ksym04

Turn off JSON REST API on your website to anonymous users and prevent unauthorized requests from using the REST API to get information from your website.
Since the release of WordPress 4.0 came out, there have been a lot of hackers exploiting the vulnerabilities of the REST API. By installing this plugin, you will effectively prevent and disable the use of REST API from unauthorized users and protect the information on your website from being accessible. If someone tries to access the REST API on your site, the plugin will return an authentication error on the API endpoints, for any unauthorized users trying to access it.
While WordPress REST API vulnerability exploits continue this plugin effectively prevent and disable the used of REST API from accessing information from your website, this plugin return authentication error and disable all endpoints for any user not logged in on your website.
<h3>Translations</h3>
<ul>
<li>English (en_US)</li>
</ul>

Turn Off REST API

Prevents unauthorized requests from using the WP REST API.

Martin Cipriano

Every plugin and theme you install registers REST API endpoints. Most are public by default — including the ones your site never uses.
Unused endpoints are unnecessary exposure. They reveal information about your stack, invite probing, and become liabilities when a vulnerability is discovered in a plugin you forgot to audit.
WPBuoy Endpoint Manager gives you a clear view of every endpoint on your site and a one-click toggle to disable the ones you don’t need.
See your full API surface 
Every REST API endpoint from WordPress core, plugins, and themes in one organized view — grouped by namespace, with a count of how many are currently disabled.
Block endpoints instantly 
Toggle any endpoint off and it returns a 403. No code, no rules, no guesswork. One click. Requires an active Pro license.
Preview before you block 
Click the preview icon on any static endpoint to fetch its live REST API response in an inline modal — without leaving the admin. Know exactly what you’re disabling before you disable it.
Search and filter your endpoints 
Find any endpoint instantly with keyboard search (Ctrl/Cmd+F) and result highlighting. Filter by status, route type, method, or namespace to focus on what matters.
Security logging 
Every blocked request is logged with IP address, endpoint, user agent, and timestamp — so you always know what’s being probed. Filter logs by IP, endpoint, or date range. Logs auto-clean after 30 days.
Clean and accessible 
Built to WordPress admin standards. Fully keyboard-navigable with screen reader support.
<h4>Who it’s for</h4>
Agencies hardening client sites. Developers locking down staging environments. Site owners running WooCommerce, membership, or any setup where REST API exposure is a real risk.
<h4>Go further with Pro</h4>
WPBuoy Endpoint Manager Pro adds:
<ul>
<li>Endpoint blocking with a configurable response code and message (requires license)</li>
<li>Dynamic route support with regex pattern matching</li>
<li>Interactive preview modal for dynamic endpoints (auto-resolves default parameter values)</li>
<li>Global rate limiting — cap the total number of REST API requests per time window</li>
<li>Per-endpoint rate limiting — set independent limits on individual routes</li>
<li>IP Block List — manual blocking, auto-block IPs that exceed rate limits, and an allowlist for trusted IPs</li>
<li>CSV export of security logs</li>
<li>Automatic plugin updates</li>
<li>Priority support</li>
</ul>
<a href="https://wpbuoy.com/plugins/endpoint-manager/" rel="nofollow ugc">Learn more about Endpoint Manager Pro</a>

WPBuoy Endpoint Manager

View, search, filter, and disable WordPress REST API endpoints. Reduce your attack surface and log blocked requests — no code required.

Turn Off REST API vs WPBuoy Endpoint Manager