內容簡介
Turn Off REST API 是一款輕量級的 WordPress 安全外掛，旨在為未登入的訪客禁用 WordPress REST API。這樣可以防止匿名請求訪問網站數據，提升網站安全性，同時不影響已登入用戶的正常使用。
【主要功能】
• 對未認證的 REST API 請求返回認證錯誤
• 可選擇移除頁面源碼中的 REST API 發現連結和標頭
• 建立允許清單以保留特定路由公開
• 添加網站健康檢查以清楚解釋限制
• 只阻止未認證訪問，保持管理區域正常運作
外掛標籤
開發者團隊
原文外掛簡介
Turn Off REST API is a lightweight WordPress security plugin that disables the WordPress REST API for visitors who are not logged in. Anonymous requests to your /wp-json endpoints receive an authentication error instead of your site data, while logged in users, the block editor, and your admin area keep working normally.
Because every route is blocked for logged out visitors by default, features that call the REST API on behalf of visitors stop working for them until you allow their routes. This includes the WooCommerce Cart and Checkout blocks and Contact Form 7 form submissions. The FAQ below shows exactly which routes to allow.
By default WordPress exposes a large amount of information through the REST API, including your list of user accounts and usernames, published content, and details about your site. For most sites that open, unauthenticated access is unnecessary and only widens the attack surface for user enumeration and content scraping. Turn Off REST API closes the WordPress REST API to the public in one click, then gives you a clear settings screen to reopen only the specific REST API routes you actually need.
Why turn off the WordPress REST API?
Stop anonymous user enumeration through /wp-json/wp/v2/users.
Reduce your attack surface against REST API based exploits and bots.
Keep your content and site data from being scraped through the public API.
Stay in control with a per route allow list instead of an all or nothing switch.
What it does
Returns an authentication error for unauthenticated REST API requests.
Optionally removes the REST API discovery links and headers from your page source.
Lets you build an allow list of routes that should stay public (for example a contact form or a specific integration).
Adds a Site Health check so the restriction is clearly explained and never mistaken for a fault.
Keeps the admin area, the block editor, and logged in functionality fully working.
Built for control, not breakage
Some security plugins disable the REST API completely and break the block editor or third party integrations in the process. Turn Off REST API only blocks unauthenticated access, and the per route allow list means you can whitelist exactly the endpoints a service needs without opening the whole API back up.
Developer friendly
The access decision runs through the tora_grant_rest_api filter, so developers can extend or override the logic for custom roles, application passwords, or trusted requests.
