, custom prompt, or image check before someone can submit a form or log in. Everything runs on...

Security

Disabled

Hide WP Version

Removes WordPress version from public HTML generator tags, feed generator output, and the admin footer. Does not change ver= on script and...

Security

Disabled

IP Allow & Block List Pro

Allow or block visitors by IP address—ideal for office-only dashboards or shutting out known troublemakers. Rules apply site-wide, including wp-admin and login.

Security

Disabled

Email Obfuscator

Automatically protects visible email addresses and mailto links from basic spam bots by safely encoding them while keeping them clickable for visitors.

Security

Disabled