Andrew Wilkinson

A lightweight plugin that forces login for backend access in a headless WordPress setup. Keeps your WordPress dashboard private while allowing your front end (e.g. Astro, Next.js) to pull content via GraphQL/REST.
<h4>What it does</h4>
<ul>
<li>Requires authentication for <code>/wp-admin/</code> and other backend pages</li>
<li>Always allows the login page to avoid redirect loops</li>
<li>Leaves key endpoints open for headless use:
<ul>
<li><code>/wp-json/</code> (REST API)</li>
<li><code>/graphql</code> (WPGraphQL)</li>
<li><code>/wp-admin/admin-ajax.php</code> (AJAX)</li>
<li><code>/wp-cron.php</code> (cron)</li>
<li><code>/robots.txt</code></li>
<li><code>/sitemap*.xml</code> (sitemaps and indexes)</li>
<li><code>/wp-content/uploads/*</code> (media)</li>
<li><code>/favicon.ico</code></li>
<li><code>/newrelic</code> (New Relic monitoring)</li>
</ul>
</li>
<li>Logged-in users visiting the backend root get redirected to the dashboard</li>
<li>Works with Bedrock layouts (handles root path vs <code>/wp/</code>)</li>
</ul>
<h4>Use case</h4>
<ul>
<li>WordPress is the content backend</li>
<li>Public site is built with Astro/Next.js/etc</li>
<li>Editors log in to WordPress. Visitors never see the backend</li>
<li>Front end builds and live pages can still query GraphQL/REST without authentication</li>
</ul>
<h4>Customization</h4>
Developers can customize allowed endpoints using the <code>force_login_allowed_patterns</code> filter:
<pre><code>add_filter('force_login_allowed_patterns', function($patterns) {
 $patterns[] = '#^/healthz$#'; // custom health check
 $patterns[] = '#^/status$#'; // uptime checks
 $patterns[] = '#^/wp-json/acf/v3/.*#'; // specific REST namespace
 return $patterns;
});
</code></pre>

Headless Login Guard

Forces login for backend access in headless WordPress setups while allowing GraphQL/REST API endpoints and essential paths.

