Decide what the public REST API index advertises. Guests see only what you allow; logged-in users always see everything.

Version 0.0.6. Requires WordPress 6.0+ and PHP 8.0.

The problem

WordPress publishes a full map of its REST API at /wp-json/ — every namespace, every route, every method — to anyone who asks, no login needed. That map tells an attacker (or their AI) exactly which admin tools exist on your site and where to probe. The routes themselves are protected by authentication, but the map does not need to be public.

DeepGravity API Manager puts you in charge of that map.

What it does

Discovers — Scans your site’s full REST surface and inventories every namespace and route. Each namespace is classified as admin (every route requires authentication) or public (at least one route is publicly accessible). The first scan is queued on activation and runs on the next REST request; further scans run weekly and on demand.

Decides — A settings page under Settings > API Manager lists every namespace with its classification and route count, and a visibility toggle (Public / Hidden). New admin namespaces follow your default policy (Hidden by default, the safe choice). Public namespaces always stay visible.

Enforces — A filter on the public index strips hidden namespaces for unauthenticated visitors. Logged-in users see the full index unchanged. Public content routes (posts, pages, media, oEmbed, ActivityPub) stay visible, so federation and embedding keep working.

Operates — The same configuration is available through the plugin’s own REST API (dg-api-mgr/v1): list namespaces, set visibility, trigger a scan, check status. All endpoints require the manage_options capability. An AI agent can operate the tool through this API with no browser; a human can use the settings page. Either way, or both together — the settings page is a backup and human-friendly tool, nothing requires a human to ever open it.

Operation modes

All-user: manage everything from the settings page.
All-AI: manage everything through the REST API.
Hybrid: you decide, your agent executes — the shape the tool is designed toward, and one option among many.

Guests vs logged-in users

The filter runs only for unauthenticated requests to /wp-json/. Guests see the index with hidden namespaces stripped. Logged-in users see the full index, unchanged, always.

Admin vs public classification

A namespace is classified admin when every route in it requires authentication, and public when at least one route is publicly accessible. The inventory records, for each public namespace, the first guest-accessible route that made it classify public, so a public classification can be explained instead of taken on faith. Public namespaces always stay visible by default; admin namespaces follow your default policy for new namespaces, Hidden by default.

Standalone

DeepGravity API Manager works with or without DeepGravity. Any WordPress site can install it and lock down its public API index. When DeepGravity is present, the plugin plugs into the larger DeepGravity ecosystem; when it is not, the plugin stands on its own. Nothing is hard-coded to any site, user, or service.

Self-reference

The plugin’s own API namespace (dg-api-mgr/v1) appears in the visibility map like any other namespace. It is classified admin and hidden from guests under the default policy. Authenticated users still see it. The inspector inspects itself.

Price and what the annual plan includes

Annual plan: $50/year.

The annual plan includes the current build (version 0.0.6) and updates released during the term. Fulfilment is through your store account and download on this site. The licensing client is included in 0.0.6: Settings > API Manager gains a “License & updates” section where you enter the license key from your store account.

The only data the licensing check ever sends is four fields: your license key, an anonymous (resettable) site ID, the product name, and the installed version. No domain, no URL, no admin email, no content, no telemetry.

If a subscription lapses, the installed copy keeps working. A lapsed or revoked key stops feature updates; it never affects the installed copy — there is no deactivation, disable, or feature-gating logic in the client.

Security patching is the floor: security releases reach public versions whether or not a key is stored. With no key stored, the client adds no notices and no behaviour beyond the public-channel check on the normal WordPress update cycle.

Three versions, one core

This plugin is the WordPress wrapper (GPLv2 or later) around a platform-agnostic core. The core lives in core/class-core.php, is licensed under the Apache License 2.0, and has no WordPress dependency at all — it computes over plain arrays, and any host (another CMS, a CLI script, a test harness) can use it.

Core — Apache License 2.0, free. The logic, usable without WordPress.
WordPress plugin — GPLv2 or later, free, donationware. Updated to keep up with WordPress version tags or to patch a security issue.
Subscription — the annual plan on this page. The development trunk: changes land there as they happen, with early access to new features and expanded functionality during the subscription period. Free releases follow when WordPress forces a compatibility revision.

Frequently asked questions

Will hiding a namespace from the index break my site? No. Hiding a namespace from the public index only removes it from the discovery document at /wp-json/. The endpoints themselves keep working exactly as before for anyone who knows their URL and has the right credentials. Public content routes (posts, pages, media) and federation routes (ActivityPub, oEmbed) are classified public and stay visible by default.

Why is a public namespace listed as “Hidden” by default? It should not be. Namespaces classified public are always visible by default. If a public namespace shows as hidden, either its classification changed (a plugin update removed its public routes) or someone set it hidden by hand. Check the classification column; a public namespace marked hidden is worth a look before you change it back.

A new plugin added a namespace. What happens? The next scan (weekly, or the next time you press “Rescan now”) discovers it, classifies it, and assigns visibility: public namespaces become visible, admin namespaces follow your default policy (Hidden by default). Until the scan runs, an undiscovered namespace follows the default policy in the filter.

Does the filter slow down the site? No. The filter reads one small cached option and passes over the index arrays once. It runs only for unauthenticated requests to /wp-json/. No scanning happens inside the filter.

Can an AI agent manage this plugin? Yes. Every function on the settings page has an equivalent in the plugin’s REST API (dg-api-mgr/v1): GET /namespaces, POST /namespaces/{namespace}/visibility, POST /scan, GET /status. All endpoints require manage_options. An agent with those credentials can read the inventory, change visibility, and trigger scans without a browser.

What happens if I deactivate the plugin? The weekly scan is unscheduled and the filter stops running — guests see the full public index again, as WordPress ships it. Your inventory, visibility map, and settings are kept, so reactivating restores everything.

What happens if I delete the plugin? Deleting removes the inventory, visibility map, and settings entirely. Deactivating alone keeps them.

Requirements

Requires WordPress 6.0 or higher, and PHP 8.0 or higher. Tested up to WordPress 6.7 in the plugin’s readme header.

Manual and support

Full instructions are in the API Manager manual. Questions: support@deepgrav.com.

Read the API Manager manual

Support & contact

WordPress Plugins

DeepGravity API Manager — Annual