Turn Off REST APIv1.1.4
Disable the WordPress REST API for logged out visitors and lock down your /wp-json endpoints, with a per route allow list so you stay in control.
Alternatives to Balada Fix
Plugins below are selected for functional relevance and current directory signals. Active-install counts do not affect this ranking.
Relevant replacements
WordPress plugins with similar use cases
Compatibility and update metadata provide context, not a quality guarantee. Review each plugin’s details for your site.
MirSecurev1.0.1
MirSecure protects your WordPress REST API by allowing access only to authenticated users.
Headless Login Guardv1.1.0
Forces login for backend access in headless WordPress setups while allowing GraphQL/REST API endpoints and essential paths.
REST API blocksv2.0.0
Add gutenberg blocks data into the post / page REST API endpoints.
Advanced security suite. Blocks REST API, disables XML-RPC, prevents user enumeration, and secures endpoints.
REST API Guardv1.5.0
Restrict and control anonymous access to the WordPress REST API, with optional JSON Web Token (JWT) authentication.
REST API and MCP access control: disable REST API routes for guests, limit AI agents and application passwords, see which plugin opened each door.
Batch REST Guardv1.2.5
Block wp2shell REST batch attacks (CVE-2026-63030). Detect fake admins and backdoor plugins. Extra security for hacked sites.
EnumGuardv1.0.0
Stops WordPress user enumeration through author URLs, REST, login errors, XML-RPC, sitemaps, and oEmbed.
Hides the list of user accounts that the WordPress REST API shows to visitors who are not logged in, which helps prevent user enumeration.