Md. Rakib Ullah

<p>Running a Headless WordPress site often involves exposing the REST API. Headless REST API Security provides tools for administrators to control which endpoints are accessible to the public or external applications.</p>
<p>This plugin restricts public access to REST API endpoints by default and offers a settings interface to allow-list only the specific routes required by a frontend application (such as Next.js, Gatsby, or mobile apps).</p>
<h3>Features</h3>
<ul>
<li><strong>Access Control:</strong> Restrict default public access to REST API endpoints.</li>
<li><strong>Route Allow-Listing:</strong> Specific API routes (e.g., <code>/wp/v2/posts</code>) can be enabled while others remain restricted.</li>
<li><strong>API Key Authentication:</strong> Supports an <code>X-API-KEY</code> header for server-to-server or frontend requests.</li>
<li><strong>Headless Redirect:</strong> Option to redirect users accessing the backend API URL to a specified frontend domain.</li>
<li><strong>Admin Access:</strong> Logged-in Administrators and Editors retain access to the API to support the Block Editor (Gutenberg) functionality.</li>
<li><strong>Plugin Support:</strong> Detects routes registered by third-party plugins for configuration.</li>
</ul>
<h3>Usage</h3>
<ol>
<li>Navigate to <strong>Settings > Headless Security</strong> in the WordPress dashboard.</li>
<li>Enable the <strong>Master Switch</strong> to activate the access restrictions.</li>
<li>Review the list of REST API routes and check the <strong>Allow</strong> box for endpoints the application requires.</li>
<li>Copy the generated <strong>API Key</strong> for use in application headers.</li>
<li>(Optional) Enter a <strong>Headless Frontend URL</strong> to configure redirects for visitors.</li>
</ol>


Headless REST API Security

Excellent plugin! Secures my headless WordPress API quickly and easily. Works perfectly with Next.js and mobile apps

Best Plugin for Securing Headless WordPress

Manage access to the WordPress REST API by restricting public endpoints, enabling specific route allow-listing, and handling API key authentication.

Joe Bailey-Roberts

<p>Logged in users are redirected to the editor screen for the post, while non-logged in users must log in first. This means that you can share a readable link straight to the editor, depending on your permalink settings.</p>
<p>Good for task management or organisation resource management.</p>
<h3>What the plugin actually does</h3>
<p>In simple terms, the plugin removes the frontend of the WordPress site. Post permalinks go straight to the editor page, and the theme is mostly redundant.</p>
<h3>Why would I want to do that?</h3>
<p>This is definitely not a useful plugin for a public-facing website. Instead, this allows you to convert WordPress into a headless CMS for managing tasks, content and more, all protected by the standard user role system. You can share a post permalink with a collaborator and they will be directed straight to the editor screen.</p>
<p>Maybe you want to go a step further and create an external application to display your WordPress content elsewhere using the API. In this case you definitely don’t want the standard WP frontend accessible!</p>


WP Headless

A lightweight plugin to disable the WP frontend experience.

Headless REST API Security vs WP Headless