Title: API Write Blocker Author: teamredfox Published: 26 de octubre de 2025 Last modified: 26 de octubre de 2025 --- Buscar plugins ![](https://s.w.org/plugins/geopattern-icon/api-write-blocker.svg) # API Write Blocker Por [teamredfox](https://profiles.wordpress.org/teamredfox/) [Descargar](https://downloads.wordpress.org/plugin/api-write-blocker.1.0.zip) * [Detalles](https://es-ar.wordpress.org/plugins/api-write-blocker/#description) * [Valoraciones](https://es-ar.wordpress.org/plugins/api-write-blocker/#reviews) * [Instalación](https://es-ar.wordpress.org/plugins/api-write-blocker/#installation) * [Desarrollo](https://es-ar.wordpress.org/plugins/api-write-blocker/#developers) [Soporte](https://wordpress.org/support/plugin/api-write-blocker/) ## Descripción **API Write Blocker** is a security-focused plugin that prevents unauthorized or anonymous users from executing write operations through REST API, XML-RPC, and Admin- Ajax interfaces. Unlike generic API blockers, this plugin enables _fine-grained control_ over which HTTP methods (POST, PUT/PATCH, DELETE) are allowed, supports whitelist-based exceptions, and protects core endpoints without interfering with legitimate functionalities such as contact form submissions or plugin integrations. ### 🔐 Key Features **REST API Method-Level Blocking** * Independently block POST, PUT/PATCH, and DELETE requests. * Whitelist specific REST routes (prefix match supported) to allow legitimate access (e.g., contact forms). * Configure a custom HTTP status code and error message per request type. **XML-RPC Write Operation Blocking** * Disable only dangerous write-related XML- RPC methods (e.g., `wp.newPost`, `metaWeblog.editPost`) while keeping harmless calls untouched. * Return a custom status code and error message for blocked XML-RPC operations. **Admin-Ajax Write Protection** * Blocks known sensitive write-related Ajax actions( e.g., `save-post`, `upload-attachment`) for unauthenticated users. * Whitelist specific actions used by safe plugins like Contact Form 7. **Flexible Exceptions** * Authenticated users are always allowed by default. * IP Whitelist support (including CIDR ranges) for external systems or trusted clients. **Custom Response Messages** * Return custom error messages and HTTP status codes for each interface: REST, XML-RPC, and Admin-Ajax. This plugin is ideal for hardening your WordPress site without breaking functionality. ## Capturas [⌊Settings UI under "Settings" > "API/Write Restriction".⌉⌊Settings UI under "Settings" > "API/Write Restriction".⌉[ Settings UI under “Settings” > “API/Write Restriction”. [⌊REST API write method controls and whitelist management.⌉⌊REST API write method controls and whitelist management.⌉[ REST API write method controls and whitelist management. [⌊IP whitelist and Ajax action whitelist settings.⌉⌊IP whitelist and Ajax action whitelist settings.⌉[ IP whitelist and Ajax action whitelist settings. ## Instalación 1. Download the ZIP file and install it from “Plugins” > “Add New” > “Upload Plugin”. 2. OR, unzip the plugin and upload it to the `/wp-content/plugins/` directory. 3. Activate “API Write Blocker” from “Plugins” in the admin panel. 4. Go to “Settings” > “API/Write Restriction” to configure the plugin. ## Preguntas frecuentes ### Will this plugin block Contact Form 7 or similar plugins? No, as long as you whitelist the required routes (e.g., `contact-form-7/v1/contact- forms`) and Ajax actions (e.g., `wpcf7-submit`). The plugin is designed to safely allow necessary requests. ### Is it safe to disable write methods in the REST API? Yes. Many sites do not use REST-based write operations publicly. By default, WordPress allows unauthenticated POST, PUT, and DELETE calls which may be exploited by attackers. This plugin disables them unless explicitly allowed. ### Can I block XML-RPC write methods without disabling XML-RPC entirely? Yes. This plugin blocks only post-related XML-RPC methods and lets other functions like pingbacks or basic metaWeblog info pass, if desired. ### What happens to authenticated users? Authenticated (logged-in) users are always allowed to execute requests. This plugin mainly protects against unauthorized, anonymous, or non-whitelisted users. ## Reseñas No hay reseñas para este plugin. ## Colaboradores y desarrolladores “API Write Blocker” es un software de código abierto. Las siguientes personas han colaborado con este plugin. Colaboradores * [ teamredfox ](https://profiles.wordpress.org/teamredfox/) [Traduce “API Write Blocker” a tu idioma.](https://translate.wordpress.org/projects/wp-plugins/api-write-blocker) ### ¿Interesado en el desarrollo? [Revisa el código](https://plugins.trac.wordpress.org/browser/api-write-blocker/), echa un vistazo al [repositorio SVN](https://plugins.svn.wordpress.org/api-write-blocker/), o suscríbete al [log de desarrollo](https://plugins.trac.wordpress.org/log/api-write-blocker/) por [RSS](https://plugins.trac.wordpress.org/log/api-write-blocker/?limit=100&mode=stop_on_copy&format=rss). ## Registro de cambios #### 1.0 * Initial release. * REST API write method blocking (POST, PUT/PATCH, DELETE). * XML-RPC method-level write blocking. * Admin-Ajax write action blocking with whitelist. * IP and route/action whitelists. * Custom status code and message per interface. ## Meta * Versión **1.0** * Última actualización **hace 10 meses** * Instalaciones activas **10+** * Versión de WordPress ** 6.8 o superior ** * Testeado hasta **6.8.7** * Versión de PHP ** 7.4 o superior ** * Idioma * [English (US)](https://wordpress.org/plugins/api-write-blocker/) * [Vista avanzada](https://es-ar.wordpress.org/plugins/api-write-blocker/advanced/) ## Valoraciones Todavía no se enviaron reseñas. [Your review](https://wordpress.org/support/plugin/api-write-blocker/reviews/#new-post) [Ver todas las reseñas](https://wordpress.org/support/plugin/api-write-blocker/reviews/) ## Colaboradores * [ teamredfox ](https://profiles.wordpress.org/teamredfox/) ## Soporte ¿Tenés algo que decir? ¿Necesitás ayuda? [Ver el foro de asistencia](https://wordpress.org/support/plugin/api-write-blocker/)