More reliable 将允许使用特定IP而不是域REMOTE_ADDR 标题。您可以使用HTTP_REFERRER 标题，但it is not reliable.

您可以通过使用rest_authentication_errors 滤器

add_filter( \'rest_authentication_errors\', \'wpse150207_filter_incoming_connections\' );

function wpse150207_filter_incoming_connections( $errors ){

    $allowed_ips = array( \'127.0.0.1\' );
    $request_server = $_SERVER[\'REMOTE_ADDR\'];

    if( ! in_array( $request_server, $allowed_ips ) )
        return new WP_Error( \'forbidden_access\', \'Access denied\', array( \'status\' => 403 ) );

    return $errors; 

}

Note: 该解决方案适用于WPv4.4.2 + Rest APIv2.0-beta12.

所提供的软件具有利用WordPress Nonce系统的工具。正如现在所写的，nonce仅用于通过API调用验证post的提交。好消息是，代码组织得很好，可以很容易地自定义代码，以要求所有API请求都提交nonce（或其他安全令牌系统）。

注意：nonce是一个“使用一次的数字”，用于保护URL和表单不被滥用。参考号：http://codex.wordpress.org/WordPress_Nonces nonce在托管站点上生成，然后发送给用户，以便用户可以将其包含在API请求中以验证其权限。一个nonce只适用于两次验证检查，如果未使用的将在24小时内过期。有一个问题是，任何人都可能“要求”临时密码，也许你必须恢复到密码/id系统。

== Method: get_nonce ==
Returns a WordPress nonce value, required to call some data manipulation methods.
= Required arguments =
* `controller` - the JSON API controller for the method you will use the nonce for
* `method` - the method you wish to call (currently `create_post` is the only method that requires a nonce)
= Response =
    {
      "status": "ok",
      "controller": "posts",
      "method": "create_post",
      "nonce": "cefe01efd4"
    }  

== Method: create_post ==
Creates a new post.
= Required argument =
* `nonce` - available from the `get_nonce` method (call with vars `controller=posts` and `method=create_post`)
= Optional arguments =
* `status` - sets the post status ("draft" or "publish"), default is "draft"
* `title` - the post title
* `content` - the post content (etc...)

<?php
require_once \'HTTP/Client.php\';
$http = new HTTP_Client();
$http->get(\'http://wordpress.test/?json=core.get_page&slug=about&dev=1&nonce=cefe01efd4\');
$response = $http->currentResponse();
$response = json_decode($response[\'body\']);

echo "Response status: $response->status\\n";
echo "Page title: {$response->page->title}\\n";
?>
--EXPECT--
Response status: ok
Page title: About Us -- This is an awesome website.

对于那些在2021读到这篇文章的人来说@Sisir

WordPress: 版本5.7.2PHP: 版本7.4

你有没有试过Permission Callback ?

根据WP的以下2个nice来源REST API Handbook:
REST API Handbook / Extending the REST API / Routes and Endpoints
REST API Handbook / Extending the REST API / Adding Custom Endpoints

/**
 * Permission Callback function:
 * \'ypp\' is the Prefix I chose (ypp = Your Private Page)
 */

function ypp_get_private_data_permissions_check() {
    /**
     * Restrict endpoint to allowed IPs (white listing approach)
     */
    $allowed_ips = array( \'127.0.0.1\' );
    $request_server = $_SERVER[\'REMOTE_ADDR\'];

    if( ! in_array( $request_server, $allowed_ips ) )
        return new WP_Error( \'rest_forbidden\', esc_html__( \'Access denied from your IP address.\', \'my-text-domain\' ), array( \'status\' => 401 ) );

    return true;
};

add_action(\'rest_api_init\', function() {
    /**
    * Register here your custom routes for your CRUD functions
    */
    register_rest_route( \'your_private_page/v1\', \'/data\', array(
        array(
            \'methods\'  => WP_REST_Server::READABLE,
            \'callback\' => \'get_your_data\', // <-- your main callback function
            // Always allow GET, for example
            \'permission_callback\' => \'__return_true\' // <-- to leave it open
            ),
        array(
            \'methods\'  => WP_REST_Server::CREATABLE,
            \'callback\' => \'insert_your_data\', // <-- your main callback function
            // Here we register our permissions callback. The callback is fired before the main callback to check if the current user can access the endpoint.
            \'permission_callback\' => \'ypp_get_private_data_permissions_check\',
        ),
        array(
            \'methods\'  => WP_REST_Server::EDITABLE,
            \'callback\' => \'update_your_data\', // <-- your main callback function
            // Here we register our permissions callback. The callback is fired before the main callback to check if the current user can access the endpoint.
            \'permission_callback\' => \'ypp_get_private_data_permissions_check\',
        ),
    ));
});