title: Safely disable WP REST API
body: <p>I am considering to improve security of my Wordpress website, and in doing so have come across WP REST API being enabled by default (since WP 4.4 if I'm not mistaken).</p>
  
  <p><strong>What is a safe way to disable it?</strong></p>
  
  <p>By "safe" here I mean that it does not cause unexpected side-effects, e.g. does not break any other WP core functionality.</p>
  
  <p>One possible approach would be to use <code>.htaccess</code> rewrite rules, but surprisingly I haven't found any 'official' instructions on doing so.</p>
  
  <p>Any help or recommendation is greatly appreciated :)</p>
  
  <p><strong>Update:</strong>
  3rd-party plugins is not the solution I am looking for. Although I'm aware there are plenty of them that solve the task, they include many extra features that slow down the website. I would hope there is a one-line solution to this problem without the overhead of an extra plugin.</p>
  
  <p><strong>Update 2:</strong>
  Here is the official opinion of Wordpress: <a href="https://developer.wordpress.org/rest-api/using-the-rest-api/frequently-asked-questions/#can-i-disable-the-rest-api" rel="noreferrer">https://developer.wordpress.org/rest-api/using-the-rest-api/frequently-asked-questions/#can-i-disable-the-rest-api</a></p>
  
  <p>According to this, the Wordpress team wants future WP functionality to depend on the new REST API. This means there is no <em>guaranteed safe</em> way to disable the REST API.</p>
  
  <p>Let's just hope there are enough security experts taking care of WP security.</p>
  
  <p><strong>Update 3:</strong></p>
  
  <p>A workaround is presented in WordPress API Handbook - you can <a href="https://developer.wordpress.org/rest-api/using-the-rest-api/frequently-asked-questions/#require-authentication-for-all-requests" rel="noreferrer">Require Authentication for All Reque​sts</a></p>
  
  <p>This makes sure that anonymous access to your website's REST API is disabled, only authenticated requests will work.</p>