內容簡介
MaxtDesign REST API Control 外掛讓您完全掌控誰可以訪問您的 WordPress REST API 及可用的端點。它能夠為未經身份驗證的訪客鎖定 REST API，同時保持已登入用戶的功能完整。
【主要功能】
• 一鍵禁用 — 只需一個開關即可阻止未經身份驗證用戶訪問 REST API
• 端點白名單 — 自動發現所有註冊的 REST API 端點並允許特定端點
• 角色基礎訪問控制 — 為特定用戶角色限制 REST API 訪問
• 智能預設 — 自動檢測 Contact Form 7 和 WooCommerce 所需端點
• 零前端足跡 — 不添加任何 CSS、JavaScript 或 HTTP 請求
• 輕量化 — 前端請求不進行數據庫查詢
外掛標籤
開發者團隊
原文外掛簡介
MaxtDesign REST API Control gives you complete control over who can access your WordPress REST API and which endpoints are available.
By default, WordPress exposes a REST API to the public, which can reveal usernames, post data, and site structure to anyone. This plugin lets you lock down the REST API for unauthenticated visitors while keeping it fully functional for logged-in users and the plugins that need it.
Key Features
One-click disable — Block all REST API access for unauthenticated users with a single toggle.
Endpoint whitelisting — Auto-discovers all registered REST API endpoints and lets you whitelist specific ones, even when the API is disabled.
Per-role access control — Restrict REST API access for specific user roles with individual endpoint whitelists.
Smart defaults — Automatically detects Contact Form 7 and WooCommerce and whitelists their required endpoints on activation.
Zero frontend footprint — No CSS, JavaScript, or HTTP requests are added to your frontend. Ever.
Lightweight — No database queries on frontend requests. Uses a single autoloaded option.
Import/Export — Transfer settings between sites with JSON export and import.
Clean uninstall — Removes all plugin data when deleted. Leaves no trace.
How It Works
The plugin uses the rest_authentication_errors filter — the correct, modern WordPress approach — to intercept REST API requests early in the lifecycle, before any endpoint logic executes. This means blocked requests have virtually zero performance impact.
Built for Performance
This plugin follows the MaxtDesign performance-first philosophy:
Zero frontend asset loading (no CSS, no JS, no HTTP requests)
Admin assets load only on the plugin’s own settings page
Single autoloaded database option — no extra queries
Filter fires before endpoint logic — blocked requests are fast
Privacy
This plugin makes no external HTTP requests, sets no cookies, loads no third-party scripts, and collects no analytics. It does not track usage and never “calls home.” It stores a single settings option (mdra_settings) in your database and nothing else; that option is removed when you delete the plugin. No personal or visitor data is processed or transmitted.
Security
Found a security issue? Please report it privately to [email protected] rather than posting
in a public support thread. We aim to acknowledge reports within 3 business days and will agree a
disclosure timeline with you.
Please include the plugin version, steps to reproduce, and the impact as you understand it. We will
credit you in the changelog unless you would rather stay anonymous, and we ask that you do not test
against a site you do not own.
This plugin is published on WordPress.org by the account slaacr, which is MaxtDesign. The account
name predates the brand and WordPress.org does not support renaming accounts, so the two names
differ. Anything published under slaacr is ours.
