Md. Rakib Ullah

<p>Running a Headless WordPress site often involves exposing the REST API. Headless REST API Security provides tools for administrators to control which endpoints are accessible to the public or external applications.</p>
<p>This plugin restricts public access to REST API endpoints by default and offers a settings interface to allow-list only the specific routes required by a frontend application (such as Next.js, Gatsby, or mobile apps).</p>
<h3>Features</h3>
<ul>
<li><strong>Access Control:</strong> Restrict default public access to REST API endpoints.</li>
<li><strong>Route Allow-Listing:</strong> Specific API routes (e.g., <code>/wp/v2/posts</code>) can be enabled while others remain restricted.</li>
<li><strong>API Key Authentication:</strong> Supports an <code>X-API-KEY</code> header for server-to-server or frontend requests.</li>
<li><strong>Headless Redirect:</strong> Option to redirect users accessing the backend API URL to a specified frontend domain.</li>
<li><strong>Admin Access:</strong> Logged-in Administrators and Editors retain access to the API to support the Block Editor (Gutenberg) functionality.</li>
<li><strong>Plugin Support:</strong> Detects routes registered by third-party plugins for configuration.</li>
</ul>
<h3>Usage</h3>
<ol>
<li>Navigate to <strong>Settings > Headless Security</strong> in the WordPress dashboard.</li>
<li>Enable the <strong>Master Switch</strong> to activate the access restrictions.</li>
<li>Review the list of REST API routes and check the <strong>Allow</strong> box for endpoints the application requires.</li>
<li>Copy the generated <strong>API Key</strong> for use in application headers.</li>
<li>(Optional) Enter a <strong>Headless Frontend URL</strong> to configure redirects for visitors.</li>
</ol>


Headless REST API Security

Excellent plugin! Secures my headless WordPress API quickly and easily. Works perfectly with Next.js and mobile apps

Best Plugin for Securing Headless WordPress

Manage access to the WordPress REST API by restricting public endpoints, enabling specific route allow-listing, and handling API key authentication.

