Beginner's Guide for WordPress - Start your WordPress Blog in minutes.
Choosing the Best
WordPress Hosting
How to Easily
Install WordPress
WordPress Plugins
View all Guides

How to Disable JSON REST API in WordPress

Last updated on by
Special WordPress Hosting offer for WPBeginner Readers
How to Disable JSON REST API in WordPress

WordPress 4.4 added the much anticipated JSON REST API. It is great for plugin developers, but many site owners may not find it useful at all. In this article, we will show you how to easily disable the JSON REST API in WordPress.

Disable JSON REST API in WordPress

Why You Need to Disable JSON REST API in WordPress?

There is no denying that the API will bring lots of benefits for WordPress developers. However, some website owners may not be using those features at all. The API makes it super easy to retrieve data using GET requests. This is extremely useful for those building apps with WordPress.

Having that said, this could potentially open your website to a new front of DDoS attacks. It can be resource intensive and slow down your website.

It is similar to disabling XML-RPC, which many site admins disable on their WordPress sites just to be on the safe side.

Disabling JSON REST API in WordPress

If you want to disable JSON REST API on your WordPress site, then you can easily do so by simply adding the following code in your theme’s functions.php or in a site-specific plugin.

add_filter('json_enabled', '__return_false');
add_filter('json_jsonp_enabled', '__return_false');

This code simply uses the built-in filters to disable the JSON and JSONP APIs.

For those of you who don’t want to manually add the code, you can install and activate the Disable JSON API plugin. The plugin works out of the box, and there are no settings for you to configure. Simply activating the plugin will disable the API on your site.

We hope this article helped you learn how to Disable JSON API in WordPress. Security conscious users may also want to checkout these tips on protecting WordPress admin area.

If you liked this article, then please subscribe to our YouTube Channel for WordPress video tutorials. You can also find us on Twitter and Google+.

Editorial Staff at WPBeginner is a team of WordPress experts led by Syed Balkhi. Page maintained by Syed Balkhi.

WPBeginner's Video Icon
Our HD-Quality tutorial videos for WordPress Beginners will teach you how to use WordPress to create and manage your own website in about an hour. Get started now »


  1. Andrew says:

    When I check the speed of my site using, the first html entry that tried to load shows the link as and it has over 2 seconds of “wait” time. Is this the same as what this article is talking about? I’m hesitant to simply disable it since I would assume it will be used in the future. Any idea why it would add a 2+ second delay to loading anything on the page?

  2. Stephen Cronin says:

    Hmm, the REST API is going to become the standard way for plugins and themes to make Ajax calls back to the server from the front end, replacing admin-ajax, so I wouldn’t be disabling it… Hopefully they will fail gracefully, but you will almost end up missing some functionality.

    Also, if you really want to protect against DDoS attacks, you better disable html as well! ;)

  3. Kasey says:

    How likely is it that a plugin will be using this functionality. Just for example would contact forms be utilizing this? Not keen on turning it off in case it breaks anything.

    • WPBeginner Support says:

      The plugins will most likely notify you if they will be using it and you have it turned off.

Add a Comment

We're glad you have chosen to leave a comment. Please keep in mind that all comments are moderated according to our comment policy, and all links are nofollow. Do NOT use keywords in the name field. Let's have a personal and meaningful conversation.