Andrew Wilkinson

<p>A lightweight plugin that <strong>forces login for backend access</strong> in a headless WordPress setup. Keeps your WordPress dashboard private while allowing your front end (e.g. Astro, Next.js) to pull content via GraphQL/REST.</p>
<h4>What it does</h4>
<ul>
<li>Requires authentication for <code>/wp-admin/</code> and other backend pages</li>
<li>Always allows the login page to avoid redirect loops</li>
<li>Leaves key endpoints open for headless use:
<ul>
<li><code>/wp-json/</code> (REST API)</li>
<li><code>/graphql</code> (WPGraphQL)</li>
<li><code>/wp-admin/admin-ajax.php</code> (AJAX)</li>
<li><code>/wp-cron.php</code> (cron)</li>
<li><code>/robots.txt</code></li>
<li><code>/sitemap*.xml</code> (sitemaps and indexes)</li>
<li><code>/wp-content/uploads/*</code> (media)</li>
<li><code>/favicon.ico</code></li>
<li><code>/newrelic</code> (New Relic monitoring)</li>
</ul>
</li>
<li>Logged-in users visiting the backend root get redirected to the dashboard</li>
<li>Works with Bedrock layouts (handles root path vs <code>/wp/</code>)</li>
</ul>
<h4>Use case</h4>
<ul>
<li>WordPress is the content backend</li>
<li>Public site is built with Astro/Next.js/etc</li>
<li>Editors log in to WordPress. Visitors never see the backend</li>
<li>Front end builds and live pages can still query GraphQL/REST without authentication</li>
</ul>
<h4>Customization</h4>
<p>Developers can customize allowed endpoints using the <code>force_login_allowed_patterns</code> filter:</p>
<pre><code>add_filter('force_login_allowed_patterns', function($patterns) {
    $patterns[] = '#^/healthz$#';           // custom health check
    $patterns[] = '#^/status$#';            // uptime checks
    $patterns[] = '#^/wp-json/acf/v3/.*#';  // specific REST namespace
    return $patterns;
});
</code></pre>


Headless Login Guard

Forces login for backend access in headless WordPress setups while allowing GraphQL/REST API endpoints and essential paths.

Renato Alves

<p>WPGraphQL BuddyPress is a free and open-source extension for the WPGraphQL plugin, bringing the power of GraphQL to BuddyPress.</p>
<p><a href="https://wordpress.org/plugins/buddypress/" rel="ugc">BuddyPress</a> is a plugin that provides a modern, robust, and sophisticated social network software.</p>
<p>WPGraphQL BuddyPress is built on top of <a href="https://wordpress.org/plugins/wp-graphql/" rel="ugc">WPGraphQL</a>, allowing to get all the data you need from WordPress and BuddyPress.</p>
<h4>Powerful Debugging Tools</h4>
<p>WPGraphQL ships with GraphiQL in your WordPress dashboard, allowing you to browse your BuddyPress site’s GraphQL Schema, Queries, and Mutations.</p>
<h4>Features</h4>
<p>WPGraphQL BuddyPress has support to all BuddyPress components.</p>
<h4>Join our community</h4>
<p>This plugin is in active development. If you’re interested in contributing to BuddyPress or the WPGraphQL BuddyPress plugin, we’d love to have you. \o/</p>
<p>Head over to the <a href="https://codex.buddypress.org/participate-and-contribute/" rel="nofollow ugc">BuddyPress Documentation</a> site to find out how you can pitch in or to the <a href="https://github.com/renatonascalves/wp-graphql-buddypress" rel="nofollow ugc">WPGraphQL BuddyPress Github repo</a> to contribute to this WPGraphQL extension.</p>


WPGraphQL BuddyPress

Get together safely, in your own way, in WordPress.

Headless Login Guard vs WPGraphQL BuddyPress