Andrew Wilkinson

A lightweight plugin that forces login for backend access in a headless WordPress setup. Keeps your WordPress dashboard private while allowing your front end (e.g. Astro, Next.js) to pull content via GraphQL/REST.
<h4>What it does</h4>
<ul>
<li>Requires authentication for <code>/wp-admin/</code> and other backend pages</li>
<li>Always allows the login page to avoid redirect loops</li>
<li>Leaves key endpoints open for headless use:
<ul>
<li><code>/wp-json/</code> (REST API)</li>
<li><code>/graphql</code> (WPGraphQL)</li>
<li><code>/wp-admin/admin-ajax.php</code> (AJAX)</li>
<li><code>/wp-cron.php</code> (cron)</li>
<li><code>/robots.txt</code></li>
<li><code>/sitemap*.xml</code> (sitemaps and indexes)</li>
<li><code>/wp-content/uploads/*</code> (media)</li>
<li><code>/favicon.ico</code></li>
<li><code>/newrelic</code> (New Relic monitoring)</li>
</ul>
</li>
<li>Logged-in users visiting the backend root get redirected to the dashboard</li>
<li>Works with Bedrock layouts (handles root path vs <code>/wp/</code>)</li>
</ul>
<h4>Use case</h4>
<ul>
<li>WordPress is the content backend</li>
<li>Public site is built with Astro/Next.js/etc</li>
<li>Editors log in to WordPress. Visitors never see the backend</li>
<li>Front end builds and live pages can still query GraphQL/REST without authentication</li>
</ul>
<h4>Customization</h4>
Developers can customize allowed endpoints using the <code>force_login_allowed_patterns</code> filter:
<pre><code>add_filter('force_login_allowed_patterns', function($patterns) {
 $patterns[] = '#^/healthz$#'; // custom health check
 $patterns[] = '#^/status$#'; // uptime checks
 $patterns[] = '#^/wp-json/acf/v3/.*#'; // specific REST namespace
 return $patterns;
});
</code></pre>

Headless Login Guard

Forces login for backend access in headless WordPress setups while allowing GraphQL/REST API endpoints and essential paths.

Joe Fusco

Jason Bahl

WPGraphQL IDE is a next-generation query editor for WPGraphQL, built on WordPress’s component library and CodeMirror 6. It replaces the bundled legacy GraphiQL interface with a faster, more extensible IDE that feels native to wp-admin.
Three ways to open the IDE:
<ul>
<li>Dedicated page at <code>wp-admin/admin.php?page=graphql-ide</code></li>
<li>Drawer — slide-up panel triggered from the admin bar, available on every wp-admin and front-end page</li>
<li>Public endpoint mode (opt-in) — visiting the GraphQL endpoint URL in a browser renders the IDE shell instead of returning JSON. Anonymous visitors get a read-only schema browser; signed-in administrators get the full editor.</li>
</ul>
Editor features:
<ul>
<li>Multi-tab editor with auto-save and overflow tab dropdown</li>
<li>Schema-aware autocomplete, hover-doc tooltips, and inline lint warnings (powered by CodeMirror 6 + cm6-graphql)</li>
<li>Cmd-click navigation from any field, type, or argument straight to the Docs Explorer</li>
<li>Response panes: JSON viewer, table view, status code / duration / size / resolver-count badges, request tracing, query log, N+1 detection</li>
<li>Variables and headers editors with their own autocomplete</li>
<li>Per-document settings (description, alias names, max-age cache hint, allow/deny)</li>
<li>Execution history persisted to localStorage, scoped per WordPress user and IDE context — available to anonymous public-endpoint visitors too</li>
<li>Saved Queries panel with personal collections and share links (when WPGraphQL Smart Cache is also active)</li>
<li>Full keyboard support: Cmd+Enter to execute, Ctrl+Shift+P to prettify, arrow keys to switch tabs</li>
</ul>
What’s new in 5.0:
<ul>
<li>Rebuilt UI on <code>@wordpress/components</code> and <code>@wordpress/data</code>. The legacy GraphiQL wrapper is gone — see the Upgrade Notice if you have customizations.</li>
<li>Smart Cache integration. Saved documents now live in <code>wp-graphql-smart-cache</code>‘s <code>graphql_document</code> post type — one canonical primitive for the WPGraphQL ecosystem. The IDE works standalone when Smart Cache isn’t installed; Saved Queries / Document Settings / share links light up when it is.</li>
<li>Three render modes (above), each individually configurable.</li>
<li>Schema-typed data layer. Document and collection operations run through WPGraphQL itself instead of the WordPress REST API.</li>
<li>Full internationalization. Every UI string passes through <code>@wordpress/i18n</code> under the <code>wpgraphql-ide</code> text domain.</li>
<li>Auto-upgrade from 4.x. Open tabs and query history saved by the legacy GraphiQL UI migrate forward on first 5.0 load.</li>
</ul>
For the complete breaking-change list and 4.x → 5.0 migration guide, see <code>UPGRADE-5.0.md</code> in the plugin or the project’s GitHub releases.
<h3>Privacy Policy</h3>
WPGraphQL IDE uses <a href="https://appsero.com" rel="nofollow ugc">Appsero</a> SDK to collect some telemetry data upon user’s confirmation. This helps us to troubleshoot problems faster and make product improvements.
Appsero SDK does not gather any data by default. The SDK only starts gathering basic telemetry data when a user allows it via the admin notice.
When you opt in, each telemetry request is sent to Appsero and a duplicate is sent in a non-blocking request to WPGraphQL-operated infrastructure at https://telemetry.wpgraphql.com (the same categories of data as described for Appsero below).
Learn more about how <a href="https://appsero.com/privacy-policy/" rel="nofollow ugc">Appsero collects and uses this data</a>.

WPGraphQL IDE

Modern GraphQL IDE for WPGraphQL — schema-aware editor, execution history, saved queries, and a public endpoint mode.

Headless Login Guard vs WPGraphQL IDE