Andrew Wilkinson

A lightweight plugin that forces login for backend access in a headless WordPress setup. Keeps your WordPress dashboard private while allowing your front end (e.g. Astro, Next.js) to pull content via GraphQL/REST.
<h4>What it does</h4>
<ul>
<li>Requires authentication for <code>/wp-admin/</code> and other backend pages</li>
<li>Always allows the login page to avoid redirect loops</li>
<li>Leaves key endpoints open for headless use:
<ul>
<li><code>/wp-json/</code> (REST API)</li>
<li><code>/graphql</code> (WPGraphQL)</li>
<li><code>/wp-admin/admin-ajax.php</code> (AJAX)</li>
<li><code>/wp-cron.php</code> (cron)</li>
<li><code>/robots.txt</code></li>
<li><code>/sitemap*.xml</code> (sitemaps and indexes)</li>
<li><code>/wp-content/uploads/*</code> (media)</li>
<li><code>/favicon.ico</code></li>
<li><code>/newrelic</code> (New Relic monitoring)</li>
</ul>
</li>
<li>Logged-in users visiting the backend root get redirected to the dashboard</li>
<li>Works with Bedrock layouts (handles root path vs <code>/wp/</code>)</li>
</ul>
<h4>Use case</h4>
<ul>
<li>WordPress is the content backend</li>
<li>Public site is built with Astro/Next.js/etc</li>
<li>Editors log in to WordPress. Visitors never see the backend</li>
<li>Front end builds and live pages can still query GraphQL/REST without authentication</li>
</ul>
<h4>Customization</h4>
Developers can customize allowed endpoints using the <code>force_login_allowed_patterns</code> filter:
<pre><code>add_filter('force_login_allowed_patterns', function($patterns) {
 $patterns[] = '#^/healthz$#'; // custom health check
 $patterns[] = '#^/status$#'; // uptime checks
 $patterns[] = '#^/wp-json/acf/v3/.*#'; // specific REST namespace
 return $patterns;
});
</code></pre>

Headless Login Guard

Forces login for backend access in headless WordPress setups while allowing GraphQL/REST API endpoints and essential paths.

Dropndot Solutions

Redirection Manager is a powerful redirect management plugin designed for both classic WordPress sites and Headless WordPress setups, perfect for developers building modern frontends with Next.js, Nuxt.js, React, and other JavaScript frameworks.
Note: The plugin WPGraphQL (https://wordpress.org/plugins/wp-graphql/) is required for GraphQL functionality.
<h4>Key Features</h4>
Global Redirect Management: 
– Intuitive admin interface to add, edit, and delete redirects 
– Support for 301 (Moved Permanently), 308 (Permanent Redirect), and 410 (Gone) status codes 
– Advanced search and filtering by status code 
– Pagination support for large redirect lists 
– CSV export functionality for backup and migration 
– Automatic URL normalization for consistency
Post-Level Redirects: 
– Meta box on all public post types (posts, pages, custom post types) 
– Set redirects directly from the post editor 
– Supports 301, 308, and 410 redirects at the post level 
– Automatic handling during template_redirect
Content Management: 
– Related content detection – automatically identifies posts/pages/terms associated with redirect URLs 
– Quick access to edit or view related content 
– Option to trash content when creating redirects 
– Support for WooCommerce products
GraphQL Integration: 
– Fetch all global redirects via GraphQL query 
– Post-level redirect fields (redirectType, redirectUrl) on all post types 
– Perfect for headless CMS implementations 
– Optimized for frontend frameworks
Developer-Friendly: 
– Clean, well-documented code following WordPress coding standards 
– Custom database table for optimal performance 
– AJAX-powered admin interface 
– Full security with nonce verification and capability checks 
– Extensible architecture
<h4>Supported Redirect Types</h4>
<ul>
<li>301 – Moved Permanently: Traditional permanent redirect with destination URL</li>
<li>308 – Permanent Redirect: Modern permanent redirect that preserves HTTP method</li>
<li>410 – Gone: Indicates content is permanently deleted (no destination URL needed)</li>
</ul>

Redirection Manager

Easily manage redirects when using WordPress as a Headless CMS with frontend frameworks like Next.js, Nuxt.js, React, etc. GraphQL ready!

Headless Login Guard vs Redirection Manager