WireCore REST Control

Description

WireCore REST Control restricts access to the WordPress REST API without breaking the block editor or the plugins your visitors rely on. Instead of an all-or-nothing switch, you decide per namespace and per route who may read and who may write.

The route list shows every registered route – WordPress core, themes and all other plugins – and tells you which plugin or theme registered it.

Rules

• A default rule plus overrides per namespace and per route. The most specific rule wins: route, then namespace, then automatic allowance, then default.
• Separate rules for reading (GET/HEAD) and writing (POST/PUT/PATCH/DELETE).
• Rule levels: Public, Logged-in only (optionally limited to selected roles), Admins only, Blocked, Inherit.
• Out of the box, logged-out visitors are blocked – except for the namespaces of known front-end plugins (see below).
• Quick actions: block everything for guests, block everything, restrict the user list (/wp/v2/users) to admins, reset custom rules.
• Search and filter the route list by text, source plugin/theme and status.

Advanced exceptions per namespace or route

• Allow IP addresses / CIDR ranges (IPv4 and IPv6), roles and user IDs.
• Deny IP addresses / CIDR ranges and roles.
• Denials take precedence over allowances and also apply to administrators.
• All exceptions are visible in the route list at a glance.

Automatic allowances

Some plugins need the REST API for visitors on the front end. Their namespaces are public as long as you do not set a custom rule. Each of them can be switched off in the settings:

• Contact Form 7
• WooCommerce Store API (cart, checkout)
• oEmbed (embedding posts on other sites)
• LiteSpeed Cache (QUIC.cloud)
• WP Statistics

Global settings and hardening

• Never block administrators (recommended – the block editor needs the REST API).
• Global allow lists for user IDs and IP addresses, global IP deny list.
• Custom error message and status code (401, 403 or 404 – the latter makes blocked routes look non-existent).
• Allow the REST API over HTTPS only.
• Disable JSONP.
• Remove REST links from HTTP headers, the HTML head and RSD.
• Hide blocked routes and namespaces in the REST index (/wp-json/).

Log and tools

• Optional log of the last 200 blocked requests. The IP address can be stored in full, shortened or not at all.
• Self-test: shows what logged-out visitors get from the REST API.
• Export and import of all settings as JSON.
• WP-CLI: wp wirecore-rest status|routes|set|default|export|import|log.

Coverage

Rules apply to every real REST request, including embedded responses (_embed) and sub-requests of the batch endpoint (/batch/v1). Internal rest_do_request() calls made by PHP – for example when the block editor preloads data – are not affected.

Multisite

Settings are stored per site, because every site has its own routes and plugins. The plugin can be network-activated; uninstalling removes the settings of all sites.

For developers

• wirecore_rc_error – filters the WP_Error of a blocked request (parameters: error, route pattern, method). Returning true allows the request after all.
• wirecore_rc_client_ip – filters the client IP, e.g. behind a reverse proxy.
• wirecore_rc_known_namespaces – filters the plugins offered under “Automatic allowances” (array key => [namespaces]).

Privacy

The plugin does not send any data to external services and does not set cookies. If you enable the log, it stores the method, route, IP address (in full, shortened or not at all – configurable), user ID and the reason of blocked requests in the database of your site. The self-test sends requests from your server to its own REST API.

Source code and third-party resources

The settings page uses the WireLayer component library (MIT). assets/wirelayer/wirelayer.css is generated from the npm package @wirecore/wirelayer-css with npm run build:css; the source code of the plugin, including package.json, is available at github.com/WireCore/WP-Rest-Control. Bundled with it:

• Tailwind CSS (MIT) – preflight and utilities compiled into wirelayer.css
• Schibsted Grotesk and JetBrains Mono fonts (SIL Open Font License 1.1, assets/wirelayer/fonts/OFL.txt), served from the plugin – no external font service
• Lucide icons (ISC)