Turn Off REST API for WordPress

Turn Off REST API is a lightweight WordPress security plugin that disables the WordPress REST API for visitors who are not logged in. Anonymous requests to your /wp-json endpoints receive an authentication error instead of your site data, while logged in users, your theme, and your plugins keep working normally.

By default WordPress exposes a large amount of information through the REST API, including your list of user accounts and usernames, published content, and details about your site. For most sites that open, unauthenticated access is unnecessary and only widens the attack surface for user enumeration and content scraping. Turn Off REST API closes the WordPress REST API to the public in one click, then gives you a clear settings screen to reopen only the specific REST API routes you actually need.

Why turn off the WordPress REST API?

Stop anonymous user enumeration through /wp-json/wp/v2/users.

Reduce your attack surface against REST API based exploits and bots.

Keep your content and site data from being scraped through the public API.

Stay in control with a per route allow list instead of an all or nothing switch.

What it does

Returns an authentication error for unauthenticated REST API requests.

Optionally removes the REST API discovery links and headers from your page source.

Lets you build an allow list of routes that should stay public (for example a contact form or a specific integration).

Adds a Site Health check so the restriction is clearly explained and never mistaken for a fault.