Title: REST API Guard Author: Sean Fisher Published: 2022년 10월 20일 Last modified: 2026년 10월 13일 --- 플러그인 검색 ![](https://ps.w.org/rest-api-guard/assets/icon-256x256.png?rev=3742732) # REST API Guard 작성자: [Sean Fisher](https://profiles.wordpress.org/sean212/) [다운로드](https://downloads.wordpress.org/plugin/rest-api-guard.1.5.0.zip) * [세부사항](https://ko.wordpress.org/plugins/rest-api-guard/#description) * [평가](https://ko.wordpress.org/plugins/rest-api-guard/#reviews) * [설치](https://ko.wordpress.org/plugins/rest-api-guard/#installation) * [개발](https://ko.wordpress.org/plugins/rest-api-guard/#developers) [지원](https://wordpress.org/support/plugin/rest-api-guard/) ## 설명 The WordPress REST API is public by default and shares a good deal of information about your site with anyone who asks. REST API Guard makes it easy to decide who can see what. Out of the box, the plugin: * Blocks anonymous access to the users endpoint (`/wp/v2/users`) so usernames aren’t exposed. * Blocks anonymous access to the REST API index (`/`) and namespace endpoints (`/ wp/v2`) so visitors can’t list your plugins and post types. It can also: * Block all anonymous access to the REST API. * Allow anonymous access only to specific routes (allowlist), or block specific routes (denylist). * Require anonymous requests to include a JSON Web Token (JWT). * Let users authenticate with a JWT tied to their account. * Generate, list, and revoke tokens from the settings page or WP-CLI. Every option is available on the settings page (Settings REST API Guard) and as a filter for configuring the plugin in code. A setting controlled by a filter is shown as read-only on the settings page. #### Restrict access to user information Anonymous access to `/wp/v2/users` is blocked by default. To allow it: ``` add_filter( 'rest_api_guard_allow_user_access', '__return_true' ); ``` #### Restrict access to the index and namespace endpoints Anonymous access to the index (`/`) and namespace (`/wp/v2`) endpoints is blocked by default. To allow it: ``` add_filter( 'rest_api_guard_allow_index_access', '__return_true' ); add_filter( 'rest_api_guard_allow_namespace_access', '__return_true' ); ``` #### Block all anonymous access ``` add_filter( 'rest_api_guard_prevent_anonymous_access', '__return_true' ); ``` #### Allow anonymous access to specific routes (allowlist) When an allowlist is set, anonymous requests to any route not on the list are denied. The allowlist takes priority over the denylist. Use `*` as a wildcard. ``` add_filter( 'rest_api_guard_anonymous_requests_allowlist', fn () => [ '/wp/v2/posts*', '/custom-namespace/v1/public/*', ] ); ``` #### Deny anonymous access to specific routes (denylist) Anonymous requests to routes on the denylist are denied. All other routes are allowed. Use `*` as a wildcard. ``` add_filter( 'rest_api_guard_anonymous_requests_denylist', fn () => [ '/wp/v2/comments*', '/custom-namespace/v1/private/*', ] ); ``` #### Require a JSON Web Token (JWT) for anonymous requests Anonymous requests can be required to send a token in an `Authorization: Bearer ` header: ``` add_filter( 'rest_api_guard_authentication_jwt', '__return_true' ); ``` Tokens are expected to have an audience of `wordpress-rest-api` and an issuer of the site URL. Both can be changed: ``` add_filter( 'rest_api_guard_jwt_audience', fn () => 'custom-audience' ); add_filter( 'rest_api_guard_jwt_issuer', fn () => 'https://example.com' ); ``` Tokens are signed with a secret generated automatically and stored in the `rest_api_guard_jwt_secret` option. It