> ## Documentation Index
> Fetch the complete documentation index at: https://kb.hosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Disabling REST API endpoints in WordPress

> By default, WordPress provides\_several REST API endpoints\_to site resources. This article describes how to restrict the REST API to authenticated users.

This article describes how to disable access to the [WordPress](https://hosting.com/hosting/platforms/wordpress-hosting) [REST](https://en.wikipedia.org/wiki/Representational_state_transfer) API for non-authenticated users.

## What is the REST API?

The [REST API](https://developer.wordpress.org/rest-api/) provides a way for applications to interact with a WordPress site. By using special URLs, applications can send and receive data using the popular [JSON (JavaScript Object Notation)](https://en.wikipedia.org/wiki/JSON) format.

By default, WordPress provides several REST URI endpoints to site resources. However, these REST endpoints are accessible by non-authenticated users. For example, the*users* endpoint provides information about a site's users. For security reasons, you may not want this information to be accessible to everyone.

Disabling the REST API completely, however, breaks WordPress administrative functionality. If you want to disable access to REST API endpoints, you should instead only accept requests from authenticated users.

## Disabling the REST API for non-authenticated users

To disable access to the REST API for non-authenticated users, follow these steps:

1. Log in to WordPress as the administrator.

2. On the Dashboard in the left sidebar, click **Appearance**, and then click **Theme Editor**:\
   ![WordPress - Dashboard - Appearance - Theme Editor](https://static.hosting.com/kb/kb-wordpress-dashboard-appearance-theme-editor.png)

3. In the right sidebar, under **Theme Files**, click **Theme Functions (functions.php)**.

4. Copy the following code snippet and then paste it at the bottom of the *functions.php* file:

```javascript theme={null}
add_filter( 'rest_authentication_errors', function( $result ) {
    if ( true === $result || is _wp_error( $result ) ) {
        return $result;
    }

    if (! is _user_logged_in() ) {
        return new WP_Error(
            'rest_not_logged_in',
            __( 'You are not currently logged in.' ),
            array( 'status' = 401 )
        );
    }

    return $result;
});
```

5. Click **Update File**. WordPress saves the changes to the *functions.php* file.

6. The REST API is now disabled for non-authenticated users. To test this, use your web browser to go to *[https://example.com/wp-json/wp/v2](https://example.com/wp-json/wp/v2)*, where ***example.com*** represents your domain name. If you are not logged in, you receive the "You are not currently logged in" message. If you are logged in, a large set of [JSON](https://en.wikipedia.org/wiki/JSON) output appears.

## More information

For more information about the REST API in WordPress, please visit [https://developer.wordpress.org/rest-api](https://developer.wordpress.org/rest-api).

## Related articles

* [WordPress security](/docs/wordpress-security)

* [Adding CAPTCHA protection to a WordPress site](/docs/adding-captcha-protection-to-a-wordpress-site)

* [Debugging WordPress](/docs/debugging-wordpress)

* [Disabling plugins in WordPress](/docs/disabling-plugins-in-wordpress)

* [Enabling HTTPS and SSL for WordPress sites](/docs/enabling-https-and-ssl-for-wordpress-sites)