RESTless

RESTless is a tiny WordPress plugin which disables access to the REST API (available in WordPress since version 4.4) for non-authenticated users.
This prevents usage of the REST API by the general public and limits access to those with login credentials. No REST for the wicked.

It also supports WordPress Multisite installations.

Notes

Credits:

Sword icon used in the WordPress plugin repository and found as /assets/icon*
From the series ‘Sketchy’ By Shannon E Thomas

Thanks Shannon E Thomas and to[icon] for sharing your work!

WordPress repository banner image found in /assets/banner*:

Orginal painting: ‘Draak’
Drawn by: Utagawa Kuniyoshi
Dated around 1808 – 1861
Repository: Rijksmuseum.nl
Modified by: Björn Wijers

Thanks Rijksmuseum!

Install this plugin as you’d install any other WordPress plugin
e.g.

1. Upload restless directory to the /wp-content/plugins/ directory
2. Activate the plugin through the ‘Plugins’ menu in WordPress

Installation Instructions

Install this plugin as you’d install any other WordPress plugin
e.g.

1. Upload restless directory to the /wp-content/plugins/ directory
2. Activate the plugin through the ‘Plugins’ menu in WordPress

Does this disable the REST API?

No, it only prevents non-authenticated usage of the REST API.

Does it work with WordPress Multisite?

Yes, it does. You may disable REST API access per site or per Network.
Per site: Activate the plugin only per site on which you’d like to disable non-authenticated REST API access.
Per network: Use network-activated for the plugin and it will automagically disable non-authenticated REST API access.

1.0

First release