1. Overview
The discussion focuses on whether the WordPress REST API should be disabled or restricted for security reasons, and what the real risks actually are.
2. Key Conclusion
The REST API is **not inherently insecure**. It is a core WordPress component and is widely used by:
* The block (Gutenberg) editor
* Themes and plugins
* Mobile and headless WordPress setups
Disabling it entirely is generally **not recommended**.
3. Security Reality
What is safe by default
* Public endpoints only expose public content (posts, pages, etc.)
* Sensitive actions require authentication + permissions
#### What actually causes issues
* Poorly written plugins exposing insecure custom endpoints
* Missing permission checks in custom code
* Weak authentication setups
4. Recommended Security Approach
Instead of disabling the REST API:
Keep WordPress secure
* Always update WordPress core, plugins, and themes
* Use trusted plugins only
Restrict access intelligently
* Limit or remove unused endpoints
* Ensure sensitive endpoints require authentication
Add security layers
* Web Application Firewall (WAF)
* Rate limiting / brute-force protection
* Security plugins (monitoring + blocking suspicious requests)
Audit exposure
* Check `/wp-json` to see what is publicly accessible
5. Authentication Methods (for protected endpoints)
* WordPress cookies + nonces (for logged-in users)
* Application passwords
* OAuth / token-based methods (advanced setups)
6. Practical Recommendation
* **Do NOT disable REST API globally**
* Instead:
* Harden authentication
* Restrict unnecessary endpoints
* Secure plugins and custom code
* Add firewall + monitoring
7. Bottom Line
The REST API is a **neutral tool**—its security depends entirely on:
* Configuration
* Plugins
* Custom development quality
Disabling it often breaks functionality without meaningfully improving security.