functions.php: security check on wp-json; set global images display mode default

functions.php

@@ -5,6 +5,8 @@ if ( !defined( 'ABSPATH' ) ) {
 	exit;
 }
 
+//add_action( 'login_init', 'send_frame_options_header', 10, 0 );
+
 function openmamba_breadcrumbs() {
    $text['category'] = '';
 }
@@ -410,3 +412,22 @@ function hook_cookielaw()
 }
 
 */
+
+function wpb_imagelink_setup() {
+    $image_set = get_option( 'image_default_link_type' );
+
+    if ($image_set !== 'none') {
+        update_option('image_default_link_type', 'none');
+    }
+}
+add_action('admin_init', 'wpb_imagelink_setup', 10);
+
+/* Security: restrict access to wp-json */
+function restrict_rest_api_to_localhost() {
+    $whitelist = [ '127.0.0.1', "::1" ];
+
+    if( ! in_array($_SERVER['REMOTE_ADDR'], $whitelist ) ){
+        die( 'REST API is disabled.' );
+    }
+}
+add_action( 'rest_api_init', 'restrict_rest_api_to_localhost', 0 );