carawebs/wp-secure-rest-api

A very simple mu plugin for WordPress that disallows access to REST endpoints for users that are not logged in.

Secure WordPress REST API

A super-simple plugin that disallows access to REST endpoints for users that are not logged in., _(*1)

Stops the REST API from being used to enumerate users., _(*2)

Usage

• Clone this repo to mu-plugins - you may need to create this directory in the designated WordPress content directory (wp-content in a standard install)
• Make sure the file is loaded

If you're using Bedrock, the built in mu-plugins autoloader will take care of loading for you., _(*3)

Check it's working: https://example.com/wp-json/wp/v2/users should return a 401 response if the user is not logged in., _(*4)

Non Bedrock Loader

Add this line to a loader in the root mu-plugins directory:, _(*5)

<?php
// path/mu-plugins/load.php
require WPMU_PLUGIN_DIR.'/secure-rest-api/secure-rest-api.php';