WordPress REST API Security Best Practices

The WordPress REST API is essential for modern websites, enabling integrations, mobile apps, and dynamic features. However, if left unsecured, it can expose sensitive data or increase your attack surface.

This guide explains how to properly secure your WordPress REST API without breaking your site.

Quick answer: The best way to secure the WordPress REST API is to restrict access to authenticated users, disable unused endpoints, and apply server-level protections like Nginx or .htaccess rules. Renaming wp-json alone is not enough.

What is the WordPress REST API?

The REST API allows external systems to interact with your WordPress site via endpoints like:

/wp-json/wp/v2/posts

It powers:

• The Gutenberg editor
• Headless WordPress setups
• Mobile applications
• Third-party integrations

Why REST API Security Matters

By default, some REST endpoints are publicly accessible. This can expose:

• Post data and metadata
• Usernames
• Site structure

While not always critical, attackers can use this information for:

• Brute-force attacks
• User enumeration
• Reconnaissance

1. Restrict Access to Logged-In Users

The simplest and most effective protection is limiting API access.

\add_filter( 'rest_authentication_errors', function ( $result ) {

    if ( ! \is_user_logged_in() ) {
        return new \WP_Error(' rest_forbidden', 'Login required', array( 'status' => 401 ) );
    }

    return $result;
});

This blocks public API access while preserving functionality for logged-in users.

2. Disable Unused Endpoints

Reduce your attack surface by removing endpoints you don’t use.

\add_filter( 'rest_endpoints', function ( $endpoints ) {

    unset( $endpoints['/wp/v2/users'] );

    return $endpoints;
});

Common targets to disable:

• /wp/v2/users
• /wp/v2/comments

3. Prevent User Enumeration

Attackers often use the REST API to discover usernames.

Disabling the users endpoint helps:

unset($endpoints['/wp/v2/users']);

This reduces the risk of brute-force login attempts.

4. Change the REST API Prefix

You can change the default /wp-json/ prefix:

\add_filter( 'rest_url_prefix', function () {
    return 'custom-api';
});

Tip: If you want to change or hide the default API URL, see our guide:

How to Hide or Change wp-json in WordPress