For WooCommerce merchants
Something is still calling the Legacy REST API. WooCommerce won't tell you what.
WooCommerce removed the Legacy REST API, but 400,000+ stores still run Automattic's own stopgap plugin because nobody can say what still depends on it. LegacyLens names every integration still calling it, maps each endpoint to its modern wc/v3 replacement, and gives a safe-to-remove verdict — only after 30 quiet days.
Install the free plugin from the WordPress.org directory first — this unlocks the full report for an account already watching your store.
Why 400,000+ stores are stuck
WooCommerce removed the Legacy REST API in version 9.0 (June 2024) and shipped a stopgap plugin — last updated over a year ago, rated 30/100, with 23 of its 29 reviews at one star. Two facts trap every store still running it:
- The Legacy REST API is not compatible with High-Performance Order Storage — while it's in use, HPOS stays off the table.
- Remove the plugin while something still depends on it, and that something breaks — usually an ERP sync, a mobile app, a POS, or a shipping provider. Orders quietly stop flowing.
The honest answer to “can I remove this yet?” is “I don't know who's still calling it.” LegacyLens answers that from your own store's traffic, not a guess.
Frequently asked
Doesn't WooCommerce already warn me about this?
WooCommerce 8.5+ can detect legacy calls, but it writes one log line per request — an integration polling every 60 seconds produces 40,000+ log lines a month and still never tells you who it is. LegacyLens stores a fixed-size summary instead: one row per integration and endpoint, with a name, not a log flood.
How does it know which integration is calling?
It matches the consumer key on each legacy request to the description you typed when you created that WooCommerce API key, so the report says "Warehouse ERP sync" instead of a truncated key you don't recognize.
Why does it wait before saying 'safe to remove'?
Because monthly and quarterly jobs exist — an accounting export that runs on the 1st, a POS reconciliation that runs quarterly. LegacyLens waits 30 days of total silence before calling it safe, so you don't remove the plugin and break something you forgot about.
What does the free tier show?
Whether legacy calls are happening at all, how many distinct integrations are responsible, and the current verdict. The paid tier names each integration, lists every endpoint it calls, and gives the modern wc/v3 replacement plus the breaking change for each one.
Does it store my API keys?
No. Only the last 7 characters of a consumer key are kept — the same truncated form WooCommerce itself already shows you — which is enough to match a call to a named key without ever storing the full credential.
Why does this matter for HPOS?
The Legacy REST API is not compatible with High-Performance Order Storage. As long as something still depends on it, your store is blocked from moving to HPOS.
LegacyLens watches your own store's Legacy REST API traffic and never touches checkout, tax, or payments. It cannot break a live order flow — it only reports on one.