With the WordPress REST API Authentication plugin by miniOrange you can protect WP REST API endpoints from public access.

Disable FacetWP's API endpoints in the 'Protected REST APIs' settings list.
To prevent 403 errors, disable FacetWP’s API endpoints in the “Protected REST APIs” settings list.

With the free version of this plugin, third-party plugins (like FacetWP) are excluded from authentication. However, with the default settings enabled, this plugin will unexpectedly block access to FacetWP’s /facetwp/v1/refresh and /facetwp/v1/fetch endpoints. This will cause 403 errors on refresh (when filtering), which leads to non-functioning facets.

To fix this issue, you can either upgrade to a suitable premium plan of this plugin, or disable FacetWP’s API endpoints in the “Protected REST APIs” settings list.

See also