Birim REST Lock – Disable REST API & Stop User Enumeration
| 开发者 | birimone |
|---|---|
| 更新时间 | 2026年11月4日 04:23 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
/wp-json/. Anyone can list your users, your installed plugins' endpoints and your content. Birim REST Lock closes it without breaking your site.
- Allowlist mode (default): block every route except the ones you list.
- Blocklist mode: allow every route except the ones you list.
- Wildcards:
/wp/v2/posts*covers/wp/v2/postsand/wp/v2/posts/123. - Role rules: apply the same rules to logged-in roles you choose, such as subscribers or customers. Administrators are never blocked.
- Stop username enumeration: always block
/wp/v2/users. - Hide what you run: block the route index and namespace listings, and remove REST links from page HTML, the
Linkheader and RSD. - Safe defaults: Contact Form 7, WooCommerce block checkout, oEmbed and Jetpack routes are allowed out of the box. CORS preflight (
OPTIONS) requests pass through, so token logins keep working. - One-click import from Disable REST API: moves your logged-out allowlist and managed roles across.
- Lightweight: one file, works on PHP 7.4 and up, no tracking, no external requests, no ads.
birim_rest_lock_blockedfilter:( bool $blocked, string $route, WP_REST_Request $request )to override the decision.birim_rest_lock_messagefilter: change the error message.
安装:
- Install from Plugins > Add New, or upload the
birim-rest-lockfolder to/wp-content/plugins/. - Activate the plugin.
- Go to Settings > REST Lock to review the routes.
常见问题:
How do I check it works?
Open https://yoursite.com/wp-json/wp/v2/users in your browser. You should get a 401 error. This happens even while you are logged in: WordPress treats a browser visit to /wp-json/ without a security nonce as logged out. The block editor and admin screens send the nonce, so they keep working.
A plugin stopped working for visitors.
That plugin calls the REST API for logged-out visitors. Settings > REST Lock lists the namespaces on your site. Add the plugin's namespace (for example /my-plugin/v1) to the allowlist.
Does it block APIs outside /wp-json/?
No. It controls routes registered with the WordPress REST API only.
I'm moving from Disable REST API.
Activate REST Lock and open Settings > REST Lock. Click "Import from Disable REST API", review the result, then deactivate Disable REST API. The import copies the logged-out allowlist and turns roles you managed there into restricted roles. Per-role route lists are not copied; restricted roles share the logged-out rules.
Will it break the block editor?
No. Administrators are never blocked, and other logged-in users are only restricted if you choose their role. Do not restrict roles that write posts.
How do I report a security issue?
Please email security@birim.one instead of posting in the forum. See https://birimone.pages.dev/security/ for the full policy.
更新日志:
- First release.