Title: WireCore REST Control Author: WireCore GmbH Published: November 9, 2026 Last modified: November 9, 2026 --- Search plugins ![](https://ps.w.org/wirecore-rest-control/assets/banner-772x250.png?rev=3793158) ![](https://ps.w.org/wirecore-rest-control/assets/icon-256x256.png?rev=3793158) # WireCore REST Control By [WireCore GmbH](https://profiles.wordpress.org/wirecore/) [Download](https://downloads.wordpress.org/plugin/wirecore-rest-control.1.0.0.zip) * [Details](https://wordpress.org/plugins/wirecore-rest-control/#description) * [Reviews](https://wordpress.org/plugins/wirecore-rest-control/#reviews) * [Installation](https://wordpress.org/plugins/wirecore-rest-control/#installation) * [Development](https://wordpress.org/plugins/wirecore-rest-control/#developers) [Support](https://wordpress.org/support/plugin/wirecore-rest-control/) ## Description WireCore REST Control restricts access to the WordPress REST API without breaking the block editor or the plugins your visitors rely on. Instead of an all-or-nothing switch, you decide per namespace and per route who may read and who may write. The route list shows **every registered route** – WordPress core, themes and all other plugins – and tells you which plugin or theme registered it. #### Rules * A default rule plus overrides per namespace and per route. The most specific rule wins: route, then namespace, then automatic allowance, then default. * Separate rules for reading (GET/HEAD) and writing (POST/PUT/PATCH/DELETE). * Rule levels: Public, Logged-in only (optionally limited to selected roles), Admins only, Blocked, Inherit. * Out of the box, logged-out visitors are blocked – except for the namespaces of known front-end plugins (see below). * Quick actions: block everything for guests, block everything, restrict the user list (`/wp/v2/users`) to admins, reset custom rules. * Search and filter the route list by text, source plugin/theme and status. #### Advanced exceptions per namespace or route * Allow IP addresses / CIDR ranges (IPv4 and IPv6), roles and user IDs. * Deny IP addresses / CIDR ranges and roles. * Denials take precedence over allowances and also apply to administrators. * All exceptions are visible in the route list at a glance. #### Automatic allowances Some plugins need the REST API for visitors on the front end. Their namespaces are public as long as you do not set a custom rule. Each of them can be switched off in the settings: * Contact Form 7 * WooCommerce Store API (cart, checkout) * oEmbed (embedding posts on other sites) * LiteSpeed Cache (QUIC.cloud) * WP Statistics #### Global settings and hardening * Never block administrators (recommended – the block editor needs the REST API). * Global allow lists for user IDs and IP addresses, global IP deny list. * Custom error message and status code (401, 403 or 404 – the latter makes blocked routes look non-existent). * Allow the REST API over HTTPS only. * Disable JSONP. * Remove REST links from HTTP headers, the HTML head and RSD. * Hide blocked routes and namespaces in the REST index (`/wp-json/`). #### Log and tools * Optional log of the last 200 blocked requests. The IP address can be stored in full, shortened or not at all. * Self-test: shows what logged-out visitors get from the REST API. * Export and import of all settings as JSON. * WP-CLI: `wp wirecore-rest status|routes|set|default|export|import|log`. #### Coverage Rules apply to every real REST request, including embedded responses (`_embed`) and sub-requests of the batch endpoint (`/batch/v1`). Internal `rest_do_request()` calls made by PHP – for example when the block editor preloads data – are not affected. #### Multisite Settings are stored per site, because every site has its own routes and plugins. The plugin can be network-activated; uninstalling removes the settings of all sites. #### For developers * `wirecore_rc_error` – filters the `WP_Error` of a blocked request (parameters: error, route pattern, method). Returning `true` allows the request after all. * `wirecore_rc_client_ip` – filters the client IP, e.g. behind a reverse proxy. * `wirecore_rc_known_namespaces` – filters the plugins offered under “Automatic allowances” (array `key => [namespaces]`). #### Privacy The plugin does not send any data to external services and does not set cookies. If you enable the log, it stores the method, route, IP address (in full, shortened or not at all – configurable), user ID and the reason of blocked requests in the database of your site. The self-test sends requests from your server to its own REST API. #### Source code and third-party resources The settings page uses the [WireLayer](https://github.com/WireCore/WireLayer) component library (MIT). `assets/wirelayer/wirelayer.css` is generated from the npm package`@ wirecore/wirelayer-css` with `npm run build:css`; the source code of the plugin, including `package.json`, is available at [github.com/WireCore/WP-Rest-Control](https://github.com/WireCore/WP-Rest-Control). Bundled with it: * Tailwind CSS (MIT) – preflight and utilities compiled into `wirelayer.css` * Schibsted Grotesk and JetBrains Mono fonts (SIL Open Font License 1.1, `assets/ wirelayer/fonts/OFL.txt`), served from the plugin – no external font service * Lucide icons (ISC) ## Screenshots [⌊Every registered route, grouped by namespace, with the plugin or theme that registered it.