外掛標籤
開發者團隊
原文外掛簡介
WordPress exposes a public REST API at /wp-json/. Anyone can list your users, your installed plugins’ endpoints and your content. Birim REST Lock closes it without breaking your site.
Allowlist mode (default): block every route except the ones you list.
Blocklist mode: allow every route except the ones you list.
Wildcards: /wp/v2/posts* covers /wp/v2/posts and /wp/v2/posts/123.
Role rules: apply the same rules to logged-in roles you choose, such as subscribers or customers. Administrators are never blocked.
Stop username enumeration: always block /wp/v2/users.
Hide what you run: block the route index and namespace listings, and remove REST links from page HTML, the Link header and RSD.
Safe defaults: Contact Form 7, WooCommerce block checkout, oEmbed and Jetpack routes are allowed out of the box. CORS preflight (OPTIONS) requests pass through, so token logins keep working.
One-click import from Disable REST API: moves your logged-out allowlist and managed roles across.
Lightweight: one file, works on PHP 7.4 and up, no tracking, no external requests, no ads.
For developers
birim_rest_lock_blocked filter: ( bool $blocked, string $route, WP_REST_Request $request ) to override the decision.
birim_rest_lock_message filter: change the error message.
