Take control of the WordPress REST API
REST Pro Tools is the paid version for managing the WordPress REST API with more control than a simple logged-out visitor restriction. It is designed for site administrators who need to define how REST routes, responses, headers, and selected data behave across a WordPress site.
The underlying REST API access model can continue to allow normal operation for logged-in, authenticated users while restricting unauthenticated access. REST Pro Tools also adds controls for handling routes, users, IP addresses, response details, security transport, and REST-related output.
Route and access controls
- Disable all routes with a one-click setting.
- Disable all user routes under the /users endpoint.
- Disable specific user routes based on role for more targeted access management.
- Whitelist user IDs when selected users should remain permitted.
- Whitelist IP addresses for controlled exceptions.
These options are useful when a site needs a broad REST restriction but still requires carefully defined exceptions for particular users or network addresses.
Response, transport, and header settings
REST Pro Tools lets administrators customize the REST error message and response code returned when access is restricted. This can make REST responses more suitable for the site’s operating requirements. The plugin can also always require or force SSL/TLS and disable JSONP behavior.
Additional controls can disable REST API headers with one click. The plugin also supports disabling the REST header in HTTP responses and removing REST links from the HTML head for all users. An at-a-glance status view helps administrators check the current REST API state.
Extend REST data and routes
REST Pro Tools can add post metadata and user metadata to the REST API. It can also add routes for site profiles and author profiles, featured images and post categories, and post taxonomies and terms. These options are useful when a connected workflow or WordPress project needs selected information exposed through REST routes.
Use these capabilities to shape the REST API around a site’s needs instead of applying only one global rule. For example, an administrator might restrict user routes, permit selected IDs or IP addresses, customize the response shown to blocked requests, and add specific content-related routes.
Practical workflow
- Install and activate REST Pro Tools in WordPress.
- Review the REST API status and choose the access model required for the site.
- Disable routes, user routes, headers, JSONP, or other REST elements as needed.
- Add role rules, user ID exceptions, or IP address whitelists where appropriate.
- Configure response details, SSL/TLS requirements, metadata, and additional routes.
- Test authenticated and unauthenticated requests to confirm the intended behavior.
Installation
From the WordPress administration area, install the REST Pro Tools plugin, activate it, and open its settings. Configure the available REST API controls, save the settings, and check the API status. Before restricting access, confirm that the site does not require REST API access for non-logged-in visitors.
