=== Birim REST Lock ===
Contributors: birimone
Tags: rest-api, security, disable rest api, user enumeration, json
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Lock the WordPress REST API for logged-out visitors. Allowlist routes, stop username enumeration, import from Disable REST API.

== Description ==

WordPress exposes a public REST API at `/wp-json/`. Anyone can list your users, your installed plugins' endpoints and your content. Birim REST Lock closes it without breaking your site.

* **Allowlist mode** (default): block every route except the ones you list.
* **Blocklist mode**: allow every route except the ones you list.
* **Wildcards**: `/wp/v2/posts*` covers `/wp/v2/posts` and `/wp/v2/posts/123`.
* **Role rules**: apply the same rules to logged-in roles you choose, such as subscribers or customers. Administrators are never blocked.
* **Stop username enumeration**: always block `/wp/v2/users`.
* **Hide what you run**: block the route index and namespace listings, and remove REST links from page HTML, the `Link` header and RSD.
* **Safe defaults**: Contact Form 7, WooCommerce block checkout, oEmbed and Jetpack routes are allowed out of the box. CORS preflight (`OPTIONS`) requests pass through, so token logins keep working.
* **One-click import from Disable REST API**: moves your logged-out allowlist and managed roles across.
* Lightweight: one file, works on PHP 7.4 and up, no tracking, no external requests, no ads.

= For developers =

* `birim_rest_lock_blocked` filter: `( bool $blocked, string $route, WP_REST_Request $request )` to override the decision.
* `birim_rest_lock_message` filter: change the error message.

== Installation ==

1. Install from Plugins > Add New, or upload the `birim-rest-lock` folder to `/wp-content/plugins/`.
2. Activate the plugin.
3. Go to Settings > REST Lock to review the routes.

== Frequently Asked Questions ==

= How do I check it works? =

Open `https://yoursite.com/wp-json/wp/v2/users` in your browser. You should get a 401 error. This happens even while you are logged in: WordPress treats a browser visit to `/wp-json/` without a security nonce as logged out. The block editor and admin screens send the nonce, so they keep working.

= A plugin stopped working for visitors. =

That plugin calls the REST API for logged-out visitors. Settings > REST Lock lists the namespaces on your site. Add the plugin's namespace (for example `/my-plugin/v1`) to the allowlist.

= Does it block APIs outside /wp-json/? =

No. It controls routes registered with the WordPress REST API only.

= I'm moving from Disable REST API. =

Activate REST Lock and open Settings > REST Lock. Click "Import from Disable REST API", review the result, then deactivate Disable REST API. The import copies the logged-out allowlist and turns roles you managed there into restricted roles. Per-role route lists are not copied; restricted roles share the logged-out rules.

= Will it break the block editor? =

No. Administrators are never blocked, and other logged-in users are only restricted if you choose their role. Do not restrict roles that write posts.

= How do I report a security issue? =

Please email security@birim.one instead of posting in the forum. See https://birimone.pages.dev/security/ for the full policy.

== Screenshots ==

1. Settings > REST Lock: choose a mode, list routes with wildcards, restrict roles and hide user and route listings.

== Changelog ==

= 1.0.0 =
* First release.
