REST API blocked for anyone not logged

Hi,

Thank you for bringing this issue to our attention. The document indeed needed updating.

For this scenario, you can use the following code:

add_filter('rest_authentication_errors', 'allow_rest_api_for_local_ips');
function allow_rest_api_for_local_ips($errors)
{
// if there is already an error, just return it
if (is_wp_error($errors)) {
return $errors;
}
$whitelist = array(
'127.0.0.1',
// etc
);
if (!in_array($_SERVER['REMOTE_ADDR'], $whitelist)) {
// return WP_Error object if user is not logged in
return new WP_Error('no_rest_api_sorry', 'REST API not allowed', array('status' => 401));
}
return $errors;
}

Please let me know if you have any further questions or need assistance.
Regards,