A security plugin that controls XML-RPC access and specific WordPress REST API endpoints from anonymous users.

teamredfox

This plugin is designed to fundamentally strengthen the security of your WordPress site.
By default, WordPress exposes REST API endpoints like the user list (/wp/v2/users) even to unauthenticated users (anonymous users). This poses a risk of information leakage and can serve as a stepping stone for brute-force attacks by enabling username enumeration.
Using this plugin, you can finely adjust the following security settings from the “Settings” -> “General” page in the administration area.
Key Security Features
<h3>REST API Anonymous Access Restriction:</h3>
<ul>
<li>
Core endpoints (such as users, comments, media) and broad routes added by plugins can be specified as a blacklist.
</li>
<li>
Routes necessary for blog display (such as wp/v2/posts) can be specified as a whitelist to exempt them from restrictions.
</li>
<li>
Configure the HTTP status code (e.g., 403 Forbidden) and a custom error message to return upon access denial, preventing attackers from gaining insight into your site structure.
</li>
</ul>
<h3>Complete XML-RPC Blocking:</h3>
<ul>
<li>
Completely disable the XML-RPC functionality (xmlrpc.php) at the core WordPress level.
</li>
<li>
When an attacker attempts access, the plugin responds with a specified HTTP status code and a custom error message, deceptively denying access.
</li>
</ul>
This plugin is highly recommended for all WordPress sites that require enhanced security.

Alternatives to REST API Shield & XML-RPC Blocker

Top alternatives