Stop announcing your REST API on every page you serve
Disable REST API Links removes the discovery signals WordPress adds pointing to the REST API, without touching the API itself or anything that depends on it.
- Removes the discovery link from every page's <head>.
- Removes the HTTP Link header from front-end responses.
- Removes the RSD entry that also points at the API.
- The API keeps working exactly as before, just not advertised.
What does Disable REST API Links do?
When the disable_rest_api_links module is active, TheOneWP removes three actions WordPress core registers to advertise the REST API's location: rest_output_link_wp_head on wp_head, which prints the discovery <link> tag; rest_output_link_header on template_redirect, which adds the Link HTTP header; and rest_output_rsd on xmlrpc_rsd_apis, which adds an entry to the RSD discovery document. None of these removals touch the API's actual endpoints, so anything that calls the REST API directly, the block editor, official apps, or any plugin, keeps working exactly as it did before.
WordPress points to the REST API on every single page
Three separate signposts quietly point to the same location, whether anyone actually needs directions or not.
Every page carries three separate signposts
A discovery link in the page head, an HTTP header on every response, and an entry in the RSD document all quietly point to exactly where the REST API lives, whether anyone needs to know or not.
Advertising a location isn't the same as needing to hide the road
A site that wants to keep running its API without drawing attention to it has no built-in way to do that; the signposts stay up regardless of whether the API itself is left open or restricted.
Take down the signposts, leave the road open
The module removes exactly the three places WordPress advertises the API's location, without touching the API itself.
The <head> discovery link, gone
The link tag that points to the API's root endpoint no longer appears in the page source.
The HTTP header, gone too
The Link header WordPress adds to front-end responses, carrying the same discovery information, is removed as well.
The API itself, fully untouched
Every endpoint keeps responding exactly as it did before; only the automatic advertisements are taken down.
Three signposts, removed together
Every capability below is present in the plugin's registration logic and its settings field.
rest_output_link_wp_head removed
The action that prints the discovery link tag in wp_head is removed, so it no longer appears in any page's source.
rest_output_link_header removed
The action that adds the Link HTTP header on template_redirect is removed, closing off that discovery path too.
rest_output_rsd removed
The action that adds the REST API to the RSD (Really Simple Discovery) document is removed as well.
Every endpoint keeps responding
Nothing about the module touches the REST API's actual request handling; it only removes the pointers to it.
A single toggle
There's nothing to choose or configure beyond enabling the module; all three removals happen together.
Discretion without restriction
For a site that needs the API running but would rather not announce it on every page, this sits between leaving it fully advertised and actively restricting access.
Where removing the signposts helps most
The module supports any site that wants the API running quietly, without necessarily restricting it.
Reducing the API's visibility
Keep the REST API available for whatever depends on it, without making its location obvious to anyone glancing at page source or response headers.
A first, non-breaking step before restricting access
Remove the advertisements before deciding whether to go further with actual access restrictions, since nothing here can break an existing integration.
Cleaner page source and headers
Trim three automatic additions from every page's markup and response headers, for a site that has no use for advertising them.
Quieter by default, nothing lost
The module removes exactly what advertises the API, with zero effect on anything that actually calls it.
Three hook removals, nothing more
The verified implementation is as minimal as a module can be.
Three fewer additions per page
Removing the head link, the Link header and the RSD entry trims a small amount of markup and response overhead from every page.
Three simple hook removals
The entire module is three remove_action() calls, each targeting one specific WordPress core action.
No ongoing processing
Once the actions are removed, there's nothing left running; the fix isn't a continuous check on every request.
Reduced visibility, not a substitute for access control
The code is honest about its own limits and doesn't touch authentication in any way.
Reduces visibility, not a substitute for access control
Removing the advertisements makes the API's location less obvious, but it isn't the same as restricting who can call it.
Administrator-only configuration
Only an administrator with access to TheOneWP settings can enable the module.
No effect on authentication
The module doesn't touch how the API authenticates requests; that remains whatever it was before, or whatever a module like Disable REST API sets separately.
A read-only change to page output
The module only removes existing WordPress hooks; it doesn't accept or process any user input.
