Andrew Wilkinson

<p>A lightweight plugin that <strong>forces login for backend access</strong> in a headless WordPress setup. Keeps your WordPress dashboard private while allowing your front end (e.g. Astro, Next.js) to pull content via GraphQL/REST.</p>
<h4>What it does</h4>
<ul>
<li>Requires authentication for <code>/wp-admin/</code> and other backend pages</li>
<li>Always allows the login page to avoid redirect loops</li>
<li>Leaves key endpoints open for headless use:
<ul>
<li><code>/wp-json/</code> (REST API)</li>
<li><code>/graphql</code> (WPGraphQL)</li>
<li><code>/wp-admin/admin-ajax.php</code> (AJAX)</li>
<li><code>/wp-cron.php</code> (cron)</li>
<li><code>/robots.txt</code></li>
<li><code>/sitemap*.xml</code> (sitemaps and indexes)</li>
<li><code>/wp-content/uploads/*</code> (media)</li>
<li><code>/favicon.ico</code></li>
<li><code>/newrelic</code> (New Relic monitoring)</li>
</ul>
</li>
<li>Logged-in users visiting the backend root get redirected to the dashboard</li>
<li>Works with Bedrock layouts (handles root path vs <code>/wp/</code>)</li>
</ul>
<h4>Use case</h4>
<ul>
<li>WordPress is the content backend</li>
<li>Public site is built with Astro/Next.js/etc</li>
<li>Editors log in to WordPress. Visitors never see the backend</li>
<li>Front end builds and live pages can still query GraphQL/REST without authentication</li>
</ul>
<h4>Customization</h4>
<p>Developers can customize allowed endpoints using the <code>force_login_allowed_patterns</code> filter:</p>
<pre><code>add_filter('force_login_allowed_patterns', function($patterns) {
    $patterns[] = '#^/healthz$#';           // custom health check
    $patterns[] = '#^/status$#';            // uptime checks
    $patterns[] = '#^/wp-json/acf/v3/.*#';  // specific REST namespace
    return $patterns;
});
</code></pre>


Headless Login Guard

Forces login for backend access in headless WordPress setups while allowing GraphQL/REST API endpoints and essential paths.

ashwathama

<p>Atlasly helps you build schema-driven data models inside WordPress and use them through REST API and GraphQL.</p>
<p>Use Atlasly when you need:</p>
<ul>
<li>Structured content types and entries</li>
<li>API-first workflows for headless WordPress</li>
<li>Form submission capture and data storage</li>
<li>Import/export for operational workflows</li>
<li>Relationship fields and flexible schema design</li>
</ul>
<p>This free plugin includes:</p>
<ul>
<li>Content type builder with 20+ field types</li>
<li>Entry management with CRUD operations</li>
<li>REST API endpoints for content types and entries</li>
<li>GraphQL endpoint for querying data</li>
<li>File uploads through WordPress media library</li>
<li>Relationship fields between entries</li>
<li>Import/export in CSV, JSON, and XML</li>
<li>Setup wizard and admin dashboard</li>
<li>Basic webhook triggers for create/update/delete events</li>
</ul>


Atlasly Content Manager

Schema-driven content types, entries, REST API, GraphQL, and form capture for modern WordPress projects.

Headless Login Guard vs Atlasly Content Manager