REST API Logging

coreActivity since version 2.4 includes a component for logging activities related to the WordPress REST API using 8 events. By default, all except one event are active on installation, and one event for tracking REST-API read is set to inactive, and if you want to use it, you need to enable it from the Events panel.

Valid REST API requests

If the REST API request is valid, and it generates the response, coreActivity will log it using several events to make the distinction of the request type:

• REST Item Read: Plain read the REST API endpoint, to get the data, without making content changes. Most REST requests are for getting content from the website, and because of that, this event is not active on install, because it can generate large number of log entries.
• REST Item Deleted: REST API endpoint with the DELETE method used to delete the content from the website. To be valid, DELETE requests have to be authorized. This event logs only authorized DELETE requests.
• REST Item Creates: REST API endpoint with the POST/PUT method used to create new item (posts, comment, term…). To be valid, this type of request has to be authorized. This event logs only authorized content creation requests.
• REST Item Edited: REST API endpoint with the POST/PUT method used to edit/update the content from the website. To be valid, this type of request has to be authorized. This event logs only authorized edit requests.

Invalid REST API requests

If the REST API request is not valid, various things can happen, and coreActivity can log all sorts of errors and problems with the REST requests.

• REST Route Unknown: If the attempt is made to access REST route that is not registered or unknown, this event will log the route in question. Unknown routes attempts can help you track the possible malicious bots, missing content and other issues.
• Unauthorized REST Request: If the attempt is made to access REST route using method that requires authorization, without valid authorization, the attempt will be logged. This can point to malicious attempts, where bots try to push changes to your website without valid authorization.
• Invalid REST Request: This event covers REST requests that website can’t resolve for various reasons, and return one of the 40x error codes (with the exception of 401 and 403).
• REST Server Error: If the request triggers internal server error on the website, this event will be logged. This can point to the server issue, missing or broken plugin that handles the REST route.

Importance of REST API logging

There are many reasons to have REST API logging active. In recent years, REST API is very important part of the WordPress for various purposes, and it is used more and more. Because of that, REST API is a target of the activity that is not always desirable.

• You can find user agents of bots that are accessing your website content via REST API. These types of requests can’t be logged by the normal website analytics systems, because they use JavaScript for tracking and can’t track REST requests.
• You can discover malicious attempts that don’t follow normal attack vectors, and are probing REST API routes to find some routs that can be exploited in some way due to the bad plugin implementing route.
• You can discover problems with the website content by analyzing invalid requests and server side errors happening during REST API calls.
• You can see all the malicious attempts to run REST API requests that are not authorized, or with invalid authorization pointing to a form of brute force attacks.

And, with the help of coreSecurity Pro, these REST API logs can be helpful in increasing website security.