Setting up your own blog or homepage with WordPress is easy. You can get turnkey installations of the CMS from practically every host. This is ideal for disseminating information. However, making some data only accessible to certain users is not so easy. Because what many operators don’t know: WordPress has a powerful JSON API that is pretty informative by default. This allows some sensitive data to be accessed via the front end without prior registration.
The JSON API makes WordPress particularly expandable and flexible. It enables the development of extensions based on a stable, clearly defined interface that is also stateless – i.e. not dependent on what other users are doing on the website. There are smartphone apps and various editors with which you can create and manage content: In addition to the Classic Editor, the current standard editor Guttenberg, Thrive Architect, Elementor and Divi, to name just three better-known ones. Many plug-ins such as contact forms also use the JSON API as an interface to WordPress.
- WordPress is great for disseminating information – to reserve some things for the club’s board, for example, you have to put in extra effort.
- Without protective measures, data for which a login would be useful can also be accessed via the JSON API.
- By installing the Disable WP REST API plugin, you block the backdoor to WordPress for non-logged in users.
It may not be a problem for a travel blog that all content is accessible to everyone by default, but the situation is different for a club website: there is usually a member or even board area that not everyone should be able to see. Because even if accessing these pages via the standard theme is only possible for registered users, anyone can access them via the JSON API without logging in. A plug-in that restricts access to the JSON API provides a solution.
That was the reading sample of our heise-Plus article “Find and seal data leaks on WordPress websites”. With a heise Plus subscription you can read the entire article.
