Birim REST Lock

WordPress exposes a public REST API at /wp-json/. Anyone can list your users, your installed plugins’ endpoints and your content. Birim REST Lock closes it without breaking your site.

• Allowlist mode (default): block every route except the ones you list.
• Blocklist mode: allow every route except the ones you list.
• Wildcards: /wp/v2/posts* covers /wp/v2/posts and /wp/v2/posts/123.
• Role rules: apply the same rules to logged-in roles you choose, such as subscribers or customers. Administrators are never blocked.
• Stop username enumeration: always block /wp/v2/users.
• Hide what you run: block the route index and namespace listings, and remove REST links from page HTML, the Link header and RSD.
• Safe defaults: Contact Form 7, WooCommerce block checkout, oEmbed and Jetpack routes are allowed out of the box. CORS preflight (OPTIONS) requests pass through, so token logins keep working.
• One-click import from Disable REST API: moves your logged-out allowlist and managed roles across.
• Lightweight: one file, works on PHP 7.4 and up, no tracking, no external requests, no ads.

For developers

• birim_rest_lock_blocked filter: ( bool $blocked, string $route, WP_REST_Request $request ) to override the decision.
• birim_rest_lock_message filter: change the error message.