Disable external access to REST API Endpoint

I would suggest to not use WP REST API for this purpose, since it’s being used on homepage and not any remote app/service.

The REST API is supposed to grant access to any already publicly available data to a remote developer.
Since you’re not providing any public data but registering users from homepage, Ajax might be a good alternative.
From official WordPress REST API Handbook

WordPress REST API provides API endpoints for WordPress data types that allow developers to interact with sites remotely by sending and receiving JSON (JavaScript Object Notation) objects. 

However this is not its only use case.

I would suggest to use Ajax for this purpose.

  • Include the nonce with Ajax request.

  • Hook the Ajax request handler with wp_ajax_nopriv action.

This makes sure the user is not logged in and the nonce makes sure that the form was generated by WordPress.

There are plugins already available for Ajax user registration, premium and free, WordPress plugins repository will be a good start.
I hope this alternative approach helps.

Related Posts:

  1. WordPress 4.7.1 REST API still exposing users
  2. wp-json and what data does it give away?
  3. Should I worry about SQL injection when using REST API?
  4. What is the difference between a cer, pvk, and pfx file?
  5. How to solve “Kernel panic – not syncing – Attempted to kill init” — without erasing any user data
  6. Is it possible to decrypt SHA1
  7. Error `sec_error_revoked_certificate` when viewed in Firefox only
  8. Convert .pfx to .cer
  9. how fix “this certificate cannot be verified up to a trusted certification authority”
  10. Getting a List of Currently Available Roles on a WordPress Site?
  11. Why should I use the esc_url?
  12. Where to securely store API keys and passwords in WordPress?
  13. Why escape if the_content isnt?
  14. Why are passwords exportable as plain text in WordPress?
  15. Full path disclosure on rss-functions.php
  16. What to use instead of wp_kses() in user output
  17. Are the default salts secure?
  18. is_email() VS sanitize_email()
  19. Subscribe to email for security fixes?
  20. What is the purpose of having a token in cookies?
  21. How to escape custom css?
  22. Understanding SVG vulnerabilities in WordPress related to a specific fix
  23. How is password strength calculated?
  24. Moving wp-config.php: Can this be done after site launch?
  25. How to secure or disable the RSS feeds?
  26. Make password invalid once logged out of password-protected page
  27. What is the wp-includes/certificates/ca-bundle.crt used for?
  28. Do you need to escape hard coded plain text?
  29. Encrypt emails?
  30. WordPress salts set in config and database
  31. Disallow file edit not preventing plugin install
  32. How to secure WordPress XMLRPC?
  33. Protecting HTML5 video [closed]
  34. How can I find security hole in my wordpress site?
  35. Does WP show me if I’m logged in from multiple locations?
  36. Do I need to use the esc_html() function on hard coded links?
  37. Disable REST API for a user ROLE
  38. HTTP Security Headers in wp-config
  39. WordPress Malware Problem help! [duplicate]
  40. Frontend Password change
  41. Restrictive File Permissions
  42. Downloading File from Outside Web Root
  43. Why are xmlrpc.php and wp-cron.php being called so often?
  44. Using esc_html with HTML purifier and CSSTidy: Overkill?
  45. wordfence scan warning on W3 Total Cache [closed]
  46. site get login attempts after htaccess ip restriction
  47. Is it good security advice to install wordpress in subdirectory but link to root?
  48. wp-config.php modified?
  49. Moving wp-config.php up 2 levels
  50. Securing wp-config leads to sensitive information leak on wp-settings
  51. How Could I sanitize the receive data from this code
  52. WordPress SQL Injections through User Agent
  53. What’s the point of forbidding access to wp-config.php?
  54. How to save iframe tag into a post?
  55. How to prevent wp-login brute force attack from thousand of different IP? [duplicate]
  56. What permissions should I give directories if I want to make WordPress more secure?
  57. How to protect wp-admin through .htaccess?
  58. Something is unescaping all html entities before output to browser [closed]
  59. Is wp_kses the right approach in sanitizing this string?
  60. Renaming install.php for security?
  61. Limit Login Attempts BEFORE PHP is executed?
  62. Which Versions of WordPress Ship with the Patched TimThumb?
  63. Safe to say WordPress security releases don’t have database upgrades
  64. Use global variables or function that returns said variables for site-wide private-ish WP settings?
  65. fail2ban to prevent Brute Force Attacks on WordPress?
  66. Use Google authentication for pages within a website [closed]
  67. How to give the same error message when the wrong password or wrong username is used?
  68. Do we need to escape data that we receive from theme options?
  69. should I escape a literal url added in functions.php
  70. Moving wp-config.php outside root folder where we have multiple wordpress websites for enhanced security [duplicate]
  71. Adding Security Keys?
  72. How might I sanitize an XML file before WP Import? (Does wordpress verify or clean text when importing from an XML document? )
  73. Secret keys in SCM
  74. Spam in WordPress root folder
  75. Secure Server after configuration
  76. Uploading attachment (pdf) and prevent download for anonymous user
  77. After limiting the access to my wp-login.php by IP through .htaccess, all my password-protected posts stopped working. What’s the best solution now?
  78. Woocommerce API security concerns
  79. Specific Page/Post Need to Stay Non SSL
  80. Block JSON access over the net
  81. Can someone do something to my website if I posted a snapped image of the header and covered my logo? (On reddit, when explaining a question)
  82. Scan multiple websites for malware that are in same webhost root?
  83. The in-famous Unable to locate WordPress Content directory (wp-content) and the Direct Method
  84. Security: AWS (shared hosting) claims template file malicious
  85. How to check whether a site has been compromised without browsing into it?
  86. My site thinks it’s secure when it is fact not
  87. Is it possible to only have the admin interface bind to the local loopback?
  88. PHP Code Sniffer – WordPress VIP Coding Standards
  89. How do I hide WordPress users from security scanning?
  90. Background Updates Not Happening
  91. Trying to understand nature of hacking
  92. Default installation permissions for wp-config.php
  93. Correct setup to block file modifications from hackers
  94. Is my WP site being hacked?
  95. Securing REST API wp-json/wp/v2/users endpoint
  96. How do you search for backdoors from the previous IT person?
  97. Possible to change email address in keypair?
  98. Why is SSH password authentication a security risk?
  99. Is wp-cron.php vulnerable to external attacks and how to protect it?
  100. How to address security vulnerabilities: LUCKY13, BEAST, and BREACH

Leave a Comment