Feed and REST API protection
Both default to on, including on sites upgrading from an earlier version.
| Setting | What it does |
|---|---|
| Protect RSS feeds | Requests to /feed/ return a 401 instead of listing your posts. |
| Protect the REST API | Requests to /wp-json/ return a 401 while site-wide protection is on. |
Why these exist: before version 1.1.0 both were open. A protected site would still publish post titles and excerpts at /feed/, and full content at /wp-json/wp/v2/posts, to anyone who asked. Turning these on is what makes protection actually cover your content.
The plugin’s own endpoints stay reachable so the password screen keeps working, and developers can allowlist specific routes with the ppsas_rest_allowed_routes filter.
These gates apply while site-wide protection is on. Per-page protections are enforced on the front end, where the requested page is known.
What is never protected
These stay reachable by design, because blocking them breaks things without hiding content:
robots.txt- Favicons
- The WordPress admin and login screens (login page protection is a Pro feature)
- AJAX and cron requests