WordPress 7.0 introduces built-in AI capabilities and the new Connectors API, making it easier than ever for plugins and themes to connect with AI providers and external services.
If you’re running a Multisite network, however, you may have missed an important change: sub-site administrators can now access a new Settings → Connectors screen and configure external integrations on their own.
For standalone sites having a Connectors settings page makes perfect sense. For Multisite environments, it’s a different story.
The MultiSite story
In a Multisite ecosystem, leaving AI features and connection screens accessible to every single sub-site administrator can quickly lead to API clutter, security compliance issues, and uncoordinated external connections. As network super-admins, we need absolute, centralized control over what data are saved in our network and what leaves our network.
Until WordPress provides a native Multisite option to disable AI features and Connectors network-wide – similar to how plugins can be managed centrally by Super Admins – the following approach offers a practical workaround.
The Solution: A 3-Layer Lockdown
To completely restrict AI features and Connectors across a Multisite network, we’ll implement controls at three different layers using wp-config.php and a network-wide Must-Use Plugin (MU Plugin).
Layer 1: Disable AI Support Globally
First, disable the core AI functionality for the entire network by adding the following constant to your wp-config.php file:
// Disable core AI support network-widedefine( 'WP_AI_SUPPORT', false );
Unfortunately, this doesn’t hides the Connectors screen from the subsites.
Layer 2: Hide the Connectors Screen and Block Direct Access
Because this is a Multisite environment, the restriction should live in an MU Plugin so individual site administrators cannot disable it.
Create a file called ai-hide.php inside:
/wp-content/mu-plugins/
Then add the following code:
<?php/** * Plugin Name: Network-Wide AI & Connectors Restriction * Description: Fully disables AI features, hides the Connectors UI, and blocks REST API access for sub-sites. * Version: 1.0 */// Remove the Connectors submenufunction ls_remove_core_connectors_menu() { remove_submenu_page( 'options-general.php', 'options-connectors.php' );}add_action( 'admin_menu', 'ls_remove_core_connectors_menu', 999 );// Block direct access to the Connectors screenfunction ls_disable_connectors_screen() { global $pagenow; if ( 'options-connectors.php' === $pagenow ) { wp_die( __( 'The Connectors screen has been disabled on this site.' ),'', array( 'response' => 403 ) ); }}add_action( 'admin_init', 'ls_disable_connectors_screen' );
This removes the menu entry and prevents direct access to the Connectors screen.
Layer 3: Block AI & Connector REST API Requests
Hiding the interface alone isn’t enough.
Modern WordPress features rely heavily on REST API endpoints behind the scenes. Even if the Connectors screen is hidden, requests can still be triggered by JavaScript running in the Block Editor or by external API calls.
To close that gap, add the following filter to the same MU Plugin:
Caution: Untested code
// Block REST API requests targeting AI or Connectorsfunction ls_block_ai_rest_endpoints( $result, $server, $request ) { $route = $request->get_route(); if ( strpos( $route, '/ai/' ) !== false || strpos( $route, '/connectors/' ) !== false ) { return new WP_Error( 'rest_forbidden', __( 'AI features and Connectors have been disabled on this network.' ), array( 'status' => 403 ) ); } return $result;}add_filter( 'rest_pre_dispatch', 'ls_block_ai_rest_endpoints', 10, 3 );
The Result
With these three layers in place:
- No WordPress core files are modified, so everything remains update-safe.
- Sub-site administrators no longer see the Connectors screen.
- Direct access attempts are blocked with a 403 response.
- REST API requests targeting AI and Connector endpoints are rejected before they can be processed.
It’s not as convenient as having a built-in network setting from WordPress itself, but until that option exists, this approach provides a clean and effective way to keep AI features and Connectors under centralized Multisite control.
The code
The complete code for the mu-plugins file can be found at: https://github.com/lenasterg/wpms_snippet/blob/master/mu-plugins/lswp-disable-core-connectors.php
Irony alert:
This post and code—discussing how to block AI features—were crafted with the help of AI. No algorithms were harmed in the making of this network-wide restriction.











