Enrico Sorcinelli

<p>JSON REST API and XML-RPC API are powerful ways to remotely interact with WordPress.</p>
<p>If you don’t have external applications that need to communicate with your WordPress instance using JSON REST API or XML-RPC API you should disable access to them for external requests.</p>
<p>In the standard WordPress installation JSON REST API and XML-RPC API are enabled by default.<br />
In particular the REST API is turned on also for unlogged users. This means that your WordPress instance is potentially leaking data, for example anyone could be able to:</p>
<ul>
<li>copy easily your published contents natively with the REST API (and not with a web crawler);</li>
<li>get the list of all users (with their ID, nickname and name);</li>
<li>retrieve other information that you didn’t want to be public (such as an unlisted published page or a saved media not yet used).</li>
</ul>
<p>Even if you could do the stuff by writing your own code using native filters, this plugin aims to help you to control JSON REST API and XML-RPC API accesses from the administration panel or programmatically by a simple API filter.</p>
<h3>Basic Features</h3>
<ul>
<li><strong>Disable REST API</strong> interface for unlogged users.</li>
<li><strong>Disable JSONP support</strong> on REST API.</li>
<li><strong>Add Basic Authentication</strong> to REST API.</li>
<li><strong>Remove</strong> REST <code><link></code> tags, REST <code>Link</code> HTTP header and REST Really Simple Discovery (RSD) informations.</li>
<li><strong>Setup trusted users, IP/Networks and endpoints</strong> for unlogged users REST requests.</li>
<li><strong>Change REST endpoint prefix</strong>.</li>
<li><strong>Disable XML-RPC API</strong> interface.</li>
<li><strong>Remove</strong> <code><link></code> to the Really Simple Discovery (RDS) informations.</li>
<li><strong>Remove</strong> <code>X-Pingback</code> HTTP header.</li>
<li><strong>Setup trusted users, IP/Networks and methods</strong> for XML-RPC requests.</li>
<li><strong>Show user’s access informations</strong> in users list administration screen.</li>
</ul>
<h3>Usage</h3>
<p>Once the plugin is installed you can control settings in the following ways:</p>
<ul>
<li>Using the <em>Settings->REST XML-RPC Data Checker</em> administration screen.</li>
<li>Programmatically, by using <code>rest_xmlrpc_data_checker_settings</code> filter (see below).</li>
</ul>
<h3>API</h3>
<h4>Hooks</h4>
<p><strong><code>rest_xmlrpc_data_checker_settings</code></strong></p>
<p>Filters plugin settings values.</p>
<pre><code>apply_filters( 'rest_xmlrpc_data_checker_settings', array $settings )
</code></pre>
<p><strong><code>rest_xmlrpc_data_checker_admin_settings</code></strong></p>
<p>Filter allowing to display or not the plugin settings page in the administration.</p>
<pre><code>apply_filters( 'rest_xmlrpc_data_checker_admin_settings', boolean $display )
</code></pre>
<p><strong><code>rest_xmlrpc_data_checker_rest_error</code></strong></p>
<p>Filter JSON REST authentication error after plugin checks.</p>
<pre><code>apply_filters( 'rest_xmlrpc_data_checker_rest_error', WP_Error|boolean $result )
</code></pre>
<p><strong><code>xmlrpc_before_insert_post</code></strong></p>
<p>Filter XML-RPC post data to be inserted via XML-RPC before to insert post into database.</p>
<pre><code>apply_filters( 'xmlrpc_before_insert_post', array|IXR_Error $content_struct, WP_User $user )
</code></pre>


REST XML-RPC Data Checker

REST XML-RPC Data Checker allow to check JSON REST and XML-RPC API requests and grant access permissions.

Luiz Bills

<p>Several opinionated WordPress tweaks focused in security and performance.</p>
<h4>FEATURES</h4>
<ul>
<li>Produces clean filenames for uploads</li>
<li>Change admin footer text</li>
<li>Disable author page and author search by url</li>
<li>Disable emoji mess</li>
<li>Disable “meta widget”</li>
<li>Disable WP REST API public access</li>
<li>Disable “website” field from comment form</li>
<li>Disable wp embed</li>
<li>Disable xmlrpc.php</li>
<li>Show admin bar for admin users only</li>
<li>Hide WordPress update nag to all but admins</li>
<li>Remove “WordPress logo” from admin bar</li>
<li>Remove “+ New” button from admin bar</li>
<li>Remove some dashboard widgets</li>
<li>Remove query strings from scripts (JavaScript and CSS)</li>
<li>Remove <link rel=”shortlink” ></li>
<li>Remove dashboard “welcome panel”</li>
<li>Remove WordPress version number in <head></li>
<li>and more…</li>
</ul>
<p><strong>Note</strong>: is possible disable any feature.</p>
<h4>Contribuitions</h4>
<p>For bugs, suggestions or contribuitions, open a issue in our <a href="https://github.com/luizbills/wp-tweaks/issues" rel="nofollow ugc">Github Repository</a> or create a topic in <a href="https://wordpress.org/support/plugin/wp-tweaks/" rel="ugc">WordPress Plugin Forum</a>.</p>
<h4>Donations</h4>
<p>Support this plugin on <a href="https://luizpb.com/donate/" rel="nofollow ugc">https://luizpb.com/donate/</a></p>


WP Tweaks

Several opinionated WordPress tweaks focused in security and performance.

REST XML-RPC Data Checker vs WP Tweaks