can also be set in code: ``` add_filter( 'rest_api_guard_jwt_secret', fn () => 'my-custom-secret' ); ``` #### Authenticate users with a JWT Tokens can also be tied to a user. A request with a user token is treated as that user, with the same permissions they have: ``` add_filter( 'rest_api_guard_user_authentication_jwt', '__return_true' ); ``` #### Generate, list, and revoke tokens Once JWT authentication is enabled, tokens can be generated from the Tokens tab of the settings page. Give each one a name so you can tell them apart later, and optionally tie it to a user or set an expiration. The token is shown once after it’s generated, so copy it somewhere safe. The same tab lists every token the plugin has issued, and any of them can be revoked. A revoked token stops working right away. Tokens can also be managed with WP-CLI: ``` wp rest-api-guard generate-jwt [--name=] [--user=] [--expiration=] wp rest-api-guard list-jwts wp rest-api-guard revoke-jwt ``` Or generated in code: ``` $token = \Alley\WP\REST_API_Guard\generate_jwt( expiration: HOUR_IN_SECONDS, // Optional. Seconds until the token expires. user: 1, // Optional. A user ID or WP_User. name: 'Mobile App', // Optional. A name to identify the token by. ); ``` Tokens issued before version 1.5.0 aren’t tracked, so they can’t be listed or revoked one at a time. They’re still accepted by default. To reject them: ``` add_filter( 'rest_api_guard_allow_untracked_jwt', '__return_false' ); ``` Changing the `rest_api_guard_jwt_secret` option invalidates every token issued so far, tracked or not. #### Caching Responses to REST API requests that include an `Authorization` header are sent with no-cache headers so a page cache or CDN doesn’t store them. ## 스크린샷 [⌊The settings page.⌉⌊The settings page.⌉[ The settings page. [⌊The Tokens tab for generating, listing, and revoking JSON Web Tokens.⌉⌊The Tokens tab for generating, listing, and revoking JSON Web Tokens.⌉[ The Tokens tab for generating, listing, and revoking JSON Web Tokens. ## 설치 1. Install the plugin from the Plugins Add New screen, or upload it to the `/wp-content/ plugins/` directory. 2. Activate the plugin from the Plugins screen. 3. Configure it from Settings REST API Guard. The plugin can also be installed with Composer: ``` composer require alleyinteractive/wp-rest-api-guard ``` ## FAQ ### Does this affect logged-in users? No. The restrictions only apply to anonymous requests. Logged-in users have the same REST API access WordPress normally gives them. ### Why does the block editor still work? The block editor makes REST API requests as the logged-in user, so it isn’t affected by the anonymous access rules. ### Can I hide the settings page? Yes. Configure the plugin in code and disable the settings page: ``` add_filter( 'rest_api_guard_disable_admin_settings', '__return_true' ); ``` ### Are OPTIONS requests checked? Not by default, since browsers send them as CORS preflight requests without credentials. To check them too: ``` add_filter( 'rest_api_guard_check_options_requests', '__return_true' ); ``` ## 후기 ![](https://secure.gravatar.com/avatar/a198d8d4109faa2bfdafbcafabec1661360f7af4cde88cb8f192c7ec6babe448? s=60&d=retro&r=g) ### 󠀁[The best plugin](https://wordpress.org/support/topic/the-best-plugin-344/)󠁿 [Yworld](https://profiles.wordpress.org/yworld/) 2023년 5월 3일 Plugin works great! ![](https://secure.gravatar.com/avatar/98195d228e9177e36ca8a13d4c674356c6df724a3e0468dc646c9cc872a077a8? s=60&d=retro&r=g) ### 󠀁[Nice work!](https://wordpress.org/support/topic/nice-work-548/)󠁿 [Bowo](https://profiles.wordpress.org/qriouslad/) 2022년 10월 20일 Simple and effective. I love being able to easily turn off access to the REST API. [ 모든 2 평가 읽기 ](https://wordpress.org/support/plugin/rest-api-guard/reviews/) ## 기여자 & 개발자 “REST API Guard”(은)는 오픈 소스 소프트웨어입니다. 