Atte Liimatainen

<p>Converts frontend to JSON response when request is done with certain conditions.</p>
<h3>Inspiration</h3>
<p>After creating a bunch of headless WordPress + Web app stacks, I wanted to find a standard and a all-round solution for fetching per page information for web applications inside WordPress. Built-in rest api works fine in basic cases, but it doesn’t support querying by path. Usually this meant that for each project developers would create a custom rest endpoint which would return expected content using content type and slug parameters.</p>
<p>WordPress has few built-in functions to retrieve content by path, <a href="https://developer.wordpress.org/reference/functions/url_to_postid/" rel="nofollow ugc">url_to_postid</a> and <a href="https://developer.wordpress.org/reference/functions/get_page_by_path/" rel="nofollow ugc">get_page_by_path</a>, but they don’t seem to work with multilanguage plugins, taxonomy or archive pages, which means that WP doesn’t have a reliable way to fetch content this way through rest api.</p>
<p>This plugin converts frontend to JSON which seems after above solution the best way to do things, with added layer of security through application passwords (WordPress v5.6 feature) and a filter, which let’s developers alter outgoing data.</p>
<h3>How to start using the plugin</h3>
<ul>
<li>Install and activate this plugin in your environment</li>
<li>Create application password for a user with administrator role</li>
</ul>
<p>After above steps have been made, make a request to a page with added <a href="https://en.wikipedia.org/wiki/Basic_access_authentication#Client_side" rel="nofollow ugc">Authorization header</a>. See data fetching examples at the end of this documentation for more help</p>
<h3>Modifying the output</h3>
<p>Plugin outputs current page’s Post object or null. This can be modified using <code>headless-converter-modify-data</code>-filter. You can either modify passed in post object or do your own logic like in the example below.</p>
<pre><code>/**
 * Modifies Headless Converter plugin's output.
 * 
 * @param WPPost|null $post - Current template's post object 
 */
function modify_headless_converter_output($post) {
  if(is_404()) {
    return "this block renders 404 page content";
  } else if(is_page()) {
    return "this block renders page post types content";
  } else if (is_singular('post')) {
    return "this block renders single post content";
  } else if(is_home()) {
    return "this block renders post archive";
  } else {
    return $post;
  }
}

add_filter('headless-converter-modify-data', 'modify_headless_converter_output');
</code></pre>
<h3>Data fetching examples</h3>
<h4>Fetch</h4>
<pre><code>const username = "admin"
const password = "1111 1111 1111 1111 1111"
const url = "http://localhost:3000/?page_id=2"
const opts = {
  headers: {
     'Authorization': 'Basic ' + btoa(username + ":" + password) 
  }, 
}
fetch(url, opts).then(r => r.json()).then(console.log)
</code></pre>
<h4>Axios</h4>
<pre><code>const axios = require("axios")

const username = "admin"
const password = "1111 1111 1111 1111 1111"
const url = "http://localhost:3000/?page_id=2"
const opts = {
  auth: {
    username,
    password
  }
}

axios(url, opts).then(r => r.data).then(console.log)
</code></pre>


Headless Converter

Converts frontend to JSON response when request is done with certain conditions.

Elementor

<p>Sticklight Connector provides a structured way to use the WordPress user system in external or React-based applications.</p>
<p>The plugin extends the WordPress REST API with additional endpoints that allow authenticated clients to retrieve user context and interact with WordPress data, while fully respecting core authentication methods, roles, and capability checks.</p>
<p>Sticklight does not replace WordPress authentication. It relies on <code>wp_authenticate</code> for credential validation and WordPress Application Passwords for API access, and follows standard permission checks (<code>current_user_can</code>) for all requests.</p>
<h4>Typical use cases</h4>
<ul>
<li>React applications connected to a WordPress site</li>
<li>Headless or hybrid WordPress setups</li>
<li>Admin or user dashboards built outside wp-admin</li>
<li>External tools that require authenticated access to WordPress data</li>
</ul>
<h4>Features</h4>
<ul>
<li>Authenticates via <code>wp_authenticate</code> and issues Application Passwords for API access</li>
<li>Adds REST endpoints for login, logout, and retrieving current user context</li>
<li>Enforces WordPress capability checks on all requests</li>
<li>Supports cross-origin headless setups</li>
<li>Extensible via WordPress hooks and filters</li>
</ul>
<h3>Usage</h3>
<h4>Login</h4>
<p>Authenticate with username (or email) and password:</p>
<pre><code>POST /wp-json/sticklight/v1/auth/login
</code></pre>
<p>On success the response includes an Application Password for subsequent API requests and the authenticated user:</p>
<pre><code>{
  "app_password": "XXXX XXXX XXXX XXXX XXXX XXXX",
  "user": {
    "user_id": 1,
    "username": "admin",
    "display_name": "Admin",
    "email": "admin@example.com",
    "roles": ["administrator"]
  }
}
</code></pre>
<p>Use the returned <code>app_password</code> with HTTP Basic Authentication for all further requests.</p>
<h4>Current user</h4>
<p>Retrieve the current authenticated user:</p>
<pre><code>GET /wp-json/sticklight/v1/auth/me
</code></pre>
<h4>Logout</h4>
<p>Revoke the current Application Password session:</p>
<pre><code>POST /wp-json/sticklight/v1/auth/logout
</code></pre>
<h4>User registration</h4>
<p>User creation is handled through the built-in WordPress REST API (<code>POST /wp-json/wp/v2/users</code>) and requires administrator authentication.</p>
<h4>Accessing protected data</h4>
<p>Requests to any endpoint must pass standard WordPress permission checks. Sticklight does not bypass or override these checks.</p>
<h3>Security</h3>
<p>Sticklight follows WordPress security practices:</p>
<ul>
<li>Authenticates via <code>wp_authenticate</code>, which respects all security plugin hooks (rate limiting, two-factor authentication, brute-force protection)</li>
<li>Issues Application Passwords scoped to individual sessions</li>
<li>Does not provide user registration — accounts must be created by an administrator</li>
<li>Applies capability checks (<code>current_user_can</code>) on all endpoints</li>
<li>Does not expose private data without proper permissions</li>
</ul>
<p>For external applications, it is recommended to:</p>
<ul>
<li>Use HTTPS</li>
<li>Restrict allowed origins</li>
<li>Avoid exposing sensitive endpoints unnecessarily</li>
</ul>


Sticklight

Use WordPress authentication and permissions in external React applications via secure REST API endpoints.

Headless Converter vs Sticklight