Issue Overview
A site admin noticed a security alert from the miniOrange plugin:
“Alert: 2390 unrestricted APIs accessed. Each one could be an open door to vulnerabilities…”
Despite the alarming tone, there were no signs of suspicious activity or vulnerabilities on the site.
Our Findings
Alert Context
The alert was part of miniOrange’s upsell strategy—aimed at promoting premium features rather than flagging actual risk.
Secure Endpoints
All custom REST APIs were protected. Only internal miniOrange endpoints remained open, which is expected for plugin functionality.
️ No Data at Risk
No sensitive or public-facing data was exposed. No unusual traffic or breach indicators were detected.
✅ Safe to Ignore
Freshy confirmed that the current configuration was secure, and the alert did not require action unless the client wanted premium features.
Outcome
The warning was classified as non-critical and marketing-driven. No plugin changes were necessary, and REST API access remained secure as configured.
Unsure About Plugin Warnings?
At Integriti Studio, we separate real threats from exaggerated alerts. Let us review your WordPress setup and lock down what actually matters.
Get a Security Audit →
Frequently Asked Questions (Understanding miniOrange REST API Warnings in WordPress)
How to fix rest API error in WordPress?
To fix a WordPress REST API error, resave permalinks, temporarily disable caching and security plugins, check your PHP version and memory limit, reset the .htaccess file, and test for plugin or theme conflicts by deactivating plugins one by one and switching to a default theme.
How to check if rest API is enabled in WordPress?
To check whether the WordPress REST API is enabled, open your browser and go to yourwebsite.com/wp-json/. If the page displays JSON data or available routes, the REST API is working. If you see an error, it may be disabled by a plugin, theme, or server settings.
How to secure WordPress rest API?
To secure the WordPress REST API, restrict public endpoints, require authentication for sensitive routes, and disable unused endpoints using plugins or custom code. Use HTTPS, keep WordPress and plugins updated, apply proper user roles, and protect the site with a firewall or security plugin.
How does the WordPress rest API work?
The WordPress REST API works by exposing site data through JSON endpoints like /wp-json/. It lets external apps, themes, and plugins send GET, POST, PUT, or DELETE requests to read or update content. Authentication controls access to protected data and actions.