다음의 사람들이 이 플러그인에 기여하였습니다. 기여자 * [ Sean Fisher ](https://profiles.wordpress.org/sean212/) [자국어로 “REST API Guard”(을)를 번역하세요.](https://translate.wordpress.org/projects/wp-plugins/rest-api-guard) ### 개발에 관심이 있으십니까? [코드 탐색하기](https://plugins.trac.wordpress.org/browser/rest-api-guard/)는, [SVN 저장소](https://plugins.svn.wordpress.org/rest-api-guard/) 를 확인하시거나, [개발 기록](https://plugins.trac.wordpress.org/log/rest-api-guard/) 을 [RSS](https://plugins.trac.wordpress.org/log/rest-api-guard/?limit=100&mode=stop_on_copy&format=rss) 로 구독하세요. ## 변경이력 #### 1.5.0 * Track issued JWTs and allow them to be revoked from the settings page or WP-CLI. * Add a Tokens tab to the settings page to generate, list, and revoke JWTs when JWT authentication is enabled. * Add the `rest_api_guard_allow_untracked_jwt` filter to reject JWTs issued before tracking. * Send no-cache headers on REST API requests that include an `Authorization` header. #### 1.4.2 * Prevent mixed-case REST API routes from bypassing anonymous access restrictions. * Add support for WordPress 7.1. * Require PHP 8.3+. * Update `firebase/php-jwt` to version 7. #### 1.4.1 * No changes, release to trigger deployment to WordPress.org. #### 1.4.0 * Add support for WordPress 6.8. * Require PHP 8.1+. #### 1.3.1 * Ignore JWT authentication for the REST API if the user is already authenticated. #### 1.3.0 * Allow claims to be added to a generated JWT via filter. * Don’t check `OPTIONS` requests by default. #### 1.2.0 * Add support for authenticated users interacting with the REST API. * Allow settings to be completely disabled via code. * Increase the default length of the JWT secret to 32 characters. #### 1.1.0 * Require PHP 8.0. * Add support for anonymous authentication with a JSON Web Token (JWT). The full changelog is available on [GitHub](https://github.com/alleyinteractive/wp-rest-api-guard/blob/develop/CHANGELOG.md). ## 기초 * 버전 **1.5.0** * 최근 업데이트: **21시간 전** * 활성화된 설치 **100+** * 워드프레스 버전 ** 6.5 또는 그 이상 ** * 다음까지 시험됨: **7.1.3** * PHP 버전 ** 8.3 또는 그 이상 ** * 언어 * [English (US)](https://wordpress.org/plugins/rest-api-guard/) * 태그: * [authentication](https://ko.wordpress.org/plugins/tags/authentication/)[jwt](https://ko.wordpress.org/plugins/tags/jwt/) [privacy](https://ko.wordpress.org/plugins/tags/privacy/)[rest-api](https://ko.wordpress.org/plugins/tags/rest-api/) [security](https://ko.wordpress.org/plugins/tags/security/) * [고급 보기](https://ko.wordpress.org/plugins/rest-api-guard/advanced/) ## 평점 별 5점 만점에 5점. * [ 2/5-별점 후기 ](https://wordpress.org/support/plugin/rest-api-guard/reviews/?filter=5) * [ 0/4-별점 후기 ](https://wordpress.org/support/plugin/rest-api-guard/reviews/?filter=4) * [ 0/3-별점 후기 ](https://wordpress.org/support/plugin/rest-api-guard/reviews/?filter=3) * [ 0/2-별점 후기 ](https://wordpress.org/support/plugin/rest-api-guard/reviews/?filter=2) * [ 0/1-별점 후기 ](https://wordpress.org/support/plugin/rest-api-guard/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/rest-api-guard/reviews/#new-post) [모든 리뷰 보기](https://wordpress.org/support/plugin/rest-api-guard/reviews/) ## 기여자 * [ Sean Fisher ](https://profiles.wordpress.org/sean212/) ## 지원 할 말 있으신가요? 도움이 필요하신가요? [지원 포럼 보기](https://wordpress.org/support/plugin/rest-api-guard/)