Back to DK Home
June 05, 2026Digitized Kosmos Security
How to Secure Your WordPress REST API
Default WordPress REST APIs are completely public, allowing anyone to scrape your entire user database, media metadata, and post archives. Hardening is crucial.
1. Implement CORS Whitelisting
Allow API calls only from your verified production domain names. Block requests originating from unauthorized staging branches, curl scripts, or API testing tools.
2. Obfuscate API Namespaces
Alter the default /wp-json/wp/v2 prefix to a custom, private route. This stops automated vulnerability bots from scanning your endpoint configurations.
add_filter( 'rest_url_prefix', function() {
return 'secure-gateway/api';
});3. Restricting Default User Routes
WordPress natively exposes a list of administrative usernames under /wp-json/wp/v2/users. DK disables this endpoint completely to prevent brute-force login attacks.