Md. Rakib Ullah

<p>Running a Headless WordPress site often involves exposing the REST API. Headless REST API Security provides tools for administrators to control which endpoints are accessible to the public or external applications.</p>
<p>This plugin restricts public access to REST API endpoints by default and offers a settings interface to allow-list only the specific routes required by a frontend application (such as Next.js, Gatsby, or mobile apps).</p>
<h3>Features</h3>
<ul>
<li><strong>Access Control:</strong> Restrict default public access to REST API endpoints.</li>
<li><strong>Route Allow-Listing:</strong> Specific API routes (e.g., <code>/wp/v2/posts</code>) can be enabled while others remain restricted.</li>
<li><strong>API Key Authentication:</strong> Supports an <code>X-API-KEY</code> header for server-to-server or frontend requests.</li>
<li><strong>Headless Redirect:</strong> Option to redirect users accessing the backend API URL to a specified frontend domain.</li>
<li><strong>Admin Access:</strong> Logged-in Administrators and Editors retain access to the API to support the Block Editor (Gutenberg) functionality.</li>
<li><strong>Plugin Support:</strong> Detects routes registered by third-party plugins for configuration.</li>
</ul>
<h3>Usage</h3>
<ol>
<li>Navigate to <strong>Settings > Headless Security</strong> in the WordPress dashboard.</li>
<li>Enable the <strong>Master Switch</strong> to activate the access restrictions.</li>
<li>Review the list of REST API routes and check the <strong>Allow</strong> box for endpoints the application requires.</li>
<li>Copy the generated <strong>API Key</strong> for use in application headers.</li>
<li>(Optional) Enter a <strong>Headless Frontend URL</strong> to configure redirects for visitors.</li>
</ol>


Headless REST API Security

Excellent plugin! Secures my headless WordPress API quickly and easily. Works perfectly with Next.js and mobile apps

Best Plugin for Securing Headless WordPress

Manage access to the WordPress REST API by restricting public endpoints, enabling specific route allow-listing, and handling API key authentication.

Sébastien Dumont

CoCart Headless

<p>This free add-on for <a href="https://wordpress.org/plugins/cart-rest-api-for-woocommerce/" rel="ugc">CoCart</a> enables support for CORS to allow CoCart to work across multiple domains.</p>
<p>Simply install and activate. <strong>No configuration required!</strong></p>
<p>★★★★★</p>
<blockquote>
<p>An excellent plugin, which makes building a headless WooCommerce experience a breeze. Easy to use, nearly zero setup time. <a href="https://wordpress.org/support/topic/excellent-plugin-8062/" rel="ugc">Harald Schneider</a></p>
</blockquote>
<h3>🧰 Developer Tools</h3>
<ul>
<li><strong><a href="https://github.com/cocart-headless/cocart-beta-tester" rel="nofollow ugc">CoCart Beta Tester</a></strong> allows you to easily update to pre-release versions of CoCart Lite for testing and development purposes.</li>
<li><strong><a href="https://github.com/cocart-headless/cocart-vscode" rel="nofollow ugc">CoCart VSCode</a></strong> extension for Visual Studio Code adds snippets and autocompletion of functions, classes and hooks.</li>
<li><strong><a href="https://github.com/cocart-headless/cocart-product-support-boilerplate" rel="nofollow ugc">CoCart Product Support Boilerplate</a></strong> provides a basic boilerplate for supporting a different product types to add to the cart with validation including adding your own parameters.</li>
<li><strong><a href="https://github.com/cocart-headless/cocart-cart-callback-example" rel="nofollow ugc">CoCart Cart Callback Example</a></strong> provides you an example of registering a callback that can be triggered when updating the cart.</li>
</ul>
<p>★★★★★</p>
<blockquote>
<p>Amazing Plugin. I’m using it to create a react-native app with WooCommerce as back-end. This plugin is a life-saver! <a href="https://wordpress.org/support/topic/amazing-plugin-1562/" rel="ugc">Daniel Loureiro</a></p>
</blockquote>
<h4>👍 Add-ons to further enhance CoCart</h4>
<p>We also have other add-ons that extend CoCart to enhance your development and your customers shopping experience.</p>
<ul>
<li><strong><a href="https://wordpress.org/plugins/cocart-get-cart-enhanced/" rel="ugc">CoCart – Cart Enhanced</a></strong> enhances the data returned for the cart and the items added to it.</li>
<li><strong><a href="https://wordpress.org/plugins/cocart-jwt-authentication/" rel="ugc">CoCart – JWT Authentication</a></strong> allows you to authenticate via a simple JWT Token.</li>
<li><strong><a href="https://wordpress.org/plugins/cocart-rate-limiting/" rel="ugc">CoCart – Rate Limiting</a></strong> enables the rate limiting feature.</li>
<li>and more add-ons in development.</li>
</ul>
<p>They work with the core of CoCart already, and these add-ons of course come with support too.</p>
<h3>⌨️ Join our growing community</h3>
<p>A Discord community for developers, WordPress agencies and shop owners building the fastest and best headless WooCommerce stores with CoCart.</p>
<p><a href="https://cocartapi.com/community/?utm_medium=wp.org&utm_source=wordpressorg&utm_campaign=readme&utm_content=cocart" rel="nofollow ugc">Join our community</a></p>
<h3>🐞 Bug reports</h3>
<p>Bug reports for CoCart CORS Support are welcomed in the <a href="https://github.com/cocart-headless/cocart-cors/issues" rel="nofollow ugc">CoCart CORS repository on GitHub</a>. Please note that GitHub is not a support forum, and that issues that aren’t properly qualified as bugs will be closed.</p>
<h3>More information</h3>
<ul>
<li>The official <a href="https://cocartapi.com/?utm_medium=website&utm_source=wpplugindirectory&utm_campaign=readme&utm_content=readmelink" rel="nofollow ugc">CoCart API plugin</a> website.</li>
<li><a href="https://cocart.dev/?utm_medium=website&utm_source=wpplugindirectory&utm_campaign=readme&utm_content=readmelink" rel="nofollow ugc">CoCart for Developers</a>, an official hub for resources you need to be productive with CoCart and keep track of everything that is happening with the API.</li>
<li>The CoCart <a href="https://docs.cocart.xyz/" rel="nofollow ugc">Documentation</a></li>
<li><a href="http://eepurl.com/dKIYXE" rel="nofollow ugc">Subscribe to updates</a></li>
<li>Like, Follow and Star on <a href="https://www.facebook.com/cocartforwc/" rel="nofollow ugc">Facebook</a>, <a href="https://twitter.com/cocartapi" rel="nofollow ugc">Twitter</a>, <a href="https://www.instagram.com/cocartheadless/" rel="nofollow ugc">Instagram</a> and <a href="https://github.com/co-cart/co-cart" rel="nofollow ugc">GitHub</a></li>
</ul>
<h4>💯 Credits</h4>
<p>This plugin is developed and maintained by <a href="https://twitter.com/sebd86" rel="nofollow ugc">Sébastien Dumont</a>.<br />
Founder of <a href="https://twitter.com/cocartheadless" rel="nofollow ugc">CoCart Headless, LLC</a>.</p>


CoCart CORS Support

Enables support for CORS to allow CoCart to work across multiple domains.

Headless REST API Security vs CoCart CORS Support