In reviewing the WordPress REST API documentation, it's my understanding that the endpoints are publicly access thus when accessing www.domain.com/wp-json for example, it exposes the JSON construct and associated data.

There are numerous articles on disabling access and several of these touch on restricting access by updating the functions.php file for a given theme.

The code I currently have is as follows;

// Start Restrict API acess to localhost
function restrict_rest_api_to_localhost() {
    $whitelist = [ ''];

    if( ! in_array($_SERVER['REMOTE_ADDR'], $whitelist ) ){
        die( 'REST API is not available.' );
add_action( 'rest_api_init', 'restrict_rest_api_to_localhost', 0 );
// End Restrict API access to localhost

When accessing features such as WordPress' "Site Health" it displays the message that the REST API isn't functioning as intended.

enter image description here

I presume this is is because WordPress attempts to utilize an external service to perform the check using the REST API.

Assuming this is correct, can the REST API be limited to resolve the request from the localhost for all dependent services e.g. Gutenberg, WooCommerce?

If no, how can I limit the request for a specific user account that is permitted to perform the request as opposed to all logged in user?

  • In most internal uses of the REST API the requests are made from the user's browser. So no, you cannot restrict access to localhost without breaking it. What are you hoping to achieve by disabling the REST API anyway? – Jacob Peattie Aug 13 at 6:48
  • @JacobPeattie - The purpose of limiting access to the REST API is to minimize the ability to consume services that aren't necessarily intended to be accessible via the public e.g premium content. Additionally, it's also to reduce the amount of personally identifiable information since there is an increased focus on privacy. It's also an attempt to remove as much of an attack surface. – Motivated Aug 13 at 6:59
  • I'd reconsider your approach. Just disabling the REST API is a very blunt solution, and makes about as much sense as disabling the options or customiser APIs. Any plugin or functionality for restricting premium content that was worth its salt would also restrict it from the REST API, and personal data shouldn't be exposed via the API either. If it is, then it's being used incorrectly and that's the problem that should be solved. – Jacob Peattie Aug 13 at 7:16
  • @JacobPeattie - The exposure of the information such as usernames is accessible via WordPress core and not via a plugin. Since we don't necessarily have control over the username as this is user generated, there is a a risk that personally identifiable information can be exposed. I would generally expect that any API should be restricted to a specific account however there doesn't appear to be the option to. – Motivated Aug 13 at 7:29
  • @JacobPeattie - It seems that WordPress security plugins suggest blocking the API - forum.ait-pro.com/forums/topic/…, (perishablepress.com/disable-wp-rest-api) and (neliosoftware.com/blog/…) – Motivated Aug 13 at 8:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.