The /?rest_route URL is the non-prettified version of /wp-json, which is the URI the WordPress REST API uses.
The REST API should not be disabled since the Admin UI relies upon it. Having said that, you can require the REST API only service authenticated users. To require authentication, add the following rest_authentication_errors filter:
add_filter( 'rest_authentication_errors', function( $result ) {
// If a previous authentication check was applied,
// pass that result along without modification.
if ( true === $result || is_wp_error( $result ) ) {
return $result;
}
// No authentication has been performed yet.
// Return an error if user is not logged in.
if ( ! is_user_logged_in() ) {
return new WP_Error(
'rest_not_logged_in',
__( 'You are not currently logged in.' ),
array( 'status' => 401 )
);
}
// Our custom authentication check should have no effect
// on logged-in requests
return $result;
});
I added it to my /wp-includes/rest-api.php file as part of the rest_api_default_filters() function definition. Clearly, this will be overwritten as soon as a new version of WordPress is release, so this is only a temporary measure. When I visit my site via the REST API url above, without being authenticated, I see the following:
