Md. Rakib Ullah

Running a Headless WordPress site often involves exposing the REST API. Headless REST API Security provides tools for administrators to control which endpoints are accessible to the public or external applications.
This plugin restricts public access to REST API endpoints by default and offers a settings interface to allow-list only the specific routes required by a frontend application (such as Next.js, Gatsby, or mobile apps).
<h3>Features</h3>
<ul>
<li>Access Control: Restrict default public access to REST API endpoints.</li>
<li>Route Allow-Listing: Specific API routes (e.g., <code>/wp/v2/posts</code>) can be enabled while others remain restricted.</li>
<li>API Key Authentication: Supports an <code>X-API-KEY</code> header for server-to-server or frontend requests.</li>
<li>Headless Redirect: Option to redirect users accessing the backend API URL to a specified frontend domain.</li>
<li>Admin Access: Logged-in Administrators and Editors retain access to the API to support the Block Editor (Gutenberg) functionality.</li>
<li>Plugin Support: Detects routes registered by third-party plugins for configuration.</li>
</ul>
<h3>Usage</h3>
<ol>
<li>Navigate to Settings > Headless Security in the WordPress dashboard.</li>
<li>Enable the Master Switch to activate the access restrictions.</li>
<li>Review the list of REST API routes and check the Allow box for endpoints the application requires.</li>
<li>Copy the generated API Key for use in application headers.</li>
<li>(Optional) Enter a Headless Frontend URL to configure redirects for visitors.</li>
</ol>

Headless REST API Security

Excellent plugin! Secures my headless WordPress API quickly and easily. Works perfectly with Next.js and mobile apps

Best Plugin for Securing Headless WordPress

Manage access to the WordPress REST API by restricting public endpoints, enabling specific route allow-listing, and handling API key authentication.

