Md. Rakib Ullah

Running a Headless WordPress site often involves exposing the REST API. Headless REST API Security provides tools for administrators to control which endpoints are accessible to the public or external applications.
This plugin restricts public access to REST API endpoints by default and offers a settings interface to allow-list only the specific routes required by a frontend application (such as Next.js, Gatsby, or mobile apps).
<h3>Features</h3>
<ul>
<li>Access Control: Restrict default public access to REST API endpoints.</li>
<li>Route Allow-Listing: Specific API routes (e.g., <code>/wp/v2/posts</code>) can be enabled while others remain restricted.</li>
<li>API Key Authentication: Supports an <code>X-API-KEY</code> header for server-to-server or frontend requests.</li>
<li>Headless Redirect: Option to redirect users accessing the backend API URL to a specified frontend domain.</li>
<li>Admin Access: Logged-in Administrators and Editors retain access to the API to support the Block Editor (Gutenberg) functionality.</li>
<li>Plugin Support: Detects routes registered by third-party plugins for configuration.</li>
</ul>
<h3>Usage</h3>
<ol>
<li>Navigate to Settings > Headless Security in the WordPress dashboard.</li>
<li>Enable the Master Switch to activate the access restrictions.</li>
<li>Review the list of REST API routes and check the Allow box for endpoints the application requires.</li>
<li>Copy the generated API Key for use in application headers.</li>
<li>(Optional) Enter a Headless Frontend URL to configure redirects for visitors.</li>
</ol>

Headless REST API Security

Excellent plugin! Secures my headless WordPress API quickly and easily. Works perfectly with Next.js and mobile apps

Best Plugin for Securing Headless WordPress

Manage access to the WordPress REST API by restricting public endpoints, enabling specific route allow-listing, and handling API key authentication.

Joe Fusco

Jason Bahl

WPGraphQL IDE is a next-generation query editor for WPGraphQL, built on WordPress’s component library and CodeMirror 6. It replaces the bundled legacy GraphiQL interface with a faster, more extensible IDE that feels native to wp-admin.
Three ways to open the IDE:
<ul>
<li>Dedicated page at <code>wp-admin/admin.php?page=graphql-ide</code></li>
<li>Drawer — slide-up panel triggered from the admin bar, available on every wp-admin and front-end page</li>
<li>Public endpoint mode (opt-in) — visiting the GraphQL endpoint URL in a browser renders the IDE shell instead of returning JSON. Anonymous visitors get a read-only schema browser; signed-in administrators get the full editor.</li>
</ul>
Editor features:
<ul>
<li>Multi-tab editor with auto-save and overflow tab dropdown</li>
<li>Schema-aware autocomplete, hover-doc tooltips, and inline lint warnings (powered by CodeMirror 6 + cm6-graphql)</li>
<li>Cmd-click navigation from any field, type, or argument straight to the Docs Explorer</li>
<li>Response panes: JSON viewer, table view, status code / duration / size / resolver-count badges, request tracing, query log, N+1 detection</li>
<li>Variables and headers editors with their own autocomplete</li>
<li>Per-document settings (description, alias names, max-age cache hint, allow/deny)</li>
<li>Execution history persisted to localStorage, scoped per WordPress user and IDE context — available to anonymous public-endpoint visitors too</li>
<li>Saved Queries panel with personal collections and share links (when WPGraphQL Smart Cache is also active)</li>
<li>Full keyboard support: Cmd+Enter to execute, Ctrl+Shift+P to prettify, arrow keys to switch tabs</li>
</ul>
What’s new in 5.0:
<ul>
<li>Rebuilt UI on <code>@wordpress/components</code> and <code>@wordpress/data</code>. The legacy GraphiQL wrapper is gone — see the Upgrade Notice if you have customizations.</li>
<li>Smart Cache integration. Saved documents now live in <code>wp-graphql-smart-cache</code>‘s <code>graphql_document</code> post type — one canonical primitive for the WPGraphQL ecosystem. The IDE works standalone when Smart Cache isn’t installed; Saved Queries / Document Settings / share links light up when it is.</li>
<li>Three render modes (above), each individually configurable.</li>
<li>Schema-typed data layer. Document and collection operations run through WPGraphQL itself instead of the WordPress REST API.</li>
<li>Full internationalization. Every UI string passes through <code>@wordpress/i18n</code> under the <code>wpgraphql-ide</code> text domain.</li>
<li>Auto-upgrade from 4.x. Open tabs and query history saved by the legacy GraphiQL UI migrate forward on first 5.0 load.</li>
</ul>
For the complete breaking-change list and 4.x → 5.0 migration guide, see <code>UPGRADE-5.0.md</code> in the plugin or the project’s GitHub releases.
<h3>Privacy Policy</h3>
WPGraphQL IDE uses <a href="https://appsero.com" rel="nofollow ugc">Appsero</a> SDK to collect some telemetry data upon user’s confirmation. This helps us to troubleshoot problems faster and make product improvements.
Appsero SDK does not gather any data by default. The SDK only starts gathering basic telemetry data when a user allows it via the admin notice.
When you opt in, each telemetry request is sent to Appsero and a duplicate is sent in a non-blocking request to WPGraphQL-operated infrastructure at https://telemetry.wpgraphql.com (the same categories of data as described for Appsero below).
Learn more about how <a href="https://appsero.com/privacy-policy/" rel="nofollow ugc">Appsero collects and uses this data</a>.

WPGraphQL IDE

Modern GraphQL IDE for WPGraphQL — schema-aware editor, execution history, saved queries, and a public endpoint mode.

Headless REST API Security vs WPGraphQL IDE