Restrict REST API
Requires authentication for REST API requests, so the endpoints that list users and content are no longer readable by anyone who asks.
What it does
Makes the API ask who is calling
Restrict REST API is a Vectro security feature that returns a 401 response to REST API requests from unauthenticated visitors, closing endpoints that otherwise expose your WordPress user list and content structure.
The WordPress REST API is enabled by default and several of its endpoints answer without any authentication. /wp-json/wp/v2/users is the one people notice first: on many sites it returns a JSON list of accounts, including display names and slugs.
This feature returns a 401 for REST requests from visitors who are not logged in. Authenticated requests continue to work exactly as before.
Check what you are running before you enable it. Some page builders, form plugins and front-end features call the REST API from the browser as an anonymous visitor, and those calls will start failing.
Why it matters
It is the same username leak, in JSON
Author enumeration through ?author=N is well known, so many people block it and consider the matter closed. The users endpoint gives an attacker the same information in a cleaner format, often in a single request, and it is frequently left open on sites that have otherwise been hardened.
Beyond usernames, an open REST API can expose draft-adjacent metadata, content structure, and details about installed plugins that make targeted attacks easier to plan. If nothing on your public site needs anonymous API access, requiring authentication removes the whole surface at once.
How to use it
Enable, then test your public pages
Technical detail
Where the check happens
Vectro hooks the REST authentication filter, which WordPress evaluates before dispatching any route. If the request has no authenticated user, Vectro returns a 401 error and the route is never executed.
Because the check runs at the authentication stage rather than per route, it covers custom endpoints registered by other plugins as well as core ones. That breadth is what makes testing your public pages worthwhile.
401 Unauthorized for requests with no authenticated user.Compatibility
Runs alongside everything
No conflicts detected. Vectro runs this feature regardless of other plugins active.
Questions
Frequently asked
What does restricting the WordPress REST API do?
Restricting the REST API returns a 401 response to any REST request from a visitor who is not logged in. This closes endpoints such as /wp-json/wp/v2/users, which otherwise returns a list of accounts to anyone who asks.
Does restricting the REST API work with page builders?
It can break them, because some page builders, form plugins and front-end features call the REST API as an anonymous visitor. Test your public pages logged out after enabling and turn the feature off if something stops working.
How do I restrict the REST API in Vectro?
Go to Vectro > Security in wp-admin and toggle Restrict REST API on. Then test your site in a private window, exercising forms, search and any interactive feature, because those are what break if they rely on anonymous API access.
Is restricting the REST API in Vectro free or Pro?
Yes, Restricting the REST API is free. It is included in the free Vectro plugin on WordPress.org with no account required.
Does restricting the REST API break the WordPress block editor?
No – the block editor sends authenticated requests, so it continues to work exactly as before. Only requests from visitors who are not logged in receive a 401.
Related features
Close the related data leaks
Vectro Pro adds IP blocklist and country blocking for more granular access control. See Pro plans
Download Vectro free on WordPress.org
27 features across Security, Performance and Maintenance. No account required, no expiry, unlimited sites.