Title: API Write Blocker
Author: teamredfox
Published: <strong>26. oktober 2025</strong>
Last modified: 26. oktober 2025

---

Søk gjennom innstikk

Dette innstikket **er ikkje testa med dei tre siste utgåvene av WordPress**. Det
kan henda det ikkje blir vedlikehalde lenger, og kan ha problem med nyare versjonar
av WordPress.

![](https://s.w.org/plugins/geopattern-icon/api-write-blocker.svg)

# API Write Blocker

 Av [teamredfox](https://profiles.wordpress.org/teamredfox/)

[Last ned](https://downloads.wordpress.org/plugin/api-write-blocker.1.0.zip)

 * [Detaljar](https://nn.wordpress.org/plugins/api-write-blocker/#description)
 * [Omtalar](https://nn.wordpress.org/plugins/api-write-blocker/#reviews)
 *  [Installasjon](https://nn.wordpress.org/plugins/api-write-blocker/#installation)
 * [Utvikling](https://nn.wordpress.org/plugins/api-write-blocker/#developers)

 [Hjelp](https://wordpress.org/support/plugin/api-write-blocker/)

## Skildring

**API Write Blocker** is a security-focused plugin that prevents unauthorized or
anonymous users from executing write operations through REST API, XML-RPC, and Admin-
Ajax interfaces.

Unlike generic API blockers, this plugin enables _fine-grained control_ over which
HTTP methods (POST, PUT/PATCH, DELETE) are allowed, supports whitelist-based exceptions,
and protects core endpoints without interfering with legitimate functionalities 
such as contact form submissions or plugin integrations.

### 🔐 Key Features

**REST API Method-Level Blocking**
 * Independently block POST, PUT/PATCH, and DELETE
requests. * Whitelist specific REST routes (prefix match supported) to allow legitimate
access (e.g., contact forms). * Configure a custom HTTP status code and error message
per request type.

**XML-RPC Write Operation Blocking**
 * Disable only dangerous write-related XML-
RPC methods (e.g., `wp.newPost`, `metaWeblog.editPost`) while keeping harmless calls
untouched. * Return a custom status code and error message for blocked XML-RPC operations.

**Admin-Ajax Write Protection**
 * Blocks known sensitive write-related Ajax actions(
e.g., `save-post`, `upload-attachment`) for unauthenticated users. * Whitelist specific
actions used by safe plugins like Contact Form 7.

**Flexible Exceptions**
 * Authenticated users are always allowed by default. * 
IP Whitelist support (including CIDR ranges) for external systems or trusted clients.

**Custom Response Messages**
 * Return custom error messages and HTTP status codes
for each interface: REST, XML-RPC, and Admin-Ajax.

This plugin is ideal for hardening your WordPress site without breaking functionality.

## Skjermbilete

[⌊Settings UI under "Settings" > "API/Write Restriction".⌉⌊Settings UI under "Settings"
> "API/Write Restriction".⌉[

Settings UI under «Settings» > «API/Write Restriction».

[⌊REST API write method controls and whitelist management.⌉⌊REST API write method
controls and whitelist management.⌉[

REST API write method controls and whitelist management.

[⌊IP whitelist and Ajax action whitelist settings.⌉⌊IP whitelist and Ajax action
whitelist settings.⌉[

IP whitelist and Ajax action whitelist settings.

## Installasjon

 1. Download the ZIP file and install it from «Plugins» > «Add New» > «Upload Plugin».
 2. OR, unzip the plugin and upload it to the `/wp-content/plugins/` directory.
 3. Activate «API Write Blocker» from «Plugins» in the admin panel.
 4. Go to «Settings» > «API/Write Restriction» to configure the plugin.

## Vanlege spm.

### Will this plugin block Contact Form 7 or similar plugins?

No, as long as you whitelist the required routes (e.g., `contact-form-7/v1/contact-
forms`) and Ajax actions (e.g., `wpcf7-submit`). The plugin is designed to safely
allow necessary requests.

### Is it safe to disable write methods in the REST API?

Yes. Many sites do not use REST-based write operations publicly. By default, WordPress
allows unauthenticated POST, PUT, and DELETE calls which may be exploited by attackers.
This plugin disables them unless explicitly allowed.

### Can I block XML-RPC write methods without disabling XML-RPC entirely?

Yes. This plugin blocks only post-related XML-RPC methods and lets other functions
like pingbacks or basic metaWeblog info pass, if desired.

### What happens to authenticated users?

Authenticated (logged-in) users are always allowed to execute requests. This plugin
mainly protects against unauthorized, anonymous, or non-whitelisted users.

## Omtalar

There are no reviews for this plugin.

## Bidragsytarar og utviklarar

“API Write Blocker” is open source software. The following people have contributed
to this plugin.

Contributors

 *   [ teamredfox ](https://profiles.wordpress.org/teamredfox/)

[Omset “API Write Blocker” til ditt eige språk.](https://translate.wordpress.org/projects/wp-plugins/api-write-blocker)

### Interested in development?

[Les kjeldekoden](https://plugins.trac.wordpress.org/browser/api-write-blocker/),
sjekk [SVN-lageret](https://plugins.svn.wordpress.org/api-write-blocker/) eller 
abonner på [utviklingsloggen](https://plugins.trac.wordpress.org/log/api-write-blocker/)
med [RSS](https://plugins.trac.wordpress.org/log/api-write-blocker/?limit=100&mode=stop_on_copy&format=rss).

## Endringslogg

#### 1.0

 * Initial release.
 * REST API write method blocking (POST, PUT/PATCH, DELETE).
 * XML-RPC method-level write blocking.
 * Admin-Ajax write action blocking with whitelist.
 * IP and route/action whitelists.
 * Custom status code and message per interface.

## Om

 *  Version **1.0**
 *  Last updated **12 månader sidan**
 *  Active installations **10+**
 *  WordPress version ** 6.8 eller nyare **
 *  Tested up to **6.8.11**
 *  PHP version ** 7.4 eller nyare **
 *  Language
 * [English (US)](https://wordpress.org/plugins/api-write-blocker/)
 *  [Avansert vising](https://nn.wordpress.org/plugins/api-write-blocker/advanced/)

## Vurderingar

No reviews have been submitted yet.

[Your review](https://wordpress.org/support/plugin/api-write-blocker/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/api-write-blocker/reviews/)

## Contributors

 *   [ teamredfox ](https://profiles.wordpress.org/teamredfox/)

## Hjelp

Har du noko å seia? Treng du hjelp?

 [Sjå hjelpeforumet](https://wordpress.org/support/plugin/api-write-blocker/)