Andrew Wilkinson

<p>A lightweight plugin that <strong>forces login for backend access</strong> in a headless WordPress setup. Keeps your WordPress dashboard private while allowing your front end (e.g. Astro, Next.js) to pull content via GraphQL/REST.</p>
<h4>What it does</h4>
<ul>
<li>Requires authentication for <code>/wp-admin/</code> and other backend pages</li>
<li>Always allows the login page to avoid redirect loops</li>
<li>Leaves key endpoints open for headless use:
<ul>
<li><code>/wp-json/</code> (REST API)</li>
<li><code>/graphql</code> (WPGraphQL)</li>
<li><code>/wp-admin/admin-ajax.php</code> (AJAX)</li>
<li><code>/wp-cron.php</code> (cron)</li>
<li><code>/robots.txt</code></li>
<li><code>/sitemap*.xml</code> (sitemaps and indexes)</li>
<li><code>/wp-content/uploads/*</code> (media)</li>
<li><code>/favicon.ico</code></li>
<li><code>/newrelic</code> (New Relic monitoring)</li>
</ul>
</li>
<li>Logged-in users visiting the backend root get redirected to the dashboard</li>
<li>Works with Bedrock layouts (handles root path vs <code>/wp/</code>)</li>
</ul>
<h4>Use case</h4>
<ul>
<li>WordPress is the content backend</li>
<li>Public site is built with Astro/Next.js/etc</li>
<li>Editors log in to WordPress. Visitors never see the backend</li>
<li>Front end builds and live pages can still query GraphQL/REST without authentication</li>
</ul>
<h4>Customization</h4>
<p>Developers can customize allowed endpoints using the <code>force_login_allowed_patterns</code> filter:</p>
<pre><code>add_filter('force_login_allowed_patterns', function($patterns) {
    $patterns[] = '#^/healthz$#';           // custom health check
    $patterns[] = '#^/status$#';            // uptime checks
    $patterns[] = '#^/wp-json/acf/v3/.*#';  // specific REST namespace
    return $patterns;
});
</code></pre>


Headless Login Guard

Forces login for backend access in headless WordPress setups while allowing GraphQL/REST API endpoints and essential paths.

yasiend

<p>Want to create a mobile application for your WooCommerce website ? Our plugin helps you to generate GraphQL API in seconds and start developing your Mobile Application immediately. Or create your FREE Android and iOS applications using our builder <a href="https://shopz.io" rel="nofollow ugc">here</a>.</p>
<h3>About GraphQL</h3>
<p>GraphQL is a query language for your API, and a server-side runtime for executing queries by using a type system you define for your data.</p>
<h3>How to use</h3>
<ol>
<li>First install & active the plugin on your website.</li>
<li>Install any GraphQL client like this one here: https://altair.sirmuel.design.</li>
<li>Now the GraphQL is ready on https://yourwebsite/wp-json/shopz/graphql.</li>
<li>Run this query ‘{ products { name } }’ which should return all your website products.</li>
</ol>


Headless Login Guard vs Shopz GraphQL API for WooCommerce