Md. Rakib Ullah

Running a Headless WordPress site often involves exposing the REST API. Headless REST API Security provides tools for administrators to control which endpoints are accessible to the public or external applications.
This plugin restricts public access to REST API endpoints by default and offers a settings interface to allow-list only the specific routes required by a frontend application (such as Next.js, Gatsby, or mobile apps).
<h3>Features</h3>
<ul>
<li>Access Control: Restrict default public access to REST API endpoints.</li>
<li>Route Allow-Listing: Specific API routes (e.g., <code>/wp/v2/posts</code>) can be enabled while others remain restricted.</li>
<li>API Key Authentication: Supports an <code>X-API-KEY</code> header for server-to-server or frontend requests.</li>
<li>Headless Redirect: Option to redirect users accessing the backend API URL to a specified frontend domain.</li>
<li>Admin Access: Logged-in Administrators and Editors retain access to the API to support the Block Editor (Gutenberg) functionality.</li>
<li>Plugin Support: Detects routes registered by third-party plugins for configuration.</li>
</ul>
<h3>Usage</h3>
<ol>
<li>Navigate to Settings > Headless Security in the WordPress dashboard.</li>
<li>Enable the Master Switch to activate the access restrictions.</li>
<li>Review the list of REST API routes and check the Allow box for endpoints the application requires.</li>
<li>Copy the generated API Key for use in application headers.</li>
<li>(Optional) Enter a Headless Frontend URL to configure redirects for visitors.</li>
</ol>

Headless REST API Security

Excellent plugin! Secures my headless WordPress API quickly and easily. Works perfectly with Next.js and mobile apps

Best Plugin for Securing Headless WordPress

Manage access to the WordPress REST API by restricting public endpoints, enabling specific route allow-listing, and handling API key authentication.

ristorehemagi

ContentGecko Connector exposes a secure REST API that the ContentGecko platform can use to synchronise posts, pages, product data, and translations with WordPress and WooCommerce. Access is protected by a shared API key, optional IP allow-listing, and tight capability checks inside wp-admin. The plugin stores minimal data, leans on WordPress core APIs, and keeps logging opt-in so your site remains lightweight.
Key features:
<ul>
<li>Publish or update posts through <code>/wp-json/contentgecko/v1/posts</code> and pages through <code>/wp-json/contentgecko/v1/pages</code> while sanitising content and metadata through WordPress core helpers.</li>
<li>Map multilingual content to WPML or Polylang, automatically linking translations and respecting the site’s default language.</li>
<li>Provide product, category, and catalog feeds when WooCommerce is active (gracefully failing when it is not).</li>
<li>Sideload remote featured images using WordPress core upload handlers (mime restricted) and reuse existing attachments when possible.</li>
<li>Optional debug log that persists the last 50 REST calls and mirrors high-level telemetry inside the wp-admin settings screen.</li>
</ul>
The admin settings page lives under Settings → ContentGecko Connector where administrators can generate API keys, toggle logging, view recent requests, and confirm the <code>/health</code> endpoint matches the WordPress environment.
<h3>Short Description</h3>
ContentGecko Connector exposes a secure REST API that the allows ContentGecko to automatically write and publish content for your webstore.

ContentGecko Connector


Does exactly what it's supposed to - nothing more, nothing less. ContentGecko is a great way to automate SEO for a Woocommerce store.


Great plugin, no issues

ContentGecko Connector syncs ContentGecko posts, products, and translations with WordPress securely.

Headless REST API Security vs ContentGecko Connector