How to Secure the REST-API and Still Use Independent Analytics

When someone visits a page on your site, Independent Analytics makes a single REST-API request that records the visit. Without the ability to use the REST-API, it cannot record any data.

If your site has disabled the REST API, you have to re-enable it now, or Independent Analytics will not be able to record stats.

Once the REST API has been re-enabled on your site, Independent Analytics will be able to record visits.

Can I still secure the REST API endpoints?

If you are concerned with securing the REST API while still using Independent Analytics, there are multiple options.

First, you can install a plugin like Disable REST API. This plugin allows you to disable the REST API while selectively enabling some endpoints.

Once you activate the Disable REST API plugin, you’ll find a new menu at Settings > Disable REST API. In this menu, you can click on the /iawp route to enable it, and then save your changes.

This will ensure that the /iawp route can be triggered by your visitors while locking down all other routes.

Alternatively, if you’d like to avoid installing another plugin, you can use the code snippet below:

function block_rest_api_except_ia( $access ) {
    if (!is_user_logged_in() && $_SERVER['REQUEST_URI'] != '/wp-json/iawp/search') {
        return new WP_Error( 'rest_disabled', __('The WordPress REST API has been disabled.'), array( 'status' => rest_authorization_required_code()));
    }
    return $access;
}
add_filter( 'rest_authentication_errors', 'block_rest_api_except_ia' );

This function will disable the REST API for anyone who isn’t logged in unless the request is for the Independent Analytics endpoint. This allows your analytics to be recorded without exposing any other endpoints.

You can add this code to a child theme, a custom plugin, or use a code snippet plugin like Code Snippets.