{"id":37671,"date":"2025-05-30T01:17:57","date_gmt":"2025-05-30T01:17:57","guid":{"rendered":"https:\/\/www.wpstaq.com\/?post_type=knowledgebase&#038;p=37671"},"modified":"2025-05-31T03:56:42","modified_gmt":"2025-05-31T03:56:42","slug":"unblocking-wordpress-rest-api-access","status":"publish","type":"knowledgebase","link":"https:\/\/www.wpstaq.com\/sg\/knowledgebase\/unblocking-wordpress-rest-api-access\/","title":{"rendered":"Unblocking WordPress REST API Access"},"content":{"rendered":"<p>Staq automatically restricts public access to sensitive REST API endpoints \u2014 particularly the <code>\/wp-json\/wp\/v2\/users\/<\/code> endpoint.<\/p>\n<p>Since this endpoint is blocked automatically out of the box, it prevents bots or unauthenticated users to enumerate the list of all WordPress users on a site.<\/p>\n<p>This is part of our commitment to hardening your WordPress sites by default, reducing attack surfaces without requiring any manual setup.<\/p>\n<h2><strong>What Does This Do?<\/strong><\/h2>\n<p>By default, any unauthenticated request to <code>\/wp-json\/wp\/v2\/users\/<\/code> will now return the following error response:<\/p>\n<pre><code>{\r\n  \"code\": \"rest_user_cannot_view\",\r\n  \"message\": \"You are not allowed to access this endpoint.\",\r\n  \"data\": {\r\n    \"status\": 401\r\n  }\r\n}\r\n<\/code><\/pre>\n<p>This prevents bots and scrapers from querying your site to discover usernames \u2014 a common first step in brute-force or credential stuffing attacks.<\/p>\n<h2><strong><br \/>\nHow to enable the user&#8217;s endpoint?<\/strong><\/h2>\n<p>If your application or a certain plugin requires access to this endpoint, it&#8217;s very easy to enable.<\/p>\n<p>To do so, define the following constant in the site\u2019s by going to the site&#8217;s Staq Panel, followed by clicking\u00a0<strong>WP Config File<\/strong>:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-37018\" src=\"https:\/\/www.wpstaq.com\/wp-content\/uploads\/2023\/08\/wp-config-file.png\" alt=\"\" width=\"1124\" height=\"679\" srcset=\"https:\/\/www.wpstaq.com\/wp-content\/uploads\/2023\/08\/wp-config-file.png 1124w, https:\/\/www.wpstaq.com\/wp-content\/uploads\/2023\/08\/wp-config-file-300x181.png 300w, https:\/\/www.wpstaq.com\/wp-content\/uploads\/2023\/08\/wp-config-file-1024x619.png 1024w, https:\/\/www.wpstaq.com\/wp-content\/uploads\/2023\/08\/wp-config-file-768x464.png 768w\" sizes=\"auto, (max-width: 1124px) 100vw, 1124px\" \/><\/p>\n<p>Click\u00a0<strong>Add<\/strong> and enter:<\/p>\n<p><code>ELM_BYPASS_REST_API_PROTECTION<\/code> as the <strong>Name\u00a0<\/strong>and <code>true<\/code>\u00a0as the <strong>Value<\/strong>:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-37672\" src=\"https:\/\/www.wpstaq.com\/wp-content\/uploads\/2025\/05\/rest-api-config.png\" alt=\"\" width=\"832\" height=\"501\" srcset=\"https:\/\/www.wpstaq.com\/wp-content\/uploads\/2025\/05\/rest-api-config.png 832w, https:\/\/www.wpstaq.com\/wp-content\/uploads\/2025\/05\/rest-api-config-300x181.png 300w, https:\/\/www.wpstaq.com\/wp-content\/uploads\/2025\/05\/rest-api-config-768x462.png 768w\" sizes=\"auto, (max-width: 832px) 100vw, 832px\" \/><\/p>\n<p>Click\u00a0<strong>Add<\/strong> and make sure you also click\u00a0<strong>Save<\/strong>.<\/p>\n<p><strong>Important:<\/strong> You cannot modify the <code>wp-config.php<\/code> file via SFTP, as our system will override it for security reasons. Instead, please follow our official guide to edit your config file safely inside the Staq dashboard:\u00a0<a href=\"https:\/\/www.wpstaq.com\/knowledgebase\/how-to-edit-the-wp-config-php-file-on-staq\/\" target=\"_blank\" rel=\"noopener\">How to edit the wp-config.php file on Staq<\/a><\/p>\n<h2><strong>Why This Matters \u2014 The Benefits<\/strong><\/h2>\n<ul>\n<li><strong>Improved Security:<\/strong> Blocks REST API user enumeration attacks \u2014 a known vector for brute-force and phishing attacks.<\/li>\n<li><strong>Less Bot Traffic:<\/strong> Prevents bots from crawling user information that could be used maliciously.<\/li>\n<li><strong>No Plugin Required:<\/strong> This is enabled automatically for every Staq-hosted site \u2014 no additional configuration or third-party plugins needed.