Hide the REST API Index From Visitors
Stops logged-out visitors from listing every REST API route and plugin namespace at /wp-json/, while the routes themselves keep working.
Opens WPIDE on
Code
$wpide_strip_rest_index = function ( $response ) {
if ( is_user_logged_in() || ! ( $response instanceof WP_REST_Response ) ) {
return $response;
}
$data = $response->get_data();
unset( $data['routes'], $data['namespaces'], $data['authentication'] );
$response->set_data( $data );
return $response;
};
add_filter( 'rest_index', $wpide_strip_rest_index );
add_filter( 'rest_namespace_index', $wpide_strip_rest_index );
add_filter( 'rest_jsonp_enabled', '__return_false' );Notes
Some apps discover routes through the index; test integrations that connect to your site anonymously.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.