Md. Rakib Ullah

Running a Headless WordPress site often involves exposing the REST API. Headless REST API Security provides tools for administrators to control which endpoints are accessible to the public or external applications.
This plugin restricts public access to REST API endpoints by default and offers a settings interface to allow-list only the specific routes required by a frontend application (such as Next.js, Gatsby, or mobile apps).
<h3>Features</h3>
<ul>
<li>Access Control: Restrict default public access to REST API endpoints.</li>
<li>Route Allow-Listing: Specific API routes (e.g., <code>/wp/v2/posts</code>) can be enabled while others remain restricted.</li>
<li>API Key Authentication: Supports an <code>X-API-KEY</code> header for server-to-server or frontend requests.</li>
<li>Headless Redirect: Option to redirect users accessing the backend API URL to a specified frontend domain.</li>
<li>Admin Access: Logged-in Administrators and Editors retain access to the API to support the Block Editor (Gutenberg) functionality.</li>
<li>Plugin Support: Detects routes registered by third-party plugins for configuration.</li>
</ul>
<h3>Usage</h3>
<ol>
<li>Navigate to Settings > Headless Security in the WordPress dashboard.</li>
<li>Enable the Master Switch to activate the access restrictions.</li>
<li>Review the list of REST API routes and check the Allow box for endpoints the application requires.</li>
<li>Copy the generated API Key for use in application headers.</li>
<li>(Optional) Enter a Headless Frontend URL to configure redirects for visitors.</li>
</ol>

Headless REST API Security

Excellent plugin! Secures my headless WordPress API quickly and easily. Works perfectly with Next.js and mobile apps

Best Plugin for Securing Headless WordPress

Manage access to the WordPress REST API by restricting public endpoints, enabling specific route allow-listing, and handling API key authentication.

ben.moody

Plugin provides a framework sets up WordPress as a headless CMS.
Framework options include:
<ul>
<li>JSON Web Token Authentication (optional)</li>
<li>Adds Gutenberg block data to REST responses (optional)</li>
<li>Protects REST requests with nonce (optional)</li>
<li>Cleans up REST response objects (optional)</li>
<li>Removes non required REST endpoints (optional)</li>
<li>Disables the frontend (optional)</li>
</ul>
All modules can be enabled/disabled or configured to suit most if not all WordPress as a headless CMS use cases.
Developing a single page React app but still want to use the WordPress theme based fronted.
Not a problem, maybe you just use these modules:
<ul>
<li>Adds Gutenberg block data to REST responses</li>
<li>Protects REST requests with nonce</li>
<li>Cleans up REST response objects</li>
<li>Removes non required REST endpoints</li>
</ul>
Developing a truly headless WordPress single page app or mobile app and just want WordPress for the backend?
Maybe use these modules:
<ul>
<li>JSON Web Token Authentication</li>
<li>Adds Gutenberg block data to REST responses</li>
<li>Protects REST requests with nonce</li>
<li>Cleans up REST response objects</li>
<li>Removes non required REST endpoints</li>
<li>Disable the WordPress frontend</li>
</ul>
You get the idea.
The plugin documentation is held inside the plugin ‘options’ page in the WordPress admin, although there are some docs for the custom rest endpoints:
<a href="https://documenter.getpostman.com/view/1175138/RztkPpV4#fc567f81-ff31-442e-a236-fa247bd1fd6c" rel="nofollow ugc">Learn More about plugin endpoint requests</a>
Anyway if you are looking to use WordPress as a headless CMS on a React, React Native, Angular, iOS/Android native project. This plugin should go a long way to setting WordPress up as you need it.

WP Headless CMS Framework

I like your plugin! Keep on going with this one! :)

Plugin provides a framework sets up WordPress as a headless CMS.

Headless REST API Security vs WP Headless CMS Framework