The WordPress REST API is public by default and shares a good deal of information about your site with anyone who asks. REST API Guard makes it easy to decide who can see what.<\/p>\n\n
Out of the box, the plugin:<\/p>\n\n
\/wp\/v2\/users<\/code>) so usernames aren't exposed.<\/li>\n- Blocks anonymous access to the REST API index (
\/<\/code>) and namespace endpoints (\/wp\/v2<\/code>) so visitors can't list your plugins and post types.<\/li>\n<\/ul>\n\nIt can also:<\/p>\n\n
\n- Block all anonymous access to the REST API.<\/li>\n
- Allow anonymous access only to specific routes (allowlist), or block specific routes (denylist).<\/li>\n
- Require anonymous requests to include a JSON Web Token (JWT).<\/li>\n
- Let users authenticate with a JWT tied to their account.<\/li>\n
- Generate, list, and revoke tokens from the settings page or WP-CLI.<\/li>\n<\/ul>\n\n
Every option is available on the settings page (Settings \u2192 REST API Guard) and as a filter for configuring the plugin in code. A setting controlled by a filter is shown as read-only on the settings page.<\/p>\n\n
Restrict access to user information<\/h4>\n\n
Anonymous access to \/wp\/v2\/users<\/code> is blocked by default. To allow it:<\/p>\n\nadd_filter( 'rest_api_guard_allow_user_access', '__return_true' );\n<\/code><\/pre>\n\nRestrict access to the index and namespace endpoints<\/h4>\n\n
Anonymous access to the index (\/<\/code>) and namespace (\/wp\/v2<\/code>) endpoints is blocked by default. To allow it:<\/p>\n\nadd_filter( 'rest_api_guard_allow_index_access', '__return_true' );\nadd_filter( 'rest_api_guard_allow_namespace_access', '__return_true' );\n<\/code><\/pre>\n\nBlock all anonymous access<\/h4>\n\nadd_filter( 'rest_api_guard_prevent_anonymous_access', '__return_true' );\n<\/code><\/pre>\n\nAllow anonymous access to specific routes (allowlist)<\/h4>\n\n
When an allowlist is set, anonymous requests to any route not on the list are denied. The allowlist takes priority over the denylist. Use *<\/code> as a wildcard.<\/p>\n\nadd_filter(\n 'rest_api_guard_anonymous_requests_allowlist',\n fn () => [\n '\/wp\/v2\/posts*',\n '\/custom-namespace\/v1\/public\/*',\n ]\n);\n<\/code><\/pre>\n\nDeny anonymous access to specific routes (denylist)<\/h4>\n\n
Anonymous requests to routes on the denylist are denied. All other routes are allowed. Use *<\/code> as a wildcard.<\/p>\n\nadd_filter(\n 'rest_api_guard_anonymous_requests_denylist',\n fn () => [\n '\/wp\/v2\/comments*',\n '\/custom-namespace\/v1\/private\/*',\n ]\n);\n<\/code><\/pre>\n\nRequire a JSON Web Token (JWT) for anonymous requests<\/h4>\n\n
Anonymous requests can be required to send a token in an Authorization: Bearer <token><\/code> header:<\/p>\n\nadd_filter( 'rest_api_guard_authentication_jwt', '__return_true' );\n<\/code><\/pre>\n\nTokens are expected to have an audience of wordpress-rest-api<\/code> and an issuer of the site URL. Both can be changed:<\/p>\n\nadd_filter( 'rest_api_guard_jwt_audience', fn () => 'custom-audience' );\nadd_filter( 'rest_api_guard_jwt_issuer', fn () => 'https:\/\/example.com' );\n<\/code><\/pre>\n\nTokens are signed with a secret generated automatically and stored in the rest_api_guard_jwt_secret<\/code> option. It can also be set in code:<\/p>\n\nadd_filter( 'rest_api_guard_jwt_secret', fn () => 'my-custom-secret' );\n<\/code><\/pre>\n\nAuthenticate users with a JWT<\/h4>\n\n
Tokens can also be tied to a user. A request with a user token is treated as that user, with the same permissions they have:<\/p>\n\n
add_filter( 'rest_api_guard_user_authentication_jwt', '__return_true' );\n<\/code><\/pre>\n\nGenerate, list, and revoke tokens<\/h4>\n\n
Once JWT authentication is enabled, tokens can be generated from the Tokens tab of the settings page. Give each one a name so you can tell them apart later, and optionally tie it to a user or set an expiration. The token is shown once after it's generated, so copy it somewhere safe.<\/p>\n\n
