Route rules control REST API access

REST Pro Tools gives WordPress administrators settings for REST API routes, responses, headers, and selected data. Its access model can allow normal operation for logged-in, authenticated visitors while restricting unauthenticated access. Before applying restrictions, check whether the site needs REST API access for non-logged-in users.

• Disable all REST API routes with a one-click setting.
• Disable all user routes under the /users endpoint.
• Disable specific user routes based on role.
• Whitelist user IDs or IP addresses for selected exceptions.

These controls let administrators apply broad restrictions while permitting access for particular users or network addresses.

Response and transport settings shape blocked requests

Set the error message and response code returned when access is restricted. REST Pro Tools can also require or force SSL/TLS and disable JSONP behavior.

Header controls change REST API signals

Administrators can disable REST API headers with one click. Other settings disable the REST header in HTTP responses and remove REST links from the HTML head for all users. An at-a-glance status view shows the current REST API state.

Metadata and added routes expose selected data

The plugin can add post metadata and user metadata to the REST API. It can also add routes for website profiles and author profiles, featured images and post categories, and post taxonomies and terms. These settings support connected processes and WordPress projects that need selected information available through REST routes.

Configuration and verification keep changes deliberate

1. Install and activate REST Pro Tools in WordPress, then open its settings.
2. Review the REST API status and select the access model required for the site.
3. Disable routes, user routes, headers, JSONP, or other REST elements as needed.
4. Add role rules, user ID exceptions, or IP address whitelists where appropriate.
5. Configure response details, SSL/TLS requirements, metadata, and additional routes; save the settings and check the API status.
6. Test authenticated and unauthenticated requests to confirm the intended behavior.