WordPress-specific Dictionary
REST API
Definition
The WordPress REST API is an HTTP JSON interface at /wp-json/ used by the editor, apps, and many plugins.
Also called: WordPress REST API, WP REST API, wp-json
Why it matters for WordPress
/wp-json/ is how the block editor and countless plugins talk to WordPress. It is also a discovery surface: user enumeration, authenticated routes, and plugin endpoints that forget capability checks. Killing the entire REST API often breaks Gutenberg. The job is to understand what you expose, not to yank the fuse blindly.
How it shows up in practice
- Enumerated users via public author or user routes (when not restricted)
- Brute force or stuffing against application-password protected routes
- Plugin REST endpoints with weak permission callbacks in CVE write-ups
- Headless or mobile apps that depend on specific namespaces staying open
What to do
- Keep WordPress and plugins updated; many REST bugs are permission mistakes.
- Prefer application passwords or proper OAuth-style flows over sharing the main admin password with apps.
- Rate-limit abusive auth attempts the same way you would for
wp-login.php. - Only disable specific routes you do not need, and test the editor after changes.
- Treat XML-RPC and REST as related surfaces: close what you do not use, harden what you do.
Related terms
Nearby ideas in the dictionary
- XML-RPC XML-RPC is an older WordPress API endpoint attackers often abuse for brute force and amplification.
- Login protection Login protection is the set of controls that harden the WordPress login against bots and credential attacks.
- Rate limiting Rate limiting caps how often an action can happen from an IP or account, which slows automated abuse.
- Application passwords Application passwords are per-app credentials WordPress can issue so integrations authenticate without using your main password.