Tomohiro Shiotani

<p>Content Bridge for Commerce provides a lightweight REST API endpoint that allows external commerce platforms such as Shopify to fetch WordPress editorial content.</p>
<p>This plugin does not sync databases or duplicate content. It simply exposes your WordPress posts through a clean, structured JSON API designed for external consumption.</p>
<h3>Key Features</h3>
<ul>
<li>Fetch latest WordPress posts via REST API</li>
<li>Filter posts by category or tag (using slug)</li>
<li>Return featured image, excerpt, and publish date</li>
<li>Optional conversion of Jetpack (i0.wp.com) CDN image URLs back to original URLs</li>
<li>Configurable default post count and limits</li>
<li>Built-in transient cache (5 minutes) to reduce database load</li>
<li>No data duplication or migration required</li>
</ul>
<h3>REST API Endpoint</h3>
<p>Base endpoint:</p>
<pre><code>/wp-json/content-bridge/v1/posts
</code></pre>
<p>Examples:</p>
<p>Latest posts:<br />
    /wp-json/content-bridge/v1/posts?per_page=4</p>
<p>Posts filtered by tag:<br />
    /wp-json/content-bridge/v1/posts?tax=post_tag&term=guidi&per_page=4</p>
<p>Posts filtered by category:<br />
    /wp-json/content-bridge/v1/posts?tax=category&term=news&per_page=4</p>
<p>If no taxonomy is specified, the API returns the latest posts from all published posts.</p>
<h4>Authentication</h4>
<p>This plugin protects its REST API using a simple API key mechanism.</p>
<p>Requests must include a valid API key via the following HTTP header:</p>
<p>X-Content-Bridge-Key: YOUR_API_KEY</p>
<p>If the API key is missing or invalid, the endpoint will return a 401 Unauthorized response.</p>
<p>The API key can be configured in the plugin settings screen.</p>
<p>The API key can be manually set or generated from the plugin settings screen.</p>
<h3>Settings</h3>
<p>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Content Bridge for Commerce</p>
<ul>
<li>Default number of posts</li>
<li>Maximum allowed posts per request</li>
<li>Image size (thumbnail / medium / large / full)</li>
<li>Excerpt length (word count)</li>
<li>Enable or disable Jetpack CDN URL unwrapping</li>
</ul>
<h3>Privacy</h3>
<p>Content Bridge for Commerce does not collect, store, or transmit any personal data.</p>
<p>The plugin only exposes publicly available WordPress post data (such as title, excerpt, featured image, and permalink) via a REST API endpoint.</p>
<p>No data is sent to external servers by this plugin.</p>


Content Bridge for Commerce

Bridge WordPress editorial content to Shopify and other commerce platforms via a simple REST API.

Md. Rakib Ullah

<p>Running a Headless WordPress site often involves exposing the REST API. Headless REST API Security provides tools for administrators to control which endpoints are accessible to the public or external applications.</p>
<p>This plugin restricts public access to REST API endpoints by default and offers a settings interface to allow-list only the specific routes required by a frontend application (such as Next.js, Gatsby, or mobile apps).</p>
<h3>Features</h3>
<ul>
<li><strong>Access Control:</strong> Restrict default public access to REST API endpoints.</li>
<li><strong>Route Allow-Listing:</strong> Specific API routes (e.g., <code>/wp/v2/posts</code>) can be enabled while others remain restricted.</li>
<li><strong>API Key Authentication:</strong> Supports an <code>X-API-KEY</code> header for server-to-server or frontend requests.</li>
<li><strong>Headless Redirect:</strong> Option to redirect users accessing the backend API URL to a specified frontend domain.</li>
<li><strong>Admin Access:</strong> Logged-in Administrators and Editors retain access to the API to support the Block Editor (Gutenberg) functionality.</li>
<li><strong>Plugin Support:</strong> Detects routes registered by third-party plugins for configuration.</li>
</ul>
<h3>Usage</h3>
<ol>
<li>Navigate to <strong>Settings > Headless Security</strong> in the WordPress dashboard.</li>
<li>Enable the <strong>Master Switch</strong> to activate the access restrictions.</li>
<li>Review the list of REST API routes and check the <strong>Allow</strong> box for endpoints the application requires.</li>
<li>Copy the generated <strong>API Key</strong> for use in application headers.</li>
<li>(Optional) Enter a <strong>Headless Frontend URL</strong> to configure redirects for visitors.</li>
</ol>


Headless REST API Security

Excellent plugin! Secures my headless WordPress API quickly and easily. Works perfectly with Next.js and mobile apps

Best Plugin for Securing Headless WordPress

Manage access to the WordPress REST API by restricting public endpoints, enabling specific route allow-listing, and handling API key authentication.

Content Bridge for Commerce vs Headless REST API Security