REST API Manager Pro is a WordPress plugin that provides comprehensive control over your WordPress REST API endpoints. It allows you to selectively enable or disable specific endpoints, enhancing security and performance by reducing your site’s attack surface.

By default, WordPress exposes all REST API endpoints, including those from plugins and themes. This can create security vulnerabilities and performance overhead. REST API Manager Pro allows you to:

• Enhance Security: Disable unused endpoints to reduce potential attack vectors
• Improve Performance: Reduce server load by blocking unnecessary API calls
• Monitor Activity: Track blocked requests and identify potential threats
• Granular Control: Manage endpoints at a detailed level, not all-or-nothing

• WordPress Developers: Managing client sites with security requirements
• Agencies: Deploying secure solutions across multiple sites
• E-commerce Sites: Protecting WooCommerce and payment endpoints
• Membership Sites: Securing user data and restricted content
• Enterprise: Running mission-critical WordPress installations
• Security-Conscious Site Owners: Anyone wanting better API control

1. Purchase a license from our website
2. Download the plugin ZIP file
3. Go to WordPress Admin → Plugins → Add New → Upload Plugin
4. Upload the ZIP file and activate
5. Go to Settings → REST API Manager → License
6. Enter your license key and activate

The plugin works out of the box with safe defaults. However, we recommend:

1. Review Your Endpoints: Go to REST API Manager to see all available endpoints
2. Identify Unused Endpoints: Look for endpoints you don’t need
3. Test Before Disabling: Use the Preview feature (Pro) to test endpoint responses
4. Disable Gradually: Start by disabling obviously unused endpoints
5. Monitor Logs: Check security logs (Pro) for blocked requests

No, REST API Manager Pro is designed to be safe:

1. Default State: All endpoints are enabled by default
2. Selective Disabling: You choose exactly what to disable
3. Easy Reversal: Re-enable any endpoint with one click
4. Preview Feature (Pro): Test endpoints before making changes
5. Logging (Pro): See what requests are being blocked

• WordPress 5.0 or higher
• PHP 7.2 or higher
• MySQL 5.6 or higher
• HTTPS recommended (for security)

An endpoint is a URL in the WordPress REST API that provides specific functionality. For example:

• /wp/v2/posts – Returns blog posts
• /wp/v2/users – Returns user information
• /wc/v3/products – Returns WooCommerce products (if installed)

Each endpoint can be individually enabled or disabled with REST API Manager Pro.

Static Endpoints: Fixed routes without parameters

• Example: /wp/v2/posts
• Returns a collection or resource

Dynamic Endpoints: Routes with variable parameters

• Example: /wp/v2/posts/(?P[\d]+)
• Requires an ID to access a specific item
• Pro version required to manage these

The Pro version includes 4 advanced filtering options:

1. Search/Filter: Quickly find specific endpoints by name
2. Filter by Namespace: View only endpoints from specific plugins (e.g., wc/v3 for WooCommerce)
3. Filter by Status: Show only enabled or disabled endpoints
4. Filter by Type: Show only static or dynamic endpoints

This makes managing large numbers of endpoints much easier.

The Endpoint Preview feature allows you to:

1. Click “Preview” next to any endpoint
2. See sample data that endpoint returns
3. Test the endpoint without using external tools
4. Verify endpoints work before disabling others
5. Understand what data each endpoint exposes

This is a unique feature – no other REST API management plugin offers this.

The Summary Dashboard provides at-a-glance statistics:

• Total number of endpoints on your site
• Number of enabled vs disabled endpoints
• Breakdown by namespace (WordPress, WooCommerce, etc.)
• Recently modified endpoints
• Most blocked endpoints (from security logs)

Security Logs track:

• Blocked Requests: When someone tries to access a disabled endpoint
• IP Addresses: Who attempted the request
• Timestamp: When the attempt occurred
• Endpoint: Which endpoint was targeted
• User Agent: What tool/browser was used

Logs can be:

• Viewed in the WordPress admin
• Exported to CSV for analysis
• Automatically cleaned up after 30 days (configurable)

Yes! The Pro version includes CSV export:

1. Go to REST API Manager → Logs
2. Select date range (optional)
3. Click “Export to CSV”
4. Analyze logs in Excel, Google Sheets, or security tools

This is useful for:

• Security audits
• Compliance reporting
• Identifying attack patterns
• Client reporting (for agencies)

1. Purchase a plan from our website
2. Check your email for the license key
3. Log in to your WordPress admin
4. Go to Settings → REST API Manager → License
5. Enter your license key
6. Click “Activate License”

You’ll see a success message when activation is complete.

