{"id":257436,"date":"2025-10-26T23:33:10","date_gmt":"2025-10-26T23:33:10","guid":{"rendered":"https:\/\/ja.wordpress.org\/plugins\/api-write-blocker\/"},"modified":"2025-10-26T23:32:12","modified_gmt":"2025-10-26T23:32:12","slug":"api-write-blocker","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/api-write-blocker\/","author":23382453,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0","stable_tag":"1.0","tested":"6.8.5","requires":"6.8","requires_php":"7.4","requires_plugins":null,"header_name":"API Write Blocker","header_author":"Red Fox (team Red Fox)","header_description":"Strictly blocks write operations such as creating, editing, and deleting posts via REST API, XML-RPC, and key Admin-Ajax endpoints.","assets_banners_color":"","last_updated":"2025-10-26 23:32:12","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/profiles.wordpress.org\/teamredfox\/","header_author_uri":"https:\/\/p-fox.jp\/","rating":0,"author_block_rating":0,"active_installs":10,"downloads":270,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0":{"tag":"1.0","author":"teamredfox","date":"2025-10-26 23:32:12"}},"upgrade_notice":{"1.0":"<p>Initial release. No upgrade concerns.<\/p>"},"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3384887,"resolution":"1","location":"assets","locale":"","width":1614,"height":697},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3384887,"resolution":"2","location":"assets","locale":"","width":1615,"height":766},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3384887,"resolution":"3","location":"assets","locale":"","width":1609,"height":756}},"screenshots":{"1":"Settings UI under \"Settings\" &gt; \"API\/Write Restriction\".","2":"REST API write method controls and whitelist management.","3":"IP whitelist and Ajax action whitelist settings.","4":"Custom error message configuration screen."}},"plugin_section":[],"plugin_tags":[],"plugin_category":[],"plugin_contributors":[249109],"plugin_business_model":[],"class_list":["post-257436","plugin","type-plugin","status-publish","hentry","plugin_contributors-teamredfox","plugin_committers-teamredfox"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/api-write-blocker.svg","icon_2x":false,"generated":true},"screenshots":[{"src":"https:\/\/ps.w.org\/api-write-blocker\/assets\/screenshot-1.png?rev=3384887","caption":"Settings UI under \"Settings\" &gt; \"API\/Write Restriction\"."},{"src":"https:\/\/ps.w.org\/api-write-blocker\/assets\/screenshot-2.png?rev=3384887","caption":"REST API write method controls and whitelist management."},{"src":"https:\/\/ps.w.org\/api-write-blocker\/assets\/screenshot-3.png?rev=3384887","caption":"IP whitelist and Ajax action whitelist settings."}],"raw_content":"<!--section=description-->\n<p><strong>API Write Blocker<\/strong> is a security-focused plugin that prevents unauthorized or anonymous users from executing write operations through REST API, XML-RPC, and Admin-Ajax interfaces.<\/p>\n\n<p>Unlike generic API blockers, this plugin enables <em>fine-grained control<\/em> over which HTTP methods (POST, PUT\/PATCH, DELETE) are allowed, supports whitelist-based exceptions, and protects core endpoints without interfering with legitimate functionalities such as contact form submissions or plugin integrations.<\/p>\n\n<h3>\ud83d\udd10 Key Features<\/h3>\n\n<p><strong>REST API Method-Level Blocking<\/strong>\n* Independently block POST, PUT\/PATCH, and DELETE requests.\n* Whitelist specific REST routes (prefix match supported) to allow legitimate access (e.g., contact forms).\n* Configure a custom HTTP status code and error message per request type.<\/p>\n\n<p><strong>XML-RPC Write Operation Blocking<\/strong>\n* Disable only dangerous write-related XML-RPC methods (e.g., <code>wp.newPost<\/code>, <code>metaWeblog.editPost<\/code>) while keeping harmless calls untouched.\n* Return a custom status code and error message for blocked XML-RPC operations.<\/p>\n\n<p><strong>Admin-Ajax Write Protection<\/strong>\n* Blocks known sensitive write-related Ajax actions (e.g., <code>save-post<\/code>, <code>upload-attachment<\/code>) for unauthenticated users.\n* Whitelist specific actions used by safe plugins like Contact Form 7.<\/p>\n\n<p><strong>Flexible Exceptions<\/strong>\n* Authenticated users are always allowed by default.\n* IP Whitelist support (including CIDR ranges) for external systems or trusted clients.<\/p>\n\n<p><strong>Custom Response Messages<\/strong>\n* Return custom error messages and HTTP status codes for each interface: REST, XML-RPC, and Admin-Ajax.<\/p>\n\n<p>This plugin is ideal for hardening your WordPress site without breaking functionality.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Download the ZIP file and install it from \"Plugins\" &gt; \"Add New\" &gt; \"Upload Plugin\".<\/li>\n<li>OR, unzip the plugin and upload it to the <code>\/wp-content\/plugins\/<\/code> directory.<\/li>\n<li>Activate \"API Write Blocker\" from \"Plugins\" in the admin panel.<\/li>\n<li>Go to \"Settings\" &gt; \"API\/Write Restriction\" to configure the plugin.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id='will%20this%20plugin%20block%20contact%20form%207%20or%20similar%20plugins%3F'><h3>Will this plugin block Contact Form 7 or similar plugins?<\/h3><\/dt>\n<dd><p>No, as long as you whitelist the required routes (e.g., <code>contact-form-7\/v1\/contact-forms<\/code>) and Ajax actions (e.g., <code>wpcf7-submit<\/code>). The plugin is designed to safely allow necessary requests.<\/p><\/dd>\n<dt id='is%20it%20safe%20to%20disable%20write%20methods%20in%20the%20rest%20api%3F'><h3>Is it safe to disable write methods in the REST API?<\/h3><\/dt>\n<dd><p>Yes. Many sites do not use REST-based write operations publicly. By default, WordPress allows unauthenticated POST, PUT, and DELETE calls which may be exploited by attackers. This plugin disables them unless explicitly allowed.<\/p><\/dd>\n<dt id='can%20i%20block%20xml-rpc%20write%20methods%20without%20disabling%20xml-rpc%20entirely%3F'><h3>Can I block XML-RPC write methods without disabling XML-RPC entirely?<\/h3><\/dt>\n<dd><p>Yes. This plugin blocks only post-related XML-RPC methods and lets other functions like pingbacks or basic metaWeblog info pass, if desired.<\/p><\/dd>\n<dt id='what%20happens%20to%20authenticated%20users%3F'><h3>What happens to authenticated users?<\/h3><\/dt>\n<dd><p>Authenticated (logged-in) users are always allowed to execute requests. This plugin mainly protects against unauthorized, anonymous, or non-whitelisted users.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0<\/h4>\n\n<ul>\n<li>Initial release.<\/li>\n<li>REST API write method blocking (POST, PUT\/PATCH, DELETE).<\/li>\n<li>XML-RPC method-level write blocking.<\/li>\n<li>Admin-Ajax write action blocking with whitelist.<\/li>\n<li>IP and route\/action whitelists.<\/li>\n<li>Custom status code and message per interface.<\/li>\n<\/ul>","raw_excerpt":"A plugin to control the operation of admin-ajax.php, REST API, and xmlrpc.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/257436","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=257436"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/teamredfox"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=257436"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=257436"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=257436"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=257436"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=257436"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=257436"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}