REST API Protection

Last updated: 10th July 2026 for CC Security Essentials version 1.0

What is the REST API?

The WordPress REST API allows software to communicate with your website over the internet.

It enables WordPress itself, plugins, themes and third-party applications to exchange information in a standardised way.

Many modern WordPress features rely on the REST API, including the Block Editor and numerous plugins.

For most websites, the REST API is an essential part of WordPress.

Why Would I Restrict Visitor Access?

Although the REST API is an important feature, not every part of it needs to be available to unauthenticated visitors.

If your website doesn’t require public access to the REST API, restricting visitor access can reduce unnecessary exposure while allowing administrators and authorised users to continue using WordPress normally.

For many business websites, this provides a sensible balance between usability and security.

What Does REST API Protection Do?

When enabled, REST API Protection restricts access to the REST API for visitors who are not signed in to your website.

Authenticated users continue to access the REST API as normal, allowing WordPress and authorised plugins to function correctly.

The aim is to reduce unnecessary public access without disrupting legitimate administration.

When Should I Enable REST API Protection?

REST API Protection is often appropriate for websites such as:

  • business websites
  • brochure websites
  • portfolio websites
  • company intranets
  • websites with limited public interaction

If visitors never need to access REST API endpoints directly, restricting public access is often a sensible security improvement.

When Might I Leave Visitor Access Enabled?

Some websites intentionally expose REST API endpoints.

Examples include:

  • headless WordPress websites
  • mobile applications connected to WordPress
  • public JavaScript applications
  • third-party integrations
  • plugins that publish public REST endpoints

If your website depends on public REST API access, you should leave visitor access enabled or carefully test your website before making changes.

Before You Enable REST API Protection

Before restricting visitor access, consider whether your website uses:

  • interactive JavaScript features
  • external applications
  • mobile apps
  • custom integrations
  • plugins that publish public data through the REST API

If you’re unsure, enable the protection during a quiet period and test your website thoroughly afterwards.

Because the setting can be changed at any time, it’s easy to restore public access if required.

How to Enable REST API Protection

To restrict REST API access:

  1. Open CC Security Essentials.
  2. Navigate to REST API Protection.
  3. Enable Restrict Visitor Access.
  4. Save your changes.

The protection applies immediately.

Verifying REST API Protection

CC Security Essentials includes built-in verification for REST API Protection.

After enabling the protection:

  1. Open Verification.
  2. Run the REST API Verification test.
  3. Review the results.

A successful verification confirms that unauthenticated visitors are being restricted while authenticated users continue to access the REST API normally.

What Visitors Experience

Visitors who attempt to access restricted REST API endpoints receive an appropriate response indicating that access is not available.

Normal browsing of your website is unaffected.

Pages, posts and other public content continue to work as expected.

Only requests to protected REST API endpoints are affected.

Troubleshooting

Part of my website stopped working

Some plugins or themes rely on public REST API access.

If functionality stops working after enabling REST API Protection:

  1. Temporarily disable the protection.
  2. Confirm that the feature begins working again.
  3. Identify which plugin or feature depends on public REST API access.
  4. Decide whether visitor access should remain enabled or whether an alternative configuration is possible.

Verification Failed

If the verification test doesn’t produce the expected result:

  • confirm that REST API Protection has been enabled
  • save your settings again
  • clear any caches
  • rerun the verification
  • review the Diagnostics page
  • check whether another plugin is also controlling REST API access

I’m Locked Out of the Website

Restricting visitor access does not prevent administrators from signing in or using the WordPress dashboard.

If you’re signed in with an administrator account, the REST API continues to function normally.

If you experience unexpected behaviour, temporarily disable the protection while you investigate.

REST API Protection and CC Security Essentials Pro

CC Security Essentials provides a straightforward way to restrict visitor access to the REST API.

If your website requires more granular control, CC Security Essentials Pro extends the core plugin with REST Rules.

REST Rules allow you to create allow and block rules for individual routes, making it possible to permit or deny access to specific parts of the REST API while leaving others unaffected.

This additional flexibility is particularly useful for websites with custom integrations or more complex security requirements.

Frequently Asked Questions

Will this break WordPress?

No.

The protection is designed to continue allowing authenticated users to access the REST API as required by WordPress itself.

However, some third-party plugins or custom applications may rely on public access, so testing is recommended.

Does this disable the REST API completely?

No.

REST API Protection restricts access for unauthenticated visitors.

Authorised users continue to access the REST API normally.

Can I allow only certain REST API routes?

The core plugin provides straightforward visitor restriction.

For more advanced route-based control, CC Security Essentials Pro extends the functionality of the core plugin with REST Rules.

Can I turn the protection off later?

Yes.

You can enable or disable REST API Protection at any time from the plugin settings.

Best Practice

For most business websites we recommend:

  • Review whether public REST API access is genuinely required.
  • Enable REST API Protection if appropriate.
  • Run the built-in verification test.
  • Test your website while signed in and while signed out.
  • Review the setting whenever you install plugins that introduce new integrations or public API features.

This measured approach helps reduce unnecessary public access while maintaining compatibility with the features your website relies on.

Related Articles

Continue with: