Add snippet for Disable WP REST API compatibility

[pfefferle]

Related: https://wordpress.org/support/topic/conflicts-between-activitypub-and-disable-wp-rest-api/#post-19037585

Proposed changes:

• Add a standalone, opt-in snippet allowing ActivityPub requests through the free Disable WP REST API plugin's existing allowlist filter.
• Match WordPress's resolved REST route, covering pretty/plain permalinks and built-in WebFinger/NodeInfo rewrites without exempting unrelated namespaces.
• Preserve existing allowlist entries and ActivityPub's own authentication, signature and permission checks.
• Include installation instructions and focused regression tests. No automatic integration or changes to the main plugin's behavior.

Other information:

• Have you written new tests for your changes, if applicable?

All 18 snippet tests (20 assertions) and targeted PHPCS pass. A focused code review found no actionable issues. Skip Changelog: snippets are opt-in and excluded from the distributed plugin.

Testing instructions:

• Install and activate ActivityPub and the free Disable WP REST API plugin on a test site. Logged-out REST requests should initially return rest_login_required.
• Copy snippets/disable-wp-rest-api/ into wp-content/plugins/ and activate Allow ActivityPub through Disable WP REST API. Alternatively, put its PHP file in wp-content/mu-plugins/.
• Logged out, request an enabled actor's /wp-json/activitypub/1.0/actors/<id> endpoint and /.well-known/webfinger?resource=acct:<account>@<domain>. They should reach ActivityPub normally.
• Repeat with /?rest_route=/activitypub/1.0/actors/<id>. Verify /wp-json/wp/v2/users remains restricted, including when a query parameter contains an ActivityPub URL.
• Confirm protected ActivityPub operations still require their usual permissions/signatures. Deactivate the snippet and confirm the original restriction returns.
• Run npm run env-test -- --filter=Test_Disable_Wp_Rest_Api.

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message

[Copilot]

Copilot review overview

🟡 Changes recommended

The documented installation can overwrite Disable WP REST API and remove its REST restrictions.

Review effort: Balanced
Findings: 1

Open (1)

• Install snippet separately to preserve REST API login restriction · New

What changed in this PR

Adds an opt-in compatibility snippet that keeps ActivityPub endpoints accessible when Disable WP REST API restricts REST access, without changing the main plugin.

Changes:

• Allows resolved ActivityPub routes while preserving existing allowlist entries.
• Documents installation and compatibility boundaries.
• Adds regression tests and snippet-testing guidance.

File	Description
tests/​README.md	Documents snippet test placement and cleanup.
tests/​phpunit/​tests/​snippets/​disable-wp-rest-api/​class-test-disable-wp-rest-api.php	Tests route matching, exclusions, and allowlist preservation.
snippets/​README.md	Adds the snippet to the catalog.
snippets/​disable-wp-rest-api/​README.md	Explains installation, behavior, and requirements.
snippets/​disable-wp-rest-api/​disable-wp-rest-api.php	Implements the ActivityPub route exception.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.