Torii Membership System

The REST API on a Membership Site

The REST API is how modern WordPress talks to the world: /wp-json/ serves your posts, pages, users, and comments as JSON to anyone who asks. That's the point of an API, and for a public blog it's fine. For a membership site, every "anyone who asks" deserves a second look.

The Hardening module gives you five REST toggles. They run from removing advertisements to sealing the door, and which ones you enable depends on one question: does anything legitimate need your REST API from outside?

If nothing does: the classic site

Most membership sites don't. Your theme renders pages server-side, your members log in through forms, and the only API consumers are plugins talking to your own site internally (those authenticate as admins and are unaffected).

Enable all five:

  • Disable REST API for guests is the big one. Unauthenticated requests get a 401. The API keeps working for logged-in users, which is why your own admin doesn't notice anything.
  • Remove REST link from head and from headers delete the two "REST API lives here" signs WordPress puts on every page.
  • Disable ?rest_route= closes the legacy fallback URL that bots probe when the pretty path is blocked.
  • Block JSONP removes an obsolete cross-origin escape hatch that a malicious site could use to read API responses through a logged-in member's browser.

If something does: the headless or hybrid site

If your frontend is a React app, a static generator, or a mobile client that fetches content over REST from anonymous visitors, disabling guest access breaks it. You'll know, because your frontend stops loading content.

The surgical alternative:

  • Keep guest access on, but disable REST user enumeration (covered in disrupting the attacker's workflow) so the users endpoint stops listing members.
  • Apply the link and JSONP removals, which don't affect legitimate API consumers, who already know where /wp-json/ is.
  • Whitelist your frontend's specific routes at the server or firewall level rather than opening the whole API.

The endpoints that matter most

Two families carry the membership-site risk:

  • Users (/wp/v2/users): usernames of every account, including members. That's a privacy leak and a brute-force shopping list in one.
  • Content (/wp/v2/posts, /wp/v2/pages, custom post types): your lessons and member content, served as clean JSON that scrapers can ingest without ever rendering a page. WordPress applies the same permissions as the web view, so content protected by Torii stays protected in the API, but anything your theme would show a guest, the API shows a script.

Test what your site actually exposes: visit yoursite.com/wp-json/wp/v2/users in a private browser window. Whatever you see there, the whole internet sees.