Jason Bahl

WPGraphQL for Advanced Custom Fields is a free, open-source WordPress plugin that adds ACF Fields and Field Groups to the WPGraphQL Schema.
<h4>Create ACF Field Groups</h4>
Create ACF Field Groups and Fields using the ACF User Interface, register them with PHP, or leverage ACF local JSON. Each field group and the fields within it can be configured to “Show in GraphQL.”
<h4>Query your fields with GraphQL</h4>
Once your field groups and fields are configured to “Show in GraphQL,” they become available in the GraphQL Schema for querying.
<h4>Supported Field Types</h4>
WPGraphQL for ACF provides support for most built-in field types of ACF (free & PRO) and extends support to most field types from ACF Extended (free & PRO).
<h3>Updating</h3>
If you are updating from WPGraphQL for ACF v0.6.* or older, check out the <a href="https://acf.wpgraphql.com/upgrade-guide" rel="nofollow ugc">Upgrade Guide</a>
For non-major version updates, automatic updates usually should work smoothly, but we still recommend you back up your site and test on a staging site.
Before updating WPGraphQL for ACF, review the release notes on <a href="https://github.com/wp-graphql/wpgraphql-acf/releases" rel="nofollow ugc">GitHub</a>.
We follow Semantic Versioning (Semver) for meaningful releases:
<ul>
<li>MAJOR version for incompatible API changes,</li>
<li>MINOR version for backwards-compatible functionality additions,</li>
<li>PATCH version for backwards-compatible bug fixes.</li>
</ul>
Learn more about Semver at <a href="https://semver.org" rel="nofollow ugc">semver.org</a>.
<h3>Support</h3>
<ul>
<li><a href="https://github.com/wp-graphql/wp-graphql/discussions" rel="nofollow ugc">General Help Requests</a>: For general questions and help requests, create a new topic in Github Discussions</li>
<li><a href="https://www.wpgraphql.com/discord" rel="nofollow ugc">Discord Community</a>: The WPGraphQL Discord is a great place to communicate in real-time. Ask questions, discuss features, get to know other folks using WPGraphQL.</li>
<li><a href="https://github.com/wp-graphql/wp-graphql/issues/new?assignees=&labels=&projects=&template=bug_report.yml" rel="nofollow ugc">Bug Reports</a>: Report a bug in WPGraphQL</li>
<li><a href="https://github.com/wp-graphql/wp-graphql/issues/new?assignees=&labels=&projects=&template=feature_request.yml" rel="nofollow ugc">Feature Requests</a>: Suggest an idea, feature, or enhancement for WPGraphQL.</li>
<li><a href="https://github.com/wp-graphql/wp-graphql/security/advisories/new" rel="nofollow ugc">Report a Security Vulnerability</a>: Report a security vulnerability.</li>
</ul>
<h3>FAQs</h3>
Does this work with ACF Extended?
Yes! WPGraphQL for ACF allows you to query for (most) fields created with ACF Extended.
Can I filter and sort queries by ACF Fields using WPGraphQL for ACF?
At this time WPGraphQL for ACF does not support filtering or sorting queries by ACF Fields. “Meta Queries” are often very expensive to execute, so we currently do not support filtering by ACF fields out of the box, but are exploring options for supporting it without the performance penalty.
I think I found a bug, where do I report it?
If you think you found a bug, please open an issue on <a href="https://github.com/wp-graphql/wpgraphql-acf" rel="nofollow ugc">GitHub</a>. The more details you provide in the issue, and the more clear your steps to reproduce are, the higher chances we will be able to help.
Can I use ACF Free or Pro with WPGraphQL for ACF?
Yes! WPGraphQL for ACF works great with ACF Free and Pro. The Pro version of ACF has some additional features, such as Flexible Content Fields, Repeater Fields and Options Pages that are supported by WPGraphQL for ACF.
Do I have to use Faust.js to use WPGraphQL for ACF?
No! While <a href="https://www.wpgraphql.com" rel="nofollow ugc">wpgraphql.com</a> and <a href="https://acf.wpgraphql.com" rel="nofollow ugc">acf.wpgraphql.com</a> are built using <a href="https://faustjs.org/" rel="nofollow ugc">Faust.js</a> and Next.js, you can use WPGraphQL for ACF with any GraphQL client, including Apollo, Relay, Urql, etc.
I have an ACF Extension that adds a new field type, will it work with WPGraphQL for ACF?
WPGraphQL for ACF supports the field types that come with ACF (Free and PRO) as well as the field types in ACF Extended (Free and PRO). Support for additional field types can be added by using the “register_graphql_acf_field_type” API.
Do I need WPGraphQL and ACF to be active to use this?
This plugin is a “bridge” plugin that brings functionality of ACF to WPGraphQL. Both WPGraphQL and ACF need to be installed and active in your WordPress installation for this plugin to work.
How much does WPGraphQL for ACF cost?
WPGraphQL for ACF is a FREE open-source plugin. The development is sponsored by <a href="https://wpengine.com/atlas" rel="nofollow ugc">WP Engine Atlas</a>.
Does WPGraphQL for ACF support GraphQL Mutations?
GraphQL Mutations are not yet supported. We are working on adding support for Mutations in the future. We are waiting for the GraphQL “@oneOf” directive to be merged into the GraphQL spec before we add support for Mutations.
Does this work with Field Groups registered in PHP or JSON?
Yes! You can register ACF Field Groups and Fields using the Admin UI, PHP or JSON. WPGraphQL for ACF will detect the Field Groups and Fields and add them to the GraphQL Schema. If using PHP or JSON, you will need to set the “show_in_graphql” setting to “true” to expose the Field Group and Fields to the GraphQL Schema. There might be other settings that need attention at the field group or field level that might impact the schema or field resolution.
<h3>Privacy Policy</h3>
WPGraphQL for Advanced Custom Fields uses <a href="https://appsero.com" rel="nofollow ugc">Appsero</a> SDK to collect telemetry data upon user confirmation, helping us troubleshoot problems and improve the product.
The Appsero SDK doesn’t collect data by default and only starts gathering basic telemetry data when a user allows it via the admin notice. No data is collected without user consent.
When you opt in, each telemetry request is sent to Appsero and a duplicate is sent in a non-blocking request to WPGraphQL-operated infrastructure at https://telemetry.wpgraphql.com (the same categories of data as described for Appsero below).
Learn more about how <a href="https://appsero.com/privacy-policy/" rel="nofollow ugc">Appsero collects and uses data</a>.

WPGraphQL for ACF

WPGraphQL for ACF seamlessly integrates Advanced Custom Fields with WPGraphQL.

Headless Login Guard vs WPGraphQL for ACF