WordPress build-in APIs might be useful in some cases, e.g. posting blog entries with a dedicated software. But they can be a common security risk.

_settingsUtility->displayCheckbox(__('XMLRPC API', 'tweakr'), 'disable-xmlrpc-api', array( 'label' => 'Disable API', 'description' => 'The XMLRPC API is used for Pingback Communication with external services as well as external control. This option will reject ALL xmlrpc actions by forcing the xmlrpc.php endpoint to return a HTTP403 response.', 'readmore' => 'https://codex.wordpress.org/XML-RPC_Support' )); // Restrict REST API $this->_settingsUtility->displayCheckbox(__('REST API', 'tweakr'), 'restrict-rest-api', array( 'label' => 'Restrict Access', 'description' => 'The REST JSON API will be restricted to Admin and Editor Users. Its not available for public access anymore.', 'readmore' => 'https://developer.wordpress.org/rest-api/' )); ?>

_settingsUtility->displayCheckbox(__('Monitoring API', 'tweakr'), 'monitoring-enabled', array( 'label' => 'Enable', 'description' => 'Adds a custom REST API Endpoint that allows you to query all installed plugins/themes.', 'readmore' => 'https://codeberg.org/AenonDynamics/wp-tweakr/src/branch/main/docs/Monitoring.md' )); ?>