REST Pro Tools is the paid version for administrators who need more control over the WordPress REST API. Its settings determine which routes and data are available, how restricted requests respond, and which REST signals appear in site output. The access model can allow normal operation for logged-in, authenticated visitors while restricting unauthenticated access.

Route access and exceptions

• Disable all REST API routes with one setting.
• Disable all user routes under the /users endpoint, or disable specific user routes based on role.
• Whitelist user IDs or IP addresses for selected exceptions.

These rules depend on the access model the site needs. A broad restriction can be paired with exceptions for specified users or network addresses.

Responses, transport, and REST signals

For restricted requests, configure the error message and response code. The plugin can require or force SSL/TLS and disable JSONP behavior. Administrators can also disable REST API headers with one setting, disable the REST header in HTTP responses, and remove REST links from the HTML head for all users. An at-a-glance status view shows the current REST API state.

Metadata and additional routes

REST Pro Tools can add post metadata and user metadata to the API. It can also add routes for site profiles and author profiles, featured images and post categories, and post taxonomies and terms. Enable these settings when a connected workflow or WordPress project needs the selected information through REST routes.

Configure and check the API

1. Install and activate REST Pro Tools from the WordPress administration area, then open its settings.
2. Review the REST API status and choose the access model the site requires.
3. Disable routes, user routes, headers, JSONP, or other REST elements as needed.
4. Add role rules, user ID exceptions, or IP address whitelists where appropriate.
5. Set restricted response details, SSL/TLS requirements, metadata, and additional routes.
6. Save the settings and test authenticated and unauthenticated requests to check the intended behavior.

Before restricting access, confirm that the site does not depend on REST API access for users who are not logged in.