The same tab lists every token the plugin has issued, and any of them can be revoked. A revoked token stops working right away.<\/p>\n\n
Tokens can also be managed with WP-CLI:<\/p>\n\n
wp rest-api-guard generate-jwt [--name=<name>] [--user=<user-id>] [--expiration=<seconds>]\nwp rest-api-guard list-jwts\nwp rest-api-guard revoke-jwt <id>\n<\/code><\/pre>\n\nOr generated in code:<\/p>\n\n
$token = \\Alley\\WP\\REST_API_Guard\\generate_jwt(\n expiration: HOUR_IN_SECONDS, \/\/ Optional. Seconds until the token expires.\n user: 1, \/\/ Optional. A user ID or WP_User.\n name: 'Mobile App', \/\/ Optional. A name to identify the token by.\n);\n<\/code><\/pre>\n\nTokens issued before version 1.5.0 aren't tracked, so they can't be listed or revoked one at a time. They're still accepted by default. To reject them:<\/p>\n\n
add_filter( 'rest_api_guard_allow_untracked_jwt', '__return_false' );\n<\/code><\/pre>\n\nChanging the rest_api_guard_jwt_secret<\/code> option invalidates every token issued so far, tracked or not.<\/p>\n\nCaching<\/h4>\n\n
Responses to REST API requests that include an Authorization<\/code> header are sent with no-cache headers so a page cache or CDN doesn't store them.<\/p>\n\n\n\n- Install the plugin from the Plugins \u2192 Add New screen, or upload it to the
\/wp-content\/plugins\/<\/code> directory.<\/li>\n- Activate the plugin from the Plugins screen.<\/li>\n
- Configure it from Settings \u2192 REST API Guard.<\/li>\n<\/ol>\n\n
The plugin can also be installed with Composer:<\/p>\n\n
composer require alleyinteractive\/wp-rest-api-guard\n<\/code><\/pre>\n\n\n\nDoes this affect logged-in users?<\/h3><\/dt>\nNo. The restrictions only apply to anonymous requests. Logged-in users have the same REST API access WordPress normally gives them.<\/p><\/dd>\n
Why does the block editor still work?<\/h3><\/dt>\nThe block editor makes REST API requests as the logged-in user, so it isn't affected by the anonymous access rules.<\/p><\/dd>\n
Can I hide the settings page?<\/h3><\/dt>\nYes. Configure the plugin in code and disable the settings page:<\/p>\n\n
add_filter( 'rest_api_guard_disable_admin_settings', '__return_true' );\n<\/code><\/pre><\/dd>\nAre OPTIONS requests checked?<\/h3><\/dt>\nNot by default, since browsers send them as CORS preflight requests without credentials. To check them too:<\/p>\n\n
add_filter( 'rest_api_guard_check_options_requests', '__return_true' );\n<\/code><\/pre><\/dd>\n\n<\/dl>\n\n\n1.5.0<\/h4>\n\n\n- Track issued JWTs and allow them to be revoked from the settings page or WP-CLI.<\/li>\n
- Add a Tokens tab to the settings page to generate, list, and revoke JWTs when JWT authentication is enabled.<\/li>\n
- Add the
rest_api_guard_allow_untracked_jwt<\/code> filter to reject JWTs issued before tracking.<\/li>\n- Send no-cache headers on REST API requests that include an
Authorization<\/code> header.<\/li>\n<\/ul>\n\n1.4.2<\/h4>\n\n\n- Prevent mixed-case REST API routes from bypassing anonymous access restrictions.<\/li>\n
- Add support for WordPress 7.1.<\/li>\n
- Require PHP 8.3+.<\/li>\n
- Update
firebase\/php-jwt<\/code> to version 7.<\/li>\n<\/ul>\n\n1.4.1<\/h4>\n\n\n- No changes, release to trigger deployment to WordPress.org.<\/li>\n<\/ul>\n\n
1.4.0<\/h4>\n\n\n- Add support for WordPress 6.8.<\/li>\n
- Require PHP 8.1+.<\/li>\n<\/ul>\n\n
1.3.1<\/h4>\n\n\n- Ignore JWT authentication for the REST API if the user is already authenticated.<\/li>\n<\/ul>\n\n
1.3.0<\/h4>\n\n\n- Allow claims to be added to a generated JWT via filter.<\/li>\n
- Don't check
OPTIONS<\/code> requests by default.<\/li>\n<\/ul>\n\n1.2.0<\/h4>\n\n\n- Add support for authenticated users interacting with the REST API.<\/li>\n
- Allow settings to be completely disabled via code.<\/li>\n
- Increase the default length of the JWT secret to 32 characters.<\/li>\n<\/ul>\n\n
1.1.0<\/h4>\n\n