<\/li>\n<\/ul>\n<h2><strong>Conclusion<\/strong><\/h2>\n<p>This feature strengthens your website\u2019s default security posture without sacrificing developer flexibility. By protecting critical REST API endpoints by default \u2014 and offering a simple opt-out \u2014 you get the best of both worlds: robust security with total control.<\/p>\n","protected":false},"featured_media":0,"parent":0,"template":"","class_list":["post-37671","knowledgebase","type-knowledgebase","status-publish","hentry","categories-security"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Unblocking WordPress REST API Access - Managed Hosting Platform for WordPress<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wpstaq.com\/knowledgebase\/unblocking-wordpress-rest-api-access\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Unblocking WordPress REST API Access - Managed Hosting Platform for WordPress\" \/>\n<meta property=\"og:description\" content=\"Staq automatically restricts public access to sensitive REST API endpoints \u2014 particularly the \/wp-json\/wp\/v2\/users\/ endpoint. Since this endpoint is blocked automatically out of the box, it prevents bots or unauthenticated users to enumerate the list of all WordPress users on a site. This is part of our commitment to hardening your WordPress sites by default,&hellip;\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wpstaq.com\/knowledgebase\/unblocking-wordpress-rest-api-access\/\" \/>\n<meta property=\"og:site_name\" content=\"Managed Hosting Platform for WordPress\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/staqhosting\/\" \/>\n<meta property=\"article:modified_time\" content=\"2025-05-31T03:56:42+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.wpstaq.com\/wp-content\/uploads\/2023\/08\/wp-config-file.png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.wpstaq.com\\\/knowledgebase\\\/unblocking-wordpress-rest-api-access\\\/\",\"url\":\"https:\\\/\\\/www.wpstaq.com\\\/knowledgebase\\\/unblocking-wordpress-rest-api-access\\\/\",\"name\":\"Unblocking WordPress REST API Access - Managed Hosting Platform for WordPress\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.wpstaq.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.wpstaq.com\\\/knowledgebase\\\/unblocking-wordpress-rest-api-access\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.wpstaq.com\\\/knowledgebase\\\/unblocking-wordpress-rest-api-access\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.wpstaq.com\\\/wp-content\\\/uploads\\\/2023\\\/08\\\/wp-config-file.png\",\"datePublished\":\"2025-05-30T01:17:57+00:00\",\"dateModified\":\"2025-05-31T03:56:42+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.wpstaq.com\\\/knowledgebase\\\/unblocking-wordpress-rest-api-access\\\/#breadcrumb\"},\"inLanguage\":\"en-sg\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.wpstaq.com\\\/knowledgebase\\\/unblocking-wordpress-rest-api-access\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-sg\",\"@id\":\"https:\\\/\\\/www.wpstaq.com\\\/knowledgebase\\\/unblocking-wordpress-rest-api-access\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.wpstaq.com\\\/wp-content\\\/uploads\\\/2023\\\/08\\\/wp-config-file.png\",\"contentUrl\":\"https:\\\/\\\/www.wpstaq.com\\\/wp-content\\\/uploads\\\/2023\\\/08\\\/wp-config-file.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.wpstaq.com\\\/knowledgebase\\\/unblocking-wordpress-rest-api-access\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.wpstaq.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Unblocking WordPress REST API Access\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.wpstaq.com\\\/#website\",\"url\":\"https:\\\/\\\/www.wpstaq.com\\\/\",\"name\":\"Managed Hosting Platform for WordPress\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.wpstaq.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.wpstaq.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-sg\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.wpstaq.com\\\/#organization\",\"name\":\"Staq\",\"alternateName\":\"WPStaq\",\"url\":\"https:\\\/\\\/www.wpstaq.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-sg\",\"@id\":\"https:\\\/\\\/www.wpstaq.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.wpstaq.com\\\/wp-content\\\/uploads\\\/2023\\\/05\\\/cropped-LogoNoText.png\",\"contentUrl\":\"https:\\\/\\\/www.wpstaq.com\\\/wp-content\\\/uploads\\\/2023\\\/05\\\/cropped-LogoNoText.png\",\"width\":512,\"height\":512,\"caption\":\"Staq\"},\"image\":{\"@id\":\"https:\\\/\\\/www.wpstaq.