[wp-trac] [WordPress Trac] #39806: Disable REST API by default, making it opt-in rather than always-on

[WordPress Trac]

#39806: Disable REST API by default, making it opt-in rather than always-on
-------------------------+------------------------------
 Reporter:  mor10        |       Owner:
     Type:  enhancement  |      Status:  new
 Priority:  normal       |   Milestone:  Awaiting Review
Component:  REST API     |     Version:  trunk
 Severity:  normal       |  Resolution:
 Keywords:               |     Focuses:
-------------------------+------------------------------

Comment (by mor10):

 Replying to [comment:1 ocean90]:
 > > and enable it only when the site admin requests it or a theme or
 plugin is dependent on it for full functionality.
 >
 > And what about core itself? #39634, #39553, #38922, #38343, #38342,
 #38920 or #34207, to name just a few.

 From the looks of it, these are mostly admin features, no? If so would it
 be feasible to enable the REST API only on admin?

 For clarity, I know eventually WP will use the REST API heavily at which
 point it should be enabled by default. However, at this moment in time it
 is still in its infancy and recent events show it still has room to
 mature. Therefore it seems only reasonable to limit its availability to
 only cases where it is actually in use, and allow site owners/admins to
 make an active decision to disable the feature if they do not want or need
 it. Treat it as what it is: progressive enhancement.

 I'm not working against progress here, I just want to leave control of
 such a powerful feature in the hands of the site owners. I've seen many
 compelling reasons for disabling the feature, very few for leaving it
 always-on.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/39806#comment:3>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform