Free Resource · WordPress · Plugin

REST API Lock

Going headless shouldn't mean leaving your whole WordPress REST API open to anyone who knows where to look.

Format: Plugin · ZIP
Works with: WordPress 6, PHP 7.4+
Licence: GPL-2.0-or-later
Status: Coming soon
Price: Free

Still on the workbench.

This one isn't ready to download yet. It will appear right here as soon as it is.

Why I Built It

Out of the box, WordPress publishes a REST API that lists your posts, pages, media and user names to anyone who asks. For a traditional site that's mostly harmless. For a headless site, where WordPress only exists to feed a front end, it's an open door with no reason to be open.

I wrote this plugin for my own headless sites. It closes the API to everyone except logged-in editors and the front end, which proves itself with a secret key, and it stops WordPress advertising the API's address in every page.

What's Inside

Blocks REST API requests from anonymous visitors with a 401 response
Lets your front end through with a secret key sent in a request header
Keeps the block editor and other logged-in tools working as normal
An allowlist for routes that must stay public, such as form plugins, editable with a filter
Removes the API discovery links WordPress adds to every page and response
A single file with no settings screen and no database tables

Getting started

Add your secret key to wp-config.php, as shown in the plugin's header comment.
Upload the ZIP under Plugins → Add New → Upload Plugin, and activate it.
Send the same key in a request header from your front end's server-side requests.
Visit /wp-json in a private browser window to check that it now returns a 401.

Stuck, or wondering whether it suits your project? Ask me on a free consultation call. Happy to help.

Next from the workbenchFree Shipping Progress Bar

Have a project in mind?

Whether it's a new website, a redesign or something more ambitious, let's put some numbers around your idea.

Estimate your project Book a free consultation