⌉⌊Every registered route, grouped by namespace, with the plugin or theme that registered it.⌉[ Every registered route, grouped by namespace, with the plugin or theme that registered it. [⌊Rules per namespace and route for reading and writing, with exceptions and the effective rule.⌉⌊Rules per namespace and route for reading and writing, with exceptions and the effective rule.⌉[ Rules per namespace and route for reading and writing, with exceptions and the effective rule. [⌊The "Advanced" dialog: allow and deny IP addresses, roles and users per namespace or route.⌉⌊The "Advanced" dialog: allow and deny IP addresses, roles and users per namespace or route.⌉[ The “Advanced” dialog: allow and deny IP addresses, roles and users per namespace or route. [⌊Settings: automatic allowances for front-end plugins, error response, hardening and log.⌉⌊Settings: automatic allowances for front-end plugins, error response, hardening and log.⌉[ Settings: automatic allowances for front-end plugins, error response, hardening and log. [⌊Log of blocked requests with shortened IP addresses.⌉⌊Log of blocked requests with shortened IP addresses.⌉[ Log of blocked requests with shortened IP addresses. ## Installation 1. Install the plugin via _Plugins Add New_ or upload the plugin folder to `/wp-content/ plugins/`. 2. Activate the plugin. From now on, logged-out visitors can no longer use the REST API, except for the automatically allowed namespaces. 3. Go to _Settings REST API_ to review the route list and adjust the rules. With Composer, the plugin can be installed from WPackagist: `composer require wpackagist- plugin/wirecore-rest-control`. ## FAQ ### A rule locked me out of the admin area. What can I do? Add the following line to your `wp-config.php`. It disables all rules until you remove it again: ``` define( 'WIRECORE_RC_OFF', true ); ``` ### Will administrators be blocked? Not by default: the option “Never block administrators” is enabled after activation, because the block editor needs the REST API. Deny lists (IP addresses, roles) always apply, also to administrators. ### My contact form or shop checkout stopped working. Check _Settings REST API Settings Automatic allowances_. If the plugin is not listed there, search for its namespace in the route list and set it to “Public”. ### Does it also restrict routes of other plugins? Yes. The route list contains every registered route and shows which plugin or theme registered it. Some plugins only register routes during REST requests; the list is therefore loaded through the REST API itself so that these routes are included as well. ### How can I check what visitors see? Use _Tools Self-test_ on the settings page, or open `/wp-json/` in a private browser window. ### Is the plugin translated? The plugin ships with German translations (formal and informal). Further translations are welcome on translate.wordpress.org. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “WireCore REST Control” is open source software. The following people have contributed to this plugin. Contributors * [ WireCore GmbH ](https://profiles.wordpress.org/wirecore/) [Translate “WireCore REST Control” into your language.](https://translate.wordpress.org/projects/wp-plugins/wirecore-rest-control) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/wirecore-rest-control/), check out the [SVN repository](https://plugins.svn.wordpress.org/wirecore-rest-control/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/wirecore-rest-control/) by [RSS](https://plugins.trac.wordpress.org/log/wirecore-rest-control/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * Initial release. ## Meta * Version **1.0.0** * Last updated **9 hours ago** * Active installations **Fewer than 10** * WordPress version ** 5.8 or higher ** * Tested up to **7.1.4** * PHP version ** 7.4 or higher ** * Tags * [disable REST API](https://wordpress.org/plugins/tags/disable-rest-api/)[json api](https://wordpress.org/plugins/tags/json-api/) [privacy](https://wordpress.org/plugins/tags/privacy/)[rest-api](https://wordpress.org/plugins/tags/rest-api/) [security](https://wordpress.org/plugins/tags/security/) * [Advanced View](https://wordpress.org/plugins/wirecore-rest-control/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/wirecore-rest-control/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/wirecore-rest-control/reviews/) ## Contributors * [ WireCore GmbH ](https://profiles.wordpress.org/wirecore/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/wirecore-rest-control/)