Md. Rakib Ullah

<p>Running a Headless WordPress site often involves exposing the REST API. Headless REST API Security provides tools for administrators to control which endpoints are accessible to the public or external applications.</p>
<p>This plugin restricts public access to REST API endpoints by default and offers a settings interface to allow-list only the specific routes required by a frontend application (such as Next.js, Gatsby, or mobile apps).</p>
<h3>Features</h3>
<ul>
<li><strong>Access Control:</strong> Restrict default public access to REST API endpoints.</li>
<li><strong>Route Allow-Listing:</strong> Specific API routes (e.g., <code>/wp/v2/posts</code>) can be enabled while others remain restricted.</li>
<li><strong>API Key Authentication:</strong> Supports an <code>X-API-KEY</code> header for server-to-server or frontend requests.</li>
<li><strong>Headless Redirect:</strong> Option to redirect users accessing the backend API URL to a specified frontend domain.</li>
<li><strong>Admin Access:</strong> Logged-in Administrators and Editors retain access to the API to support the Block Editor (Gutenberg) functionality.</li>
<li><strong>Plugin Support:</strong> Detects routes registered by third-party plugins for configuration.</li>
</ul>
<h3>Usage</h3>
<ol>
<li>Navigate to <strong>Settings > Headless Security</strong> in the WordPress dashboard.</li>
<li>Enable the <strong>Master Switch</strong> to activate the access restrictions.</li>
<li>Review the list of REST API routes and check the <strong>Allow</strong> box for endpoints the application requires.</li>
<li>Copy the generated <strong>API Key</strong> for use in application headers.</li>
<li>(Optional) Enter a <strong>Headless Frontend URL</strong> to configure redirects for visitors.</li>
</ol>


Headless REST API Security

Excellent plugin! Secures my headless WordPress API quickly and easily. Works perfectly with Next.js and mobile apps

Best Plugin for Securing Headless WordPress

Manage access to the WordPress REST API by restricting public endpoints, enabling specific route allow-listing, and handling API key authentication.

Elementor

<p>Sticklight Connector provides a structured way to use the WordPress user system in external or React-based applications.</p>
<p>The plugin extends the WordPress REST API with additional endpoints that allow authenticated clients to retrieve user context and interact with WordPress data, while fully respecting core authentication methods, roles, and capability checks.</p>
<p>Sticklight does not replace WordPress authentication. It relies on <code>wp_authenticate</code> for credential validation and WordPress Application Passwords for API access, and follows standard permission checks (<code>current_user_can</code>) for all requests.</p>
<h4>Typical use cases</h4>
<ul>
<li>React applications connected to a WordPress site</li>
<li>Headless or hybrid WordPress setups</li>
<li>Admin or user dashboards built outside wp-admin</li>
<li>External tools that require authenticated access to WordPress data</li>
</ul>
<h4>Features</h4>
<ul>
<li>Authenticates via <code>wp_authenticate</code> and issues Application Passwords for API access</li>
<li>Adds REST endpoints for login, logout, and retrieving current user context</li>
<li>Enforces WordPress capability checks on all requests</li>
<li>Supports cross-origin headless setups</li>
<li>Extensible via WordPress hooks and filters</li>
</ul>
<h3>Usage</h3>
<h4>Login</h4>
<p>Authenticate with username (or email) and password:</p>
<pre><code>POST /wp-json/sticklight/v1/auth/login
</code></pre>
<p>On success the response includes an Application Password for subsequent API requests and the authenticated user:</p>
<pre><code>{
  "app_password": "XXXX XXXX XXXX XXXX XXXX XXXX",
  "user": {
    "user_id": 1,
    "username": "admin",
    "display_name": "Admin",
    "email": "admin@example.com",
    "roles": ["administrator"]
  }
}
</code></pre>
<p>Use the returned <code>app_password</code> with HTTP Basic Authentication for all further requests.</p>
<h4>Current user</h4>
<p>Retrieve the current authenticated user:</p>
<pre><code>GET /wp-json/sticklight/v1/auth/me
</code></pre>
<h4>Logout</h4>
<p>Revoke the current Application Password session:</p>
<pre><code>POST /wp-json/sticklight/v1/auth/logout
</code></pre>
<h4>User registration</h4>
<p>User creation is handled through the built-in WordPress REST API (<code>POST /wp-json/wp/v2/users</code>) and requires administrator authentication.</p>
<h4>Accessing protected data</h4>
<p>Requests to any endpoint must pass standard WordPress permission checks. Sticklight does not bypass or override these checks.</p>
<h3>Security</h3>
<p>Sticklight follows WordPress security practices:</p>
<ul>
<li>Authenticates via <code>wp_authenticate</code>, which respects all security plugin hooks (rate limiting, two-factor authentication, brute-force protection)</li>
<li>Issues Application Passwords scoped to individual sessions</li>
<li>Does not provide user registration — accounts must be created by an administrator</li>
<li>Applies capability checks (<code>current_user_can</code>) on all endpoints</li>
<li>Does not expose private data without proper permissions</li>
</ul>
<p>For external applications, it is recommended to:</p>
<ul>
<li>Use HTTPS</li>
<li>Restrict allowed origins</li>
<li>Avoid exposing sensitive endpoints unnecessarily</li>
</ul>


Sticklight

Use WordPress authentication and permissions in external React applications via secure REST API endpoints.

Headless REST API Security vs Sticklight