Md. Rakib Ullah

Running a Headless WordPress site often involves exposing the REST API. Headless REST API Security provides tools for administrators to control which endpoints are accessible to the public or external applications.
This plugin restricts public access to REST API endpoints by default and offers a settings interface to allow-list only the specific routes required by a frontend application (such as Next.js, Gatsby, or mobile apps).
<h3>Features</h3>
<ul>
<li>Access Control: Restrict default public access to REST API endpoints.</li>
<li>Route Allow-Listing: Specific API routes (e.g., <code>/wp/v2/posts</code>) can be enabled while others remain restricted.</li>
<li>API Key Authentication: Supports an <code>X-API-KEY</code> header for server-to-server or frontend requests.</li>
<li>Headless Redirect: Option to redirect users accessing the backend API URL to a specified frontend domain.</li>
<li>Admin Access: Logged-in Administrators and Editors retain access to the API to support the Block Editor (Gutenberg) functionality.</li>
<li>Plugin Support: Detects routes registered by third-party plugins for configuration.</li>
</ul>
<h3>Usage</h3>
<ol>
<li>Navigate to Settings > Headless Security in the WordPress dashboard.</li>
<li>Enable the Master Switch to activate the access restrictions.</li>
<li>Review the list of REST API routes and check the Allow box for endpoints the application requires.</li>
<li>Copy the generated API Key for use in application headers.</li>
<li>(Optional) Enter a Headless Frontend URL to configure redirects for visitors.</li>
</ol>

Headless REST API Security

Excellent plugin! Secures my headless WordPress API quickly and easily. Works perfectly with Next.js and mobile apps

Best Plugin for Securing Headless WordPress

Manage access to the WordPress REST API by restricting public endpoints, enabling specific route allow-listing, and handling API key authentication.

danielauener

This plugin adds a couple of extensions to the WordPress Rest API, which are aimed to make the use of WordPress as headless CMS easier. 
It is originally coded for <a href="https://github.com/northosts/wuxt" rel="nofollow ugc">WUXT</a>, a dockerized development environment for headless WordPress combined with NuxtJs. However, it can be used by every other application, which needs a powerful headless WordPress back-end.
<h3>WordPress API Extensions</h3>
<ul>
<li>Frontpage endpoint: There is no obvious way to get the WordPress front-page via the Rest API. To read the settings, you have to be authorized, which makes things unnecessary complicated. The new endpoint returns the front-page object if it is set, the ten newest posts otherwise.</li>
<li>Menu endpoint: Right now, there is no way I know of, for getting menus from the API. This endpoint returns an entire menu as nested array. Default location is “main”, but you can request other locations.</li>
<li>Slug endpoint: If you are building a front-end app on top of WordPress, you have to think about how to structure your urls. WordPress has two default post-types (posts & pages) and in the urls is not distinguished which type you are requesting, so http://wp-site.expl/something might lead to a page or a post, dependent on the type of the object with the slug something. If you want to mirror that behaviour in your app, you have to do two requests for each url, one searching pages, one searching posts. To make that one request, use the slug end-point.</li>
<li>Taxonomy filter AND extension: When filtering taxonomies with an Rest API request, all queries are OR-queries. That means you can get posts which are either in category A or B. Our adjustment lets you switch all tax_queries to an AND-relation, so that you can select posts which are both in category A and B.</li>
<li>Geo query: If your application has to get posts by geographical proximity, you can use a geo query.</li>
<li>WordPress SEO meta fields: They are included automatically in the <code>meta</code> object if the Yoast WordPress SEO plugin is activated.</li>
<li>Advanced custom fields are included automatically in the <code>meta</code> object if the plugin is activated.</li>
</ul>
<h3>Endpoints and parameters</h3>
Frontpage
<ul>
<li><code>GET</code> <code>/wp-json/wuxt/v1/front-page</code></li>
<li><code>GET</code> <code>/wp-json/wuxt/v1/front-page?_embed</code></li>
</ul>
Menu
<ul>
<li><code>GET</code> <code>/wp-json/wuxt/v1/menu</code></li>
<li><code>GET</code> <code>/wp-json/wuxt/v1/menu?location=<location></code></li>
</ul>
Slug
<ul>
<li><code>GET</code> <code>/wp-json/wuxt/v1/slug/<post-or-page-slug></code></li>
<li><code>GET</code> <code>/wp-json/wuxt/v1/slug/<post-or-page-slug>?_embed</code></li>
</ul>
Taxonomy filter AND extension
<ul>
<li><code>GET</code> <code>/wp-json/wp/v2/posts/?categories=1,2&and=true</code></li>
</ul>
GEO query
<ul>
<li><code>GET</code> <code>/wp-json/wp/v2/posts/?coordinates=<lat>,<lng>&distance=<distance><km|m></code></li>
<li><code>GET</code> <code>/wp-json/wp/v2/posts/?coordinates=<lat_meta_field>:<lat>,<lng_meta_field>:<lng>&distance=<distance><km|m></code></li>
<li><code>GET</code> <code>/wp-json/wp/v2/posts/?coordinates=52.585,13.373&distance=10</code></li>
<li><code>GET</code> <code>/wp-json/wp/v2/posts/?coordinates=lat_mkey:52.585,lng_mkey:13.373&distance=10</code></li>
<li><code>GET</code> <code>/wp-json/wp/v2/posts/?coordinates=52.585,13.373&distance=10m</code></li>
</ul>
<h3>Links</h3>
<ul>
<li><a href="https://www.danielauener.com/wordpress-rest-api-extensions-for-going-headless-wp/" rel="nofollow ugc">More detailed end-point description</a></li>
<li><a href="https://github.com/northosts/wuxt" rel="nofollow ugc">WUXT</a></li>
<li><a href="https://www.danielauener.com/nuxt-js-wordpress-wuxt/" rel="nofollow ugc">WUXT release blog post</a></li>
<li><a href="https://nuxtjs.org/" rel="nofollow ugc">NuxtJs</a></li>
</ul>
<h3>Credits</h3>
<ul>
<li>Michael Cox <a href="https://gist.github.com/michaeland/191ce08d22fed74da05a" rel="nofollow ugc">Menu Class for returning a menu as array</a></li>
</ul>

WUXT Headless WordPress API Extensions

Extensions for the Rest API to provide endpoints that support a more convenient use of headless WordPress as back-end CMS.

Headless REST API Security vs WUXT Headless WordPress API Extensions