REST API Security Landscape
The WordPress REST API is powerful — and dangerous if misconfigured. Thousands of sites expose sensitive data (user emails, post drafts, internal metadata) through unprotected endpoints.
Issue 1: Unauthenticated Exposure
By default, REST API exposes:
- User lists (via /wp-json/wp/v2/users)
- Post content and metadata
- Plugin information
Disable public user enumeration. In wp-config.php:
add_filter('rest_endpoints', function($endpoints) { if(isset($endpoints['/wp/v2/users'])) unset($endpoints['/wp/v2/users']); return $endpoints; });
Issue 2: Missing Authentication
Only authenticated requests should modify content. Use JWT tokens or application passwords:
wp_create_application_password(1, 'API Client', array('read', 'create', 'edit', 'delete'));
Return token. Client sends token in Authorization header on every request.
Issue 3: CORS Misconfiguration
Headless sites often set overly permissive CORS:
add_filter('rest_authentication_errors', function() { return new WP_Error('forbidden', 'CORS blocked'); }, 10);
Whitelist specific origins, not wildcard *.
Issue 4: Rate Limiting Absent
Attackers brute-force endpoints. Add rate limiting:
wp-limit-login-attempts (popular plugin) + define('WP_REST_LIMIT', 60); // 60 requests per minute
Issue 5: Sensitive Metadata Exposed
Post meta, user meta, option fields leak private data. Check what’s in the REST response:
register_post_type('post', array('show_in_rest' => true, 'rest_base' => 'posts', 'rest_controller_class' => 'WP_REST_Posts_Controller',));
Use 'show_in_rest' => false for sensitive custom post types.
Security Checklist
✓ Use JWT tokens or app passwords
✓ Disable user enumeration
✓ Whitelist CORS origins
✓ Enable rate limiting
✓ Audit exposed metadata
✓ Monitor /wp-json for suspicious requests
✓ Keep WordPress core and plugins updated
Monitoring
Log REST API access. Alert on repeated 401s or suspicious patterns. Use Wordfence REST API monitoring or custom logging in functions.php.