{"id":395470,"date":"2026-10-30T07:21:01","date_gmt":"2026-10-30T07:21:01","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/birim-rest-lock\/"},"modified":"2026-10-30T07:20:49","modified_gmt":"2026-10-30T07:20:49","slug":"birim-rest-lock","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/birim-rest-lock\/","author":23595763,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.0","stable_tag":"1.0.0","tested":"7.1.4","requires":"6.0","requires_php":"7.4","requires_plugins":null,"header_name":"Birim REST Lock","header_author":"Birim","header_description":"Lock the WordPress REST API for logged-out visitors and chosen roles. Allowlist or blocklist routes, stop user enumeration, hide REST discovery, import from Disable REST API.","assets_banners_color":"0e1b2d","last_updated":"2026-10-30 07:20:49","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/birimone.pages.dev\/rest-lock\/","header_author_uri":"https:\/\/birimone.pages.dev\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":56,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"birimone","date":"2026-10-30 07:20:49","revision":3774593}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3774593,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3774593,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3774593,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3774593,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3774593,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3774593,"resolution":"1","location":"assets","locale":"","width":2560,"height":1912}},"screenshots":{"1":"Settings &gt; REST Lock: choose a mode, list routes with wildcards, restrict roles and hide user and route listings."}},"plugin_section":[],"plugin_tags":[125786,1118,23853,600,46130],"plugin_category":[54],"plugin_contributors":[289670],"plugin_business_model":[],"class_list":["post-395470","plugin","type-plugin","status-publish","hentry","plugin_tags-disable-rest-api","plugin_tags-json","plugin_tags-rest-api","plugin_tags-security","plugin_tags-user-enumeration","plugin_category-security-and-spam-protection","plugin_contributors-birimone","plugin_committers-birimone"],"banners":{"banner":"https:\/\/ps.w.org\/birim-rest-lock\/assets\/banner-772x250.png?rev=3774593","banner_2x":"https:\/\/ps.w.org\/birim-rest-lock\/assets\/banner-1544x500.png?rev=3774593","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":"https:\/\/ps.w.org\/birim-rest-lock\/assets\/icon.svg?rev=3774593","icon":"https:\/\/ps.w.org\/birim-rest-lock\/assets\/icon.svg?rev=3774593","icon_2x":false,"generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/birim-rest-lock\/assets\/screenshot-1.png?rev=3774593","caption":"Settings &gt; REST Lock: choose a mode, list routes with wildcards, restrict roles and hide user and route listings."}],"raw_content":"<!--section=description-->\n<p>WordPress exposes a public REST API at <code>\/wp-json\/<\/code>. Anyone can list your users, your installed plugins' endpoints and your content. Birim REST Lock closes it without breaking your site.<\/p>\n\n<ul>\n<li><strong>Allowlist mode<\/strong> (default): block every route except the ones you list.<\/li>\n<li><strong>Blocklist mode<\/strong>: allow every route except the ones you list.<\/li>\n<li><strong>Wildcards<\/strong>: <code>\/wp\/v2\/posts*<\/code> covers <code>\/wp\/v2\/posts<\/code> and <code>\/wp\/v2\/posts\/123<\/code>.<\/li>\n<li><strong>Role rules<\/strong>: apply the same rules to logged-in roles you choose, such as subscribers or customers. Administrators are never blocked.<\/li>\n<li><strong>Stop username enumeration<\/strong>: always block <code>\/wp\/v2\/users<\/code>.<\/li>\n<li><strong>Hide what you run<\/strong>: block the route index and namespace listings, and remove REST links from page HTML, the <code>Link<\/code> header and RSD.<\/li>\n<li><strong>Safe defaults<\/strong>: Contact Form 7, WooCommerce block checkout, oEmbed and Jetpack routes are allowed out of the box. CORS preflight (<code>OPTIONS<\/code>) requests pass through, so token logins keep working.<\/li>\n<li><strong>One-click import from Disable REST API<\/strong>: moves your logged-out allowlist and managed roles across.<\/li>\n<li>Lightweight: one file, works on PHP 7.4 and up, no tracking, no external requests, no ads.<\/li>\n<\/ul>\n\n<h4>For developers<\/h4>\n\n<ul>\n<li><code>birim_rest_lock_blocked<\/code> filter: <code>( bool $blocked, string $route, WP_REST_Request $request )<\/code> to override the decision.<\/li>\n<li><code>birim_rest_lock_message<\/code> filter: change the error message.<\/li>\n<\/ul>\n\n<!--section=installation-->\n<ol>\n<li>Install from Plugins &gt; Add New, or upload the <code>birim-rest-lock<\/code> folder to <code>\/wp-content\/plugins\/<\/code>.<\/li>\n<li>Activate the plugin.<\/li>\n<li>Go to Settings &gt; REST Lock to review the routes.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"how%20do%20i%20check%20it%20works%3F\"><h3>How do I check it works?<\/h3><\/dt>\n<dd><p>Open <code>https:\/\/yoursite.com\/wp-json\/wp\/v2\/users<\/code> in your browser. You should get a 401 error. This happens even while you are logged in: WordPress treats a browser visit to <code>\/wp-json\/<\/code> without a security nonce as logged out. The block editor and admin screens send the nonce, so they keep working.<\/p><\/dd>\n<dt id=\"a%20plugin%20stopped%20working%20for%20visitors.\"><h3>A plugin stopped working for visitors.<\/h3><\/dt>\n<dd><p>That plugin calls the REST API for logged-out visitors. Settings &gt; REST Lock lists the namespaces on your site. Add the plugin's namespace (for example <code>\/my-plugin\/v1<\/code>) to the allowlist.<\/p><\/dd>\n<dt id=\"does%20it%20block%20apis%20outside%20%2Fwp-json%2F%3F\"><h3>Does it block APIs outside \/wp-json\/?<\/h3><\/dt>\n<dd><p>No. It controls routes registered with the WordPress REST API only.<\/p><\/dd>\n<dt id=\"i%27m%20moving%20from%20disable%20rest%20api.\"><h3>I'm moving from Disable REST API.<\/h3><\/dt>\n<dd><p>Activate REST Lock and open Settings &gt; REST Lock. Click \"Import from Disable REST API\", review the result, then deactivate Disable REST API. The import copies the logged-out allowlist and turns roles you managed there into restricted roles. Per-role route lists are not copied; restricted roles share the logged-out rules.<\/p><\/dd>\n<dt id=\"will%20it%20break%20the%20block%20editor%3F\"><h3>Will it break the block editor?<\/h3><\/dt>\n<dd><p>No. Administrators are never blocked, and other logged-in users are only restricted if you choose their role. Do not restrict roles that write posts.<\/p><\/dd>\n<dt id=\"how%20do%20i%20report%20a%20security%20issue%3F\"><h3>How do I report a security issue?<\/h3><\/dt>\n<dd><p>Please email security@birim.one instead of posting in the forum. See https:\/\/birimone.pages.dev\/security\/ for the full policy.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>First release.<\/li>\n<\/ul>","raw_excerpt":"Lock the WordPress REST API for logged-out visitors. Allowlist routes, stop username enumeration, import from Disable REST API.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/395470","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=395470"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/birimone"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=395470"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=395470"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=395470"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=395470"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=395470"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=395470"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}