Built entirely around native WordPress core actions
The supplied code integrates through APIs present in WordPress core. No compatibility claim beyond the verified implementation is assumed.
rest_output_link_wp_head
The exact core function WordPress hooks to wp_head to print the REST API discovery link.
rest_output_link_header
The exact core function WordPress hooks to template_redirect to add the Link HTTP header.
rest_output_rsd
The exact core function WordPress hooks to xmlrpc_rsd_apis to add the REST API's RSD entry.
TheOneWP versus common alternatives
Compare the verified Disable REST API Links implementation with a typical partial-removal snippet.
| Capability | TheOneWP Disable REST API Links | Other common solutions |
|---|---|---|
| Removing discovery signals | All three removed together, in one toggle | Usually only the head link is addressed, if any |
| API functionality | Completely untouched | Same, when done correctly, but requires writing the snippet yourself |
| Risk to existing integrations | None, since nothing about access changes | Same, if implemented correctly |
| Pairing with access restriction | A natural first step before restricting access | Rarely framed as part of a broader approach |
| Administration | One toggle, nothing else to configure | Requires a code snippet or a dedicated plugin |
Confirm the change in four steps
Check both the page source and the API's actual response to confirm both sides of the behavior.
Enable Disable REST API Links
Activate the module from the TheOneWP settings; there's nothing else to configure.
Check a page's source and headers
Confirm the discovery link tag and the Link HTTP header no longer appear on a front-end page.
Confirm the API still responds
Call a REST API endpoint directly to confirm it still works exactly as before.
Leave it on
Since there's no ongoing configuration, the module simply keeps working once enabled.
A safe default, paired with restriction if needed
This module addresses visibility; a separate one addresses access, and the two work well together.
Enable it as routine discretion
This is a low-risk change with no impact on functionality, reasonable to enable on most sites.
Pair it with actual access restriction if that's the goal
If the intent is to limit who can use the API, combine this with a module that restricts access, since removing the signposts alone doesn't do that.
Don't expect any change to API behavior
Every endpoint keeps responding exactly as before; only the automatic advertisements are affected.
No further configuration is needed
Since it's a single toggle, there's nothing to revisit once it's enabled.
Avoid assumptions that overstate its scope
The distinction between discovery and access is easy to blur at a glance.
Assuming this restricts API access
The module only removes the advertisements for the API; it doesn't limit who can call it. A module like Disable REST API handles actual access restriction.
Expecting the API to stop responding
Every endpoint keeps working exactly as before; disabling the links only removes the automatic pointers to them.
Looking for a settings screen that isn't there
Like other single-purpose modules, this one is a toggle by design, with no further configuration screen.
Disable REST API Links FAQ
These answers come directly from the plugin's registration logic and its settings field.
What does Disable REST API Links do?
It removes the discovery link in the page head, the Link HTTP header, and the RSD entry that all point to the REST API, without touching the API itself.
Does this stop the REST API from working?
No. Every endpoint keeps responding exactly as before; only the automatic advertisements pointing to it are removed.
Does this restrict who can access the API?
No. It only removes the discovery signals. For actual access restriction, a module that filters REST API authentication, like Disable REST API, is what handles that.
Will this break the block editor or any plugin that uses the API?
No. Anything that calls the API directly, rather than relying on the discovery link or header, is unaffected.
What exactly gets removed from the page?
The link rel="https://api.w.org/" tag in the page head and the Link HTTP header on front-end responses.
What is the RSD entry this module also removes?
An entry in WordPress's RSD (Really Simple Discovery) document that also points to the REST API's location.
Are there any settings beyond turning the module on?
No. It's a single toggle with no additional configuration.
Does this affect the WordPress admin area?
No. The discovery signals it removes only appear on front-end pages and responses.
Can I use this alongside a module that restricts REST API access?
Yes. Removing the advertisements and restricting access address two different things, and they work well together.
Who can turn this module on?
Only an administrator with access to the TheOneWP settings screen.
Stop pointing everyone straight at your REST API.Keep it running, just not announced.
Use Disable REST API Links to remove the discovery link, HTTP header and RSD entry, while the API itself keeps working exactly as before.