Birim REST Lock

WordPress publishes a public API at /wp-json/. Anyone can list your usernames and the plugins you run. REST Lock closes it for logged-out visitors and keeps your site working.

What it does

• Allowlist or blocklist routes, with * wildcards.
• Stops username enumeration on /wp/v2/users.
• Hides what you run: blocks the route index and namespace listings, removes REST discovery links.
• Role rules: restrict subscribers or customers too. Administrators are never blocked.
• Safe defaults for Contact Form 7, WooCommerce checkout, oEmbed and Jetpack. CORS preflight passes through.
• One-click import from the Disable REST API plugin.
• One file. PHP 7.4+, WordPress 6.0+. No tracking, no external requests.

Settings

Moving from Disable REST API

Install REST Lock, open Settings → REST Lock, click Import from Disable REST API, review, then deactivate the old plugin.

Check it works

curl -i https://your-site.com/wp-json/wp/v2/users

You should get 401.

Download

REST Lock is in review on WordPress.org. This page will link to it once it is approved.