Yes, depending on your plan:

• Free: Unlimited sites (with limited features)
• Personal: 1 site only
• Freelancer: Up to 5 sites
• Agency: Unlimited sites

Development and staging sites don’t count toward your limit.

When your annual license expires:

• Plugin continues to work with existing settings
• Endpoints remain enabled/disabled as configured
• No new updates or bug fixes
• No access to support
• Pro features will be disabled

You can renew at any time to restore Pro features.

Yes! We offer a 30-day money-back guarantee. If you’re not satisfied for any reason within 30 days of purchase, contact us for a full refund.

Quick Fix:

1. Go to REST API Manager → Endpoints
2. Find the endpoint you disabled
3. Click “Enable” to turn it back on
4. Test your site functionality

Prevention: Always use the Preview feature (Pro) before disabling endpoints.

Safe to Disable (Usually):

• Endpoints from plugins you’ve uninstalled
• User endpoints if you don’t have public
• profiles (/wp/v2/users)
• Media endpoints if you don’t allow file uploads
• Comment endpoints if comments are disabled

DO NOT Disable:

• Endpoints used by your theme
• Endpoints used by page builders (Elementor, Gutenberg)
• WooCommerce endpoints if you run an online store
• Any endpoint with recent activity in the logs (Pro)

Best Practice: If unsure, leave it enabled.

This is expected. The Free version only shows WordPress core endpoints. To see and manage plugin/theme endpoints (like WooCommerce, BuddyPress, etc.), upgrade to a Pro plan.

Possible causes:

1. No Blocked Requests: If no one has tried accessing disabled endpoints, logs will be empty (this is good!)
2. Logging Not Enabled: Check Settings → REST API Manager → Enable Security Logging
3. Logs Cleared: Logs auto-delete after 30 days by default
4. Database Issue: Check if the logs database table exists

Try disabling a test endpoint and accessing it manually to generate a log entry.

Common Issues:

1. **Invalid License Key**: Copy-paste carefully, no extra spaces
2. **Already Activated**: Check if it’s active on another site (Personal = 1 site limit)
3. **Expired License**: Check your purchase date (licenses are annual)
4. **Server Connection**: Your server must be able to connect to our license server
5. **Local Development**: Use `WP_DEBUG` mode for local testing (bypasses license check)

REST API Manager Pro works with all plugins that use the WordPress REST API, including:

• WooCommerce
• BuddyPress
• LearnDash
• MemberPress
• WPForms
• Gravity Forms
• Jetpack
• Yoast SEO
• And thousands more

If a plugin registers REST API endpoints, you can manage them with Pro.

Yes! REST API Manager Pro works with all major caching plugins:

• WP Rocket
• W3 Total Cache
• WP Super Cache
• LiteSpeed Cache
• Cloudflare

Note: After enabling/disabling endpoints, clear your cache to see changes take effect immediately.

License Verification Only (Pro):

• Your license key and domain are sent to our license server for validation
• This happens once per activation and daily for license checks
• No user data, content, or logs are ever transmitted

No External Connections (Free):

• The free version never connects to external servers
• All data stays on your WordPress installation

Yes. All security logs are stored in your WordPress database. Nothing is sent to external servers. You have full control and ownership of your log data.

No. REST API Manager Pro does not:

• Track user behavior
• Collect personal information
• Phone home with usage stats
• Insert any tracking scripts

The only external connection is license verification for Pro users.

Yes! The Freelancer and Agency plans are specifically designed for:

• Web developers managing client sites
• Agencies deploying to multiple clients
• Consultants providing WordPress services

White Label: The plugin can be white-labeled (remove branding) for professional client presentations.

