Disable REST API

By default, WordPress exposes a REST API to the public that can reveal usernames, post data, and site structure to anyone. MaxtDesign Disable REST API gives you complete control over who can access the API and which endpoints are available.

The plugin uses the rest_authentication_errors filter — the correct, modern WordPress approach — to intercept REST API requests early in the lifecycle, before any endpoint logic executes. Blocked requests have virtually zero performance impact. It auto-discovers all registered REST API endpoints and presents them in a collapsible namespace tree with per-namespace and per-route checkboxes.

Smart defaults detect Contact Form 7 and WooCommerce on activation and automatically whitelist their required endpoints. Per-role controls let you restrict specific user roles (subscriber, contributor, author) while keeping full access for administrators. Each restricted role gets its own endpoint whitelist.

Zero frontend footprint means no CSS, no JavaScript, and no HTTP requests are added to your public-facing pages. Admin assets load only on the plugin's own settings page. A single autoloaded database option means no extra queries. Settings can be exported as JSON and imported on other sites.