33

Does anyone know how to remove the WordPress JSON API links in the header tag?

<head>
...
<link rel='https://api.w.org/' href='http://example.com/wp-json/' />
<link rel="alternate" type="application/json+oembed" href="http://example.com/wp-json/oembed/1.0/embed?url=..." />
<link rel="alternate" type="text/xml+oembed" href="http://example.com/wp-json/oembed/1.0/embed?url=..." />
</head>

I'd like to avoid using a plugin. If possible, is there a way to remove them with the remove_action function?

remove_action( 'wp_head', 'rsd_link' );
30

I see in filters.php "add_action( 'wp_head', 'rest_output_link_wp_head', 10, 0 )" Which makes me think this should do the trick to remove rel='https://api.w.org/'.

remove_action( 'wp_head',      'rest_output_link_wp_head'              );

The rest... * cough * seem to be in default-filters.php

remove_action( 'wp_head',      'wp_oembed_add_discovery_links'         );

To remove the rest_output_link_header

remove_action( 'template_redirect', 'rest_output_link_header', 11 );

Reference

  • 1
    thanks but this does not remove the api.w.org link for me. – IXN Dec 16 '15 at 12:52
  • Tried all of them, but the api.w.org header won't budge! This no longer seems to work in the recent wordpress versions. – Prahlad Yeri Jul 21 '18 at 13:21
  • 1
    All right, it worked! Turns out you have to put this in the theme's function.php. I was trying to put this in my custom plugin so that it works for all themes, but apparently that doesn't work. – Prahlad Yeri Jul 21 '18 at 13:29
26

This custom function should help removing all links in the header and footer - you may put it inside the functions.php file of your active theme;

function remove_json_api () {

    // Remove the REST API lines from the HTML Header
    remove_action( 'wp_head', 'rest_output_link_wp_head', 10 );
    remove_action( 'wp_head', 'wp_oembed_add_discovery_links', 10 );

    // Remove the REST API endpoint.
    remove_action( 'rest_api_init', 'wp_oembed_register_route' );

    // Turn off oEmbed auto discovery.
    add_filter( 'embed_oembed_discover', '__return_false' );

    // Don't filter oEmbed results.
    remove_filter( 'oembed_dataparse', 'wp_filter_oembed_result', 10 );

    // Remove oEmbed discovery links.
    remove_action( 'wp_head', 'wp_oembed_add_discovery_links' );

    // Remove oEmbed-specific JavaScript from the front-end and back-end.
    remove_action( 'wp_head', 'wp_oembed_add_host_js' );

   // Remove all embeds rewrite rules.
   add_filter( 'rewrite_rules_array', 'disable_embeds_rewrites' );

}
add_action( 'after_setup_theme', 'remove_json_api' );

And this snippet completely disable the REST API and shows the content below when you visit http://example.com/wp-json/, were example.com is the domain name of your website;

{"code":"rest_disabled","message":"The REST API is disabled on this site."}

In order to disable WordPress REST API, use the snippet below;

function disable_json_api () {

  // Filters for WP-API version 1.x
  add_filter( 'json_enabled', '__return_false' );
  add_filter( 'json_jsonp_enabled', '__return_false' );

  // Filters for WP-API version 2.x
  add_filter( 'rest_enabled', '__return_false' );
  add_filter( 'rest_jsonp_enabled', '__return_false' );

}
add_action( 'after_setup_theme', 'disable_json_api' );
  • Is it necessary to remove wp_oembed_add_discovery_links from the head twice with different priorities or is that a typo? – Bryan Willis Apr 5 '16 at 16:45
  • Also in the disable_json_api() if using the latest wordpress can we just include the version 2.x filters or are both needed? – Bryan Willis Apr 5 '16 at 16:47
  • 3
    The custom function is missing the function disable_embeds_rewrites. The complete source can be found at github.com/swissspidy/disable-embeds/blob/master/…. – Drakes Jun 14 '16 at 0:46
  • @Drakes Yes, you're right. It's missing it because this code hasn't been updated since it has been posted last year. Why not modify/update the snippet above to help others here instead? That would be helpful and handy ;) – Jentan Bernardus Jun 15 '16 at 1:42
  • 1
    I'd rather recommend to use the Disable Embeds plugin instead of copying only half of it into your plugin or theme. It's more future-proof. – swissspidy Feb 20 '17 at 15:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.