REST Pro Tools

Choose an access model before restricting routes

REST Pro Tools is the paid version for administrators who need to manage WordPress REST API routes, responses, headers, and selected data. Its access model can allow normal operation for logged-in, authenticated customers while restricting unauthenticated access. Check first whether the site or its connected processes need REST API access for users who are not logged in.

Set route rules and exceptions

• Disable all REST API routes with a one-click setting.
• Disable all visitor routes under the /users endpoint.
• Disable specific user routes based on role.
• Whitelist user IDs or IP addresses for selected exceptions.

These settings can apply a broad restriction while preserving access for specified users or network addresses. Review which routes the site depends on before disabling them.

Configure restricted responses and API behavior

Set the error message and response code returned when access is restricted. REST Pro Tools can require or force SSL/TLS, disable JSONP, and disable REST API headers with a one-click setting. You can also disable the REST header in HTTP responses and remove REST links from the HTML head for all users. An at-a-glance status view shows the current REST API state.

Add selected data and routes

The plugin can add post metadata and user metadata to the REST API. It can also add routes for site profiles, author profiles, featured pictures, post categories, post taxonomies, and terms. Enable the data and routes that a connected workflow or WordPress project needs.

Configure and check the result

1. Install and activate REST Pro Tools in WordPress, then open its settings.
2. Review the REST API status and choose the access model for the site.
3. Disable routes, user routes, headers, JSONP, or other REST components as needed.
4. Add role rules, user ID exceptions, or IP address whitelists where appropriate.
5. Configure restricted response details, SSL/TLS requirements, metadata, and additional routes.
6. Save the settings and test authenticated and unauthenticated requests to confirm the intended behavior.