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/staqhosting\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/wpstaq\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Unblocking WordPress REST API Access - Managed Hosting Platform for WordPress","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wpstaq.com\/knowledgebase\/unblocking-wordpress-rest-api-access\/","og_locale":"en_US","og_type":"article","og_title":"Unblocking WordPress REST API Access - Managed Hosting Platform for WordPress","og_description":"Staq automatically restricts public access to sensitive REST API endpoints \u2014 particularly the \/wp-json\/wp\/v2\/users\/ endpoint. Since this endpoint is blocked automatically out of the box, it prevents bots or unauthenticated users to enumerate the list of all WordPress users on a site. This is part of our commitment to hardening your WordPress sites by default,&hellip;","og_url":"https:\/\/www.wpstaq.com\/knowledgebase\/unblocking-wordpress-rest-api-access\/","og_site_name":"Managed Hosting Platform for WordPress","article_publisher":"https:\/\/www.facebook.com\/staqhosting\/","article_modified_time":"2025-05-31T03:56:42+00:00","og_image":[{"url":"https:\/\/www.wpstaq.com\/wp-content\/uploads\/2023\/08\/wp-config-file.png","type":"","width":"","height":""}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wpstaq.com\/knowledgebase\/unblocking-wordpress-rest-api-access\/","url":"https:\/\/www.wpstaq.com\/knowledgebase\/unblocking-wordpress-rest-api-access\/","name":"Unblocking WordPress REST API Access - Managed Hosting Platform for WordPress","isPartOf":{"@id":"https:\/\/www.wpstaq.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.wpstaq.com\/knowledgebase\/unblocking-wordpress-rest-api-access\/#primaryimage"},"image":{"@id":"https:\/\/www.wpstaq.com\/knowledgebase\/unblocking-wordpress-rest-api-access\/#primaryimage"},"thumbnailUrl":"https:\/\/www.wpstaq.com\/wp-content\/uploads\/2023\/08\/wp-config-file.png","datePublished":"2025-05-30T01:17:57+00:00","dateModified":"2025-05-31T03:56:42+00:00","breadcrumb":{"@id":"https:\/\/www.wpstaq.com\/knowledgebase\/unblocking-wordpress-rest-api-access\/#breadcrumb"},"inLanguage":"en-sg","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wpstaq.com\/knowledgebase\/unblocking-wordpress-rest-api-access\/"]}]},{"@type":"ImageObject","inLanguage":"en-sg","@id":"https:\/\/www.wpstaq.com\/knowledgebase\/unblocking-wordpress-rest-api-access\/#primaryimage","url":"https:\/\/www.wpstaq.com\/wp-content\/uploads\/2023\/08\/wp-config-file.png","contentUrl":"https:\/\/www.wpstaq.com\/wp-content\/uploads\/2023\/08\/wp-config-file.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.wpstaq.com\/knowledgebase\/unblocking-wordpress-rest-api-access\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.wpstaq.com\/"},{"@type":"ListItem","position":2,"name":"Unblocking WordPress REST API Access"}]},{"@type":"WebSite","@id":"https:\/\/www.wpstaq.com\/#website","url":"https:\/\/www.wpstaq.com\/","name":"Managed Hosting Platform for WordPress","description":"","publisher":{"@id":"https:\/\/www.wpstaq.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wpstaq.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-sg"},{"@type":"Organization","@id":"https:\/\/www.wpstaq.com\/#organization","name":"Staq","alternateName":"WPStaq","url":"https:\/\/www.wpstaq.com\/","logo":{"@type":"ImageObject","inLanguage":"en-sg","@id":"https:\/\/www.wpstaq.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.wpstaq.com\/wp-content\/uploads\/2023\/05\/cropped-LogoNoText.png","contentUrl":"https:\/\/www.wpstaq.com\/wp-content\/uploads\/2023\/05\/cropped-LogoNoText.png","width":512,"height":512,"caption":"Staq"},"image":{"@id":"https:\/\/www.wpstaq.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/staqhosting\/","https:\/\/www.linkedin.com\/company\/wpstaq"]}]}},"_links":{"self":[{"href":"https:\/\/www.wpstaq.com\/sg\/wp-json\/wp\/v2\/knowledgebase\/37671","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wpstaq.com\/sg\/wp-json\/wp\/v2\/knowledgebase"}],"about":[{"href":"https:\/\/www.wpstaq.com\/sg\/wp-json\/wp\/v2\/types\/knowledgebase"}],"wp:attachment":[{"href":"https:\/\/www.wpstaq.com\/sg\/wp-json\/wp\/v2\/media?parent=37671"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}