Sébastien Dumont

CoCart Headless

<p>This free add-on for <a href="https://cocartapi.com/?utm_medium=wp.org&utm_source=wordpressorg&utm_campaign=readme&utm_content=cocart" rel="nofollow ugc">CoCart</a> allows you to authenticate the Cart API via JSON Web Tokens as an authentication method.</p>
<p>★★★★★</p>
<blockquote>
<p>An excellent plugin, which makes building a headless WooCommerce experience a breeze. Easy to use, nearly zero setup time. <a href="https://wordpress.org/support/topic/excellent-plugin-8062/" rel="ugc">Harald Schneider</a></p>
</blockquote>
<h3>Key Features</h3>
<ul>
<li><strong>Standard JWT Authentication</strong>: Implements the industry-standard <a href="https://datatracker.ietf.org/doc/html/rfc7519" rel="nofollow ugc">RFC 7519</a> for secure claims representation.</li>
<li><strong>Simple Endpoints</strong>: Offers clear endpoints for generating and validating tokens.</li>
<li><strong>Configurable Secret Key</strong>: Define your unique secret key via <code>wp-config.php</code> for secure token signing.</li>
<li><strong>Multiple signing algorithms</strong>: <code>HS256</code>, <code>HS384</code>, <code>HS512</code>, <code>RS256</code>, <code>RS384</code>, <code>RS512</code>, <code>ES256</code>, <code>ES384</code>, <code>ES512</code>, <code>PS256</code>, <code>PS384</code>, <code>PS512</code></li>
<li><strong>Rate Limiting</strong>: Controlled specifically for refreshing and validating tokens.</li>
<li><strong>Helpful Debugging</strong>: Detailed logs of authentication issues to help figure out exactly what happened and fix it faster.</li>
<li><strong>WP-CLI Commands</strong>: Useful <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/wp-cli.md" rel="nofollow ugc">commands to handle tokens</a> – whether you need to check, destroy or create new ones, or clean up old ones.</li>
<li><strong>Developer Hooks</strong>: Provides <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/filters.md" rel="nofollow ugc">filters</a> and <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/hooks.md" rel="nofollow ugc">hooks</a> for more configuration to your requirements.</li>
</ul>
<p>JSON Web Tokens are an open, industry standard method for representing claims securely between two parties.</p>
<p>For more information, <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/concepts.md" rel="nofollow ugc">read the core concept</a> on what this plugin does and can do.</p>
<h3>📄 Documentation</h3>
<p>See documentation on how to <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/guide.md" rel="nofollow ugc">get setup</a>, <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/filters.md" rel="nofollow ugc">filters</a> and <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/hooks.md" rel="nofollow ugc">hooks</a> with examples to help configure JWT Authentication to your needs.</p>
<p>Once ready to use, see the <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/quick-start.md" rel="nofollow ugc">quick start guide</a>. There is also an <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/advanced-configuration.md" rel="nofollow ugc">advanced configuration</a> for using RSA Keys.</p>
<p>★★★★★</p>
<blockquote>
<p>Amazing Plugin. I’m using it to create a react-native app with WooCommerce as back-end. This plugin is a life-saver! <a href="https://wordpress.org/support/topic/amazing-plugin-1562/" rel="ugc">Daniel Loureiro</a></p>
</blockquote>
<h4>👍 Add-ons to further enhance CoCart</h4>
<p>We also have other add-ons that extend CoCart to enhance your headless store development.</p>
<ul>
<li><strong><a href="https://wordpress.org/plugins/cocart-cors/" rel="ugc">CoCart – CORS</a></strong> enables support for CORS to allow CoCart to work across multiple domains.</li>
<li><strong><a href="https://wordpress.org/plugins/cocart-rate-limiting/" rel="ugc">CoCart – Rate Limiting</a></strong> enables the rate limiting feature.</li>
</ul>
<p>These add-ons of course come with support too.</p>
<h3>💜 Need Support?</h3>
<p>We aim to provide regular support for the CoCart plugin via <a href="https://cocartapi.com/community/?utm_medium=website&utm_source=wpplugindirectory&utm_campaign=readme&utm_content=readmelink" rel="nofollow ugc">our Discord community server</a>. Please understand that we do prioritize support for our <a href="https://cocartapi.com/pricing/?utm_medium=website&utm_source=wpplugindirectory&utm_campaign=readme&utm_content=readmelink" rel="nofollow ugc">paying customers</a>.</p>
<h3>⌨️ Join our growing community</h3>
<p>On Discord, we have a community of developers, WordPress agencies, and shop owners building the fastest and best headless WooCommerce stores with CoCart.</p>
<p>Come and <a href="https://cocartapi.com/community/?utm_medium=wp.org&utm_source=wordpressorg&utm_campaign=readme&utm_content=cocart" rel="nofollow ugc">join our community</a></p>
<h3>🐞 Bug reports</h3>
<p>Bug reports for CoCart JWT Authentication are welcomed in the <a href="https://github.com/cocart-headless/cocart-jwt-authentication" rel="nofollow ugc">CoCart JWT Authentication repository on GitHub</a>. Please note that GitHub is not a support forum, and that issues that aren’t properly qualified as bugs will be closed.</p>
<h3>More information</h3>
<ul>
<li><a href="https://cocartapi.com/?utm_medium=website&utm_source=wpplugindirectory&utm_campaign=readme&utm_content=readmelink" rel="nofollow ugc">Website</a>.</li>
<li><a href="https://cocartapi.com/docs/?utm_medium=website&utm_source=wpplugindirectory&utm_campaign=readme&utm_content=readmelink" rel="nofollow ugc">Documentation</a></li>
<li><a href="http://eepurl.com/dKIYXE" rel="nofollow ugc">Subscribe to updates</a></li>
<li>Like, Follow and Star on <a href="https://www.facebook.com/cocartforwc/" rel="nofollow ugc">Facebook</a>, <a href="https://twitter.com/cocartapi" rel="nofollow ugc">X/Twitter</a>, <a href="https://www.instagram.com/cocartheadless/" rel="nofollow ugc">Instagram</a> and <a href="https://github.com/co-cart/co-cart" rel="nofollow ugc">GitHub</a></li>
</ul>
<h4>💯 Credits</h4>
<p>This plugin is developed and maintained by <a href="https://twitter.com/sebd86" rel="nofollow ugc">Sébastien Dumont</a>.<br />
Founder of <a href="https://twitter.com/cocartheadless" rel="nofollow ugc">CoCart Headless, LLC</a>.</p>


Headless REST API Security vs CoCart JWT Authentication