41

Does anyone know how to remove the WordPress JSON API links in the header tag?

<head>
...
<link rel='https://api.w.org/' href='http://example.com/wp-json/' />
<link rel="alternate" type="application/json+oembed" href="http://example.com/wp-json/oembed/1.0/embed?url=..." />
<link rel="alternate" type="text/xml+oembed" href="http://example.com/wp-json/oembed/1.0/embed?url=..." />
</head>

I'd like to avoid using a plugin. If possible, is there a way to remove them with the remove_action function?

remove_action( 'wp_head', 'rsd_link' );
Improve this question

3 Answers 3

Reset to default
43

I see in filters.php "add_action( 'wp_head', 'rest_output_link_wp_head', 10, 0 )" Which makes me think this should do the trick to remove rel='https://api.w.org/'.

remove_action( 'wp_head',      'rest_output_link_wp_head'              );

The rest... * cough * seem to be in default-filters.php

remove_action( 'wp_head',      'wp_oembed_add_discovery_links'         );

To remove the rest_output_link_header

remove_action( 'template_redirect', 'rest_output_link_header', 11 );

Reference

Improve this answer
3
  • 1
    thanks but this does not remove the api.w.org link for me.
    – IXN
    Commented Dec 16, 2015 at 12:52
  • Tried all of them, but the api.w.org header won't budge! This no longer seems to work in the recent wordpress versions.
    – Prahlad Yeri
    Commented Jul 21, 2018 at 13:21
  • 2
    All right, it worked! Turns out you have to put this in the theme's function.php. I was trying to put this in my custom plugin so that it works for all themes, but apparently that doesn't work.
    – Prahlad Yeri
    Commented Jul 21, 2018 at 13:29
30

This custom function should help removing all links in the header and footer - you may put it inside the functions.php file of your active theme;

function remove_json_api () {

    // Remove the REST API lines from the HTML Header
    remove_action( 'wp_head', 'rest_output_link_wp_head', 10 );
    remove_action( 'wp_head', 'wp_oembed_add_discovery_links', 10 );

    // Remove the REST API endpoint.
    remove_action( 'rest_api_init', 'wp_oembed_register_route' );

    // Turn off oEmbed auto discovery.
    add_filter( 'embed_oembed_discover', '__return_false' );

    // Don't filter oEmbed results.
    remove_filter( 'oembed_dataparse', 'wp_filter_oembed_result', 10 );

    // Remove oEmbed discovery links.
    remove_action( 'wp_head', 'wp_oembed_add_discovery_links' );

    // Remove oEmbed-specific JavaScript from the front-end and back-end.
    remove_action( 'wp_head', 'wp_oembed_add_host_js' );

   // Remove all embeds rewrite rules.
   add_filter( 'rewrite_rules_array', 'disable_embeds_rewrites' );

}
add_action( 'after_setup_theme', 'remove_json_api' );

And this snippet completely disable the REST API and shows the content below when you visit http://example.com/wp-json/, were example.com is the domain name of your website;

{"code":"rest_disabled","message":"The REST API is disabled on this site."}

In order to disable WordPress REST API, use the snippet below;

function disable_json_api () {

  // Filters for WP-API version 1.x
  add_filter( 'json_enabled', '__return_false' );
  add_filter( 'json_jsonp_enabled', '__return_false' );

  // Filters for WP-API version 2.x
  add_filter( 'rest_enabled', '__return_false' );
  add_filter( 'rest_jsonp_enabled', '__return_false' );

}
add_action( 'after_setup_theme', 'disable_json_api' );
Improve this answer
7
  • 1
    Is it necessary to remove wp_oembed_add_discovery_links from the head twice with different priorities or is that a typo?
    – Bryan Willis
    Commented Apr 5, 2016 at 16:45
  • Also in the disable_json_api() if using the latest wordpress can we just include the version 2.x filters or are both needed?
    – Bryan Willis
    Commented Apr 5, 2016 at 16:47
  • 3
    The custom function is missing the function disable_embeds_rewrites. The complete source can be found at github.com/swissspidy/disable-embeds/blob/master/….
    – Drakes
    Commented Jun 14, 2016 at 0:46
  • @Drakes Yes, you're right. It's missing it because this code hasn't been updated since it has been posted last year. Why not modify/update the snippet above to help others here instead? That would be helpful and handy ;)
    – Jentan Bernardus
    Commented Jun 15, 2016 at 1:42
  • 2
    I'd rather recommend to use the Disable Embeds plugin instead of copying only half of it into your plugin or theme. It's more future-proof.
    – swissspidy
    Commented Feb 20, 2017 at 15:43
4

The best solution and easy way to disable oEmbed discovery links and wp-embed.min.js is by adding this code snippet in your theme (function.php).

remove_action( 'wp_head', 'wp_oembed_add_discovery_links', 10 ); remove_action( 'wp_head', 'wp_oembed_add_host_js' ); remove_action('rest_api_init', 'wp_oembed_register_route'); remove_filter('oembed_dataparse', 'wp_filter_oembed_result', 10);

Hope this can help someone as the above solutions don't work for me while using the latest version of WordPress.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.