Turn Off REST APIv1.1.4
Disable the WordPress REST API for logged out visitors and lock down your /wp-json endpoints, with a per route allow list so you stay in control.
Alternatives to WP REST API Security
Plugins below are selected for functional relevance and current directory signals. Active-install counts do not affect this ranking.
Relevant replacements
WordPress plugins with similar use cases
Compatibility and update metadata provide context, not a quality guarantee. Review each plugin’s details for your site.
Full control over your WordPress REST API. Block, restrict, or whitelist endpoints per user role. Lightweight, fast, zero frontend footprint.
Control WordPress REST API access by requiring user authentication with API key system.
Prevents public access to REST API user endpoints while allowing authorized roles.
Expose selected posts & pages as AI-readable endpoints via the Model Context Protocol (MCP) with granular permission control and full CRUD operations.
Secure and protect WordPress REST API from unauthorized access using JWT token, Basic Authentication, API Key, OAuth 2, or external token.
REST API Guardv1.5.0
Restrict and control anonymous access to the WordPress REST API, with optional JSON Web Token (JWT) authentication.
Extends GlotPress with REST API endpoints for programmatic access to translation data.
Access Governance for WordPress. Understand, control, and continuously govern who and what can access your WordPress website.
Hides the list of user accounts that the WordPress REST API shows to visitors who are not logged in, which helps prevent user enumeration.