# Hide the REST API Index From Visitors

> Stops logged-out visitors from listing every REST API route and plugin namespace at /wp-json/, while the routes themselves keep working.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: security, rest-api, hardening
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/hide-rest-api-index/

## Code

```php
$wpide_strip_rest_index = function ( $response ) {
    if ( is_user_logged_in() || ! ( $response instanceof WP_REST_Response ) ) {
        return $response;
    }

    $data = $response->get_data();
    unset( $data['routes'], $data['namespaces'], $data['authentication'] );
    $response->set_data( $data );

    return $response;
};

add_filter( 'rest_index', $wpide_strip_rest_index );
add_filter( 'rest_namespace_index', $wpide_strip_rest_index );
add_filter( 'rest_jsonp_enabled', '__return_false' );
```

## Notes

Some apps discover routes through the index; test integrations that connect to your site anonymously.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Hide the REST API Index From Visitors" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/