# Disabling REST API endpoints in WordPress

> Restrict public access to WordPress REST API endpoints, such as the users list, to reduce exposure to attacks.

Source: https://helpcenter.ruachost.com/wordpress/guides/disabling-rest-api-endpoints-in-wordpress/

WordPress includes a **REST API** that allows applications to interact with your site using JSON data. By default, many REST API endpoints are publicly accessible, including those that expose user information. On **ruachost.com**, you can restrict access to these endpoints for better security.

## Why Disable REST API Endpoints?

- Prevents unauthorized access to sensitive data (e.g., user lists).
- Reduces exposure to automated attacks.
- Helps harden WordPress security without breaking admin functionality.

## Steps to Disable REST API for Non‑Authenticated Users

1. **Log in to WordPress** as the administrator.
2. In the dashboard, go to **Appearance → Theme Editor**.
3. From the right‑hand column, select **functions.php**.
4. Scroll to the bottom of the file and add the following code:

   ```
   add_filter( 'rest_authentication_errors', function( $result ) {
       if ( true === $result || is_wp_error( $result ) ) {
           return $result;
       }
       if ( ! is_user_logged_in() ) {
           return new WP_Error( 'rest_not_logged_in', __( 'You are not currently logged in.' ), array( 'status' => 401 ) );
       }
       return $result;
   });
   ```
5. Click **Update File** to save changes.

✅ Now, only logged‑in users can access REST API endpoints. Non‑authenticated users will see the message:

```
You are not currently logged in.
```

## Important Notes

- Do **not** disable the REST API completely, as it is required for WordPress admin functionality.
- Always back up your site before editing theme files.
- Use a **child theme** to preserve changes during updates.
- Test thoroughly to ensure plugins or themes that rely on the REST API continue to work.