WordPress REST API publicly lists the plugins it runs

1. Find out which namespaces your pages call. Open the site in a private browser window, open the browser's developer tools (F12) → Network, filter by wp-json, and use the site as a visitor: send a form, add something to the cart, open the checkout, search. Every request listed names a namespace to keep.

Common ones:

• Contact Form 7 submits its forms through the REST API.
• WooCommerce's block-based cart, checkout and mini cart read the Store API (wc/store).
• View counters such as WP Statistics and WordPress Popular Posts record visits through it.
• Community, donation and consent plugins (BuddyPress, GiveWP, Complianz) use it on the pages.

2. Hide the rest from visitors. Save this as wp-content/mu-plugins/hide-rest-map.php (the folder may need creating; files there are always active). Put the namespaces from step 1 in the list — each one is kept with everything under it.

wp-content/mu-plugins/hide-rest-map.php

<?php
/* Hide the REST API's map from visitors who are not logged in. */
add_filter( 'rest_endpoints', function ( $endpoints ) {
	if ( current_user_can( 'edit_posts' ) ) {
		return $endpoints; // staff keep everything
	}
	// Namespaces your pages call. Everything else answers 404 to visitors.
	$keep = array( 'wc/store', 'contact-form-7/v1' );
	foreach ( array_keys( $endpoints ) as $route ) {
		$kept = false;
		foreach ( $keep as $namespace ) {
			if ( 0 === strpos( $route, '/' . $namespace . '/' ) ) {
				$kept = true;
				break;
			}
		}
		if ( ! $kept ) {
			unset( $endpoints[ $route ] );
		}
	}
	return $endpoints;
}, 5 );

// No pointer to the API in the pages' head and headers.
remove_action( 'wp_head', 'rest_output_link_wp_head' );
remove_action( 'template_redirect', 'rest_output_link_header', 11 );

Anyone who can edit content keeps the whole API, so the block editor, WooCommerce's and other plugins' admin screens and Site Health work as before. Security plugins offer the same as a setting ("Disable REST API for visitors" or similar); make sure it takes a list of exceptions and answers 404, not 401.

Not recommended: the common snippet that refuses the whole API to visitors through rest_authentication_errors. It breaks forms and the block cart, and still answers 401 for every address, which confirms each plugin exists.

3. Check it. Open https://example.com/wp-json/ in a private window: it should answer "not found" (404, rest_no_route). Then send a form and use the cart or whatever else your pages do, and run this check again.

Hide my WordPress site's REST API map from visitors who are not logged in, without breaking the features that use the API. https://example.com/wp-json/ currently answers anyone and lists every namespace, i.e. every plugin.

Do this:
1. Find which namespaces the public pages call (forms, cart, checkout, view counters): grep the theme and plugins for wp-json / rest_url / apiFetch, and check the browser's network tab as a visitor.
2. Add a must-use plugin (wp-content/mu-plugins/hide-rest-map.php) with a rest_endpoints filter: when the user cannot edit_posts, unset every route except those under the kept namespaces (match '/<namespace>/' as a prefix of the route), so the index '/', every namespace index and the other routes answer 404 rest_no_route, never 401. Also remove_action wp_head rest_output_link_wp_head and template_redirect rest_output_link_header (priority 11).
3. Do not use rest_authentication_errors to refuse the whole API: it breaks visitor-facing features and answers 401, which confirms the plugins.
4. Verify: /wp-json/ and /wp-json/wp/v2 answer 404 for a visitor and still work for an editor; the kept features work in a private window; no <link rel="https://api.w.org/"> and no Link header on the pages.
Tell me exactly which file you added and which namespaces you kept.

Subject: example.com – please hide the WordPress REST API map from visitors

Hi,

A website check (PageCheck) found that https://example.com/wp-json/ answers anyone and lists every plugin our site runs, which gives attackers a ready-made list to work through.

Please:
1. Hide the REST API index (/wp-json/) and every namespace our pages do not call from visitors who are not logged in, so they answer 404 (a small must-use plugin with a rest_endpoints filter, or the security plugin's setting with exceptions).
2. Keep the namespaces our forms, shop or other visitor-facing features use.
3. Remove the REST API link from the pages' head and headers.
4. Check that forms, the cart and the admin screens still work.

Thank you!