4

I have my blog self hosted running WordPress and I Do NOT need the Wp-Rest API.

But as it turns out disabling it is causing to Contact Form 7 To not work. Contact form 7 simply shows the spinning circle infinitely.

As I read on wpbeginner (link here) that disabling will boost security.

So my question is if I leave it enabled, which I intend to do. What safety precautions should I take?

Thanks

  • 1
    The linked article is quite old. Do you have any other sources? If so, why do they say it is unsafe and then take the necessary precautions. Without this information, your question boils down to "How should I secure my WordPress?" which is way too broad and/or opinionated for this StackExchange format – kero Jan 24 '18 at 13:13
  • True. There are no other sources. – krv Jan 24 '18 at 13:29
  • 1
    Personally, I feel WordPress takes security quite seriously. Look into the JetPack plugin if you're wanting to tighten it up even more. If having the Wordpress Rest API was a major security concern, it wouldn't be a default feature. One of the best security practices that you can implement on your site is to always keep your WordPress installation up-to-date. – Brent Jan 24 '18 at 16:35
8

You personally might not need or rely on the WP REST API, but clearly Contact Form 7 does. And so does WordPress core. Especially future versions (think Gutenberg) will heavily rely on the REST API and won‘t work without it.

There might be plugins that disable the API, but that‘s at your own risk and certainly doesn‘t make your site suddenly secure. It might decrease the possible attack surface, sure, but at the cost of breaking all parts that rely on the API.

tl;dr: There‘s no point in disabling the WordPress REST API.

1

In addition to the accepted answer, if you wish to keep your website secure even with WP REST API enabled, may I recommend Wordfence?

I'm not affiliated with them, but we use them on all our sites as security measures.

To read more about their WAF (Web Application Firewall) and counter-attack for REST API, have a look at this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.