Jason Bahl

WPGraphQL for Advanced Custom Fields is a free, open-source WordPress plugin that adds ACF Fields and Field Groups to the WPGraphQL Schema.
<h4>Create ACF Field Groups</h4>
Create ACF Field Groups and Fields using the ACF User Interface, register them with PHP, or leverage ACF local JSON. Each field group and the fields within it can be configured to “Show in GraphQL.”
<h4>Query your fields with GraphQL</h4>
Once your field groups and fields are configured to “Show in GraphQL,” they become available in the GraphQL Schema for querying.
<h4>Supported Field Types</h4>
WPGraphQL for ACF provides support for most built-in field types of ACF (free & PRO) and extends support to most field types from ACF Extended (free & PRO).
<h3>Updating</h3>
If you are updating from WPGraphQL for ACF v0.6.* or older, check out the <a href="https://acf.wpgraphql.com/upgrade-guide" rel="nofollow ugc">Upgrade Guide</a>
For non-major version updates, automatic updates usually should work smoothly, but we still recommend you back up your site and test on a staging site.
Before updating WPGraphQL for ACF, review the release notes on <a href="https://github.com/wp-graphql/wpgraphql-acf/releases" rel="nofollow ugc">GitHub</a>.
We follow Semantic Versioning (Semver) for meaningful releases:
<ul>
<li>MAJOR version for incompatible API changes,</li>
<li>MINOR version for backwards-compatible functionality additions,</li>
<li>PATCH version for backwards-compatible bug fixes.</li>
</ul>
Learn more about Semver at <a href="https://semver.org" rel="nofollow ugc">semver.org</a>.
<h3>Support</h3>
<ul>
<li><a href="https://github.com/wp-graphql/wp-graphql/discussions" rel="nofollow ugc">General Help Requests</a>: For general questions and help requests, create a new topic in Github Discussions</li>
<li><a href="https://www.wpgraphql.com/discord" rel="nofollow ugc">Discord Community</a>: The WPGraphQL Discord is a great place to communicate in real-time. Ask questions, discuss features, get to know other folks using WPGraphQL.</li>
<li><a href="https://github.com/wp-graphql/wp-graphql/issues/new?assignees=&labels=&projects=&template=bug_report.yml" rel="nofollow ugc">Bug Reports</a>: Report a bug in WPGraphQL</li>
<li><a href="https://github.com/wp-graphql/wp-graphql/issues/new?assignees=&labels=&projects=&template=feature_request.yml" rel="nofollow ugc">Feature Requests</a>: Suggest an idea, feature, or enhancement for WPGraphQL.</li>
<li><a href="https://github.com/wp-graphql/wp-graphql/security/advisories/new" rel="nofollow ugc">Report a Security Vulnerability</a>: Report a security vulnerability.</li>
</ul>
<h3>FAQs</h3>
Does this work with ACF Extended?
Yes! WPGraphQL for ACF allows you to query for (most) fields created with ACF Extended.
Can I filter and sort queries by ACF Fields using WPGraphQL for ACF?
At this time WPGraphQL for ACF does not support filtering or sorting queries by ACF Fields. “Meta Queries” are often very expensive to execute, so we currently do not support filtering by ACF fields out of the box, but are exploring options for supporting it without the performance penalty.
I think I found a bug, where do I report it?
If you think you found a bug, please open an issue on <a href="https://github.com/wp-graphql/wpgraphql-acf" rel="nofollow ugc">GitHub</a>. The more details you provide in the issue, and the more clear your steps to reproduce are, the higher chances we will be able to help.
Can I use ACF Free or Pro with WPGraphQL for ACF?
Yes! WPGraphQL for ACF works great with ACF Free and Pro. The Pro version of ACF has some additional features, such as Flexible Content Fields, Repeater Fields and Options Pages that are supported by WPGraphQL for ACF.
Do I have to use Faust.js to use WPGraphQL for ACF?
No! While <a href="https://www.wpgraphql.com" rel="nofollow ugc">wpgraphql.com</a> and <a href="https://acf.wpgraphql.com" rel="nofollow ugc">acf.wpgraphql.com</a> are built using <a href="https://faustjs.org/" rel="nofollow ugc">Faust.js</a> and Next.js, you can use WPGraphQL for ACF with any GraphQL client, including Apollo, Relay, Urql, etc.
I have an ACF Extension that adds a new field type, will it work with WPGraphQL for ACF?
WPGraphQL for ACF supports the field types that come with ACF (Free and PRO) as well as the field types in ACF Extended (Free and PRO). Support for additional field types can be added by using the “register_graphql_acf_field_type” API.
Do I need WPGraphQL and ACF to be active to use this?
This plugin is a “bridge” plugin that brings functionality of ACF to WPGraphQL. Both WPGraphQL and ACF need to be installed and active in your WordPress installation for this plugin to work.
How much does WPGraphQL for ACF cost?
WPGraphQL for ACF is a FREE open-source plugin. The development is sponsored by <a href="https://wpengine.com/atlas" rel="nofollow ugc">WP Engine Atlas</a>.
Does WPGraphQL for ACF support GraphQL Mutations?
GraphQL Mutations are not yet supported. We are working on adding support for Mutations in the future. We are waiting for the GraphQL “@oneOf” directive to be merged into the GraphQL spec before we add support for Mutations.
Does this work with Field Groups registered in PHP or JSON?
Yes! You can register ACF Field Groups and Fields using the Admin UI, PHP or JSON. WPGraphQL for ACF will detect the Field Groups and Fields and add them to the GraphQL Schema. If using PHP or JSON, you will need to set the “show_in_graphql” setting to “true” to expose the Field Group and Fields to the GraphQL Schema. There might be other settings that need attention at the field group or field level that might impact the schema or field resolution.
<h3>Privacy Policy</h3>
WPGraphQL for Advanced Custom Fields uses <a href="https://appsero.com" rel="nofollow ugc">Appsero</a> SDK to collect telemetry data upon user confirmation, helping us troubleshoot problems and improve the product.
The Appsero SDK doesn’t collect data by default and only starts gathering basic telemetry data when a user allows it via the admin notice. No data is collected without user consent.
Learn more about how <a href="https://appsero.com/privacy-policy/" rel="nofollow ugc">Appsero collects and uses data</a>.

WPGraphQL for ACF

WPGraphQL for ACF seamlessly integrates Advanced Custom Fields with WPGraphQL.

Headless REST API Security vs WPGraphQL for ACF