REST API Manager Pro significantly reduces your attack surface by:

• Disabling unnecessary endpoints
• Logging suspicious activity
• Providing visibility into API access

However, it’s one layer of security. We recommend:

• Using a security plugin (Wordfence, iThemes Security)
• Keeping WordPress and plugins updated
• Using strong passwords and 2FA
• Regular backups
• HTTPS/SSL certificate

No. REST API Manager Pro is specialized for API security. A comprehensive security plugin like Wordfence provides:

• Firewall
• Malware scanning
• Login protection
• File integrity monitoring

Use REST API Manager Pro alongside a security plugin for best protection.

Yes! REST API Manager Pro is essential for headless WordPress setups where you need to:

• Expose only necessary endpoints to your frontend
• Secure sensitive data endpoints
• Monitor API access
• Optimize performance by blocking unused Endpoints

Many headless WordPress developers use REST API Manager Pro.

Yes. The plugin is fully compatible with Gutenberg. Be careful not to disable core endpoints that Gutenberg relies on, such as:

• /wp/v2/posts
• /wp/v2/pages
• /wp/v2/blocks
• /wp/v2/media

The Preview feature (Pro) helps you test before disabling.

Currently, REST API Manager Pro has a WordPress admin interface only. WP-CLI support is planned for a future release.

Yes! Developers can use our filter hooks:

  
    add_filter('rest_api_manager_endpoint_enabled', function($enabled, $endpoint) {
        if ($endpoint === '/wp/v2/users') {
            return false; // Disable users endpoint
        }
        return $enabled;
    }, 10, 2);
  

See the developer documentation for complete API reference.

No. REST API Manager Pro controls **which endpoints are accessible**, not **who can access them**. Authentication is handled separately by WordPress and plugins like Application Passwords or OAuth.

You can use both:

• REST API Manager Pro to control endpoint availability
• Authentication plugins to control access permissions

Yes! REST API Manager Pro works on WordPress Multisite:

• Network Activate: Apply settings across all sites
• Per-Site Activation: Different settings per subsite
• Network Admin: Manage endpoints from network dashboard

Agency license recommended for multisite networks.

Endpoint settings are stored as WordPress options:

• Enabled/disabled state per endpoint
• Security logs in a custom database table
• License information (encrypted)

All data is stored locally in your WordPress database.

• Free Version:
  • Community support forum on WordPress.org
  • Documentation and FAQ (this document)
• Personal Plan:
  • Email support
  • 48-hour response time during business days
  • Access to knowledge base
• Freelancer Plan:
  • Priority email support
  • 24-hour response time
  • Access to knowledge base
  • Feature requests considered
• Agency Plan:
  • Priority email support
  • 12-hour response time (including weekends)
  • Access to knowledge base
  • Priority feature requests
  • Direct developer access for complex issues

Email: support@wpbuoy.com
Documentation: http://wpbuoy.com/docs
License Issues: http://wpbuoy.com/my-account/licenses

Include in your support request:

• License key (if Pro user)
• WordPress version
• PHP version
• Description of the issue
• Steps to reproduce
• Screenshots (if applicable)

• Security updates: Released immediately when needed
• Bug fixes: Released as needed (usually monthly)
• Feature updates: Quarterly releases
• Compatibility updates: When new WordPress versions release

All updates are free for active license holders.

The full changelog is available:

• In the plugin directory: CHANGELOG.md
• On the WordPress.org plugin page
• In your account dashboard (for Pro users)

Yes! We welcome feature requests:

• Free Users: Submit via WordPress.org forum
• Pro Users: Email support with detailed request
• Agency Users: Priority consideration for requests

Popular requests are added to the roadmap and announced via email.

Yes. We commit to:

• Testing with WordPress beta releases
• Updating before major WordPress releases
• Maintaining backward compatibility
• Supporting the latest 3 major WordPress versions

Security Issues: Email security@wpbuoy.com (do not post publicly)

Other Bugs:

1. Check if it’s already fixed in the latest version
2. Disable other plugins to rule out conflicts
3. Test with a default WordPress theme
4. Submit detailed report with:
   • Steps to reproduce
   • Expected vs actual behavior
   • Error messages
   • System information

We aim to fix critical bugs within 48 hours.

If you didn’t find your answer here:

1. Check Documentation: http://wpbuoy.com/docs
2. Search Support Forum: WordPress.org plugin support
3. Contact Support: support@wpbuoy.com (Pro users)
4. Community Forum: Free users can ask questions on WordPress.org