Skip to content
StaleWP

Replace now Radar no. 04 · Quiet

Disable REST API

By Dave McHale

What it does: Restricts who can use the WordPress REST API, by user role.

Why it’s listed: It controls who can reach the WordPress REST API, and it has had no update for over three years. It is tested only up to WordPress 6.3. The block editor and many plugins rely on the REST API, so test logged-in and logged-out pages after any change to its rules.

View on WordPress.org ↗ Checked Reviewed by Abhishek Deshpande

Active installs
80k+
Last updated
2023-09-14
Tested up to
6.3.14
Rating
4.8 / 5 (38)
Version
1.8
Maintainers
2

Is Disable REST API still maintained?

It has gone over two years without an update, and it has a second warning sign: controls API access.

Quiet: No update for over a year.

Placements are our opinion, based on public evidence. Risk here means a plugin may not get a fix if a problem appears. It doesn’t mean we found a flaw, unless we show an advisory. Going quiet alone never puts a plugin in Replace now.

Updates No release since 2023-09-14. That was 3 yr 2 mo before our check. WordPress.org plugin directory · checked 2026-10-31
Compatibility Tested up to WordPress 6.3.14. WordPress 7.1.4 was current on 2026-10-31. WordPress.org plugin directory · checked 2026-10-31
Security No public advisories found. A quiet record is not proof of safety. wpvulnerability.net · checked 2026-10-31
Reviews The latest 10 reviews average 4.6 stars, against 4.8 overall. 1 of them gave 1 or 2 stars. Newest activity: 2024-08-19. We see no negative trend. WordPress.org reviews · checked 2026-10-31
Maintainers 2 listed contributors. 0 of 1 recent support threads are marked resolved. WordPress.org plugin directory · checked 2026-10-31
Usage 7,855 downloads in the last 30 days, including updates. 83.76% of sites run version 1.8. WordPress.org stats · checked 2026-10-31

What to do next

  1. Back up the site, and use a staging copy for any change.
  2. Check which REST routes you need to restrict, then try one of the alternatives below.

If it works today, no need to panic, but don’t leave this for long.

Recommended alternatives to Disable REST API

Disable WP REST API ↗

Restrict REST API access.

30k+ installs · 4.8 stars · Updated 2026-08-10 · Tested 7.1.4

JWT Authentication for WP REST APIs ↗

Require authentication for API access.

10k+ installs · 4.4 stars · Updated 2026-10-09 · Tested 7.1.4

Admin and Site Enhancements ↗

A toolkit with REST API settings.

200k+ installs · 5.0 stars · Updated 2026-10-26 · Tested 7.1.4

Each listed plugin was updated in the last six months, is tested with WordPress 7.0 or newer, and had no open advisory in WPVulnerability when we checked. We have not tried them ourselves. No one pays to appear here.

Latest reviews

Dates show last activity. Titles are written by WordPress.org users.

Also on this radar: REST API

No one can pay to appear on the radar or to change a placement. How we stay independent

Something wrong, or updated since we checked? Suggest a correction

StaleWP Newsletter

What changed in the plugin directory, twice a month. Free, unsubscribe anytime.

See how we handle your email on our Legal page.