- Article
- Intermediate
- 2 minutes read
- Reviewed August 4, 2026
The WordPress REST API exposes structured endpoints used by the Block Editor, plugins, integrations and external applications.
Public WordPress content is often intentionally public through the API. Security means enforcing the correct visibility and permissions, not disabling the API indiscriminately.
Authentication and Authorization
Authentication identifies the requester.
Authorization determines whether that identity can perform the requested action.
A custom route should use a permission_callback and check capabilities or ownership appropriate to the resource.
Checking only whether a user is logged in is often too broad.
Public Endpoints
A deliberately public route can use a permission callback that returns true.
Confirm that its response contains only information intended for every visitor.
Validate Route Arguments
Define argument schemas and use validation and sanitization callbacks.
Validate IDs, enumeration values, dates, URLs and nested structures before processing.
Limit Response Data
Do not expose secrets, private metadata, internal notes or unnecessary personal information.
Review registered fields and custom post type REST settings.
Nonces and Application Passwords
Browser-based authenticated requests commonly use a REST nonce with the current WordPress session.
External applications can use revocable application passwords or another supported authentication method over HTTPS.
Rate and Resource Protection
Expensive public routes can be abused even when they expose no private data.
Use pagination, limits, caching, infrastructure rate controls and efficient queries.
Error Responses
Return useful errors without exposing stack traces, SQL, credentials or internal paths.
Frequently Asked Questions
Should the REST API be disabled?
WordPress administration and plugins depend on it. Restrict sensitive routes rather than disabling the complete API blindly.
Does a REST nonce authorize the request?
No. The endpoint must still check capabilities.
Continue Learning
Previous: [Securing WordPress File Uploads](/resources/wordpress-manual/security/securing-file-uploads/)
Next: [Preventing Brute-Force Attacks](/resources/wordpress-manual/security/preventing-brute-force-attacks/)