Do I have to use Next.js?
No. Gallop’s REST endpoints are framework-agnostic JSON. Next.js is the reference target and the redirect feature is named for it, but any HTTP client can consume the API.
Does the redirect break the WordPress admin or previews?
No. The redirect runs on template_redirect only, skips any request with a preview=true or _wp* query parameter, and never touches /wp-admin or /wp-json . Leave the Next.js URL setting blank to disable redirection entirely.
How do members log in on the front end?
The front end’s server sends the login name, password, and the visitor’s address to /gallop/v1/members/login with the API key. Gallop checks the password with wp_authenticate() , the function behind wp-login.php, and answers with the member’s details; the front end then keeps a session of its own for them. No WordPress cookies are involved, so the front end can be on any domain. A two-factor plugin on the WordPress login screen does not apply to front-end logins. The older /gallop/v1/auth/* routes, which set WordPress’s own cookies for a front end on the same registered domain, still work.
What happens when someone signs up?
Nothing is written to the users table. Gallop keeps the address and names for up to 48 hours and emails a confirmation link to the front end. When the link is opened the front end calls /gallop/v1/members/confirm , and only then is a user created, with the Subscriber role. If the address already had an account, it is marked verified (and subscribed, if that was asked) and the person is told to log in; the link never logs anyone into an existing account. WordPress’s “Anyone can register” setting is not consulted: the Manage members permission is the switch.
Can the front end send the confirmation email itself?
Yes. A front end that confirms the address its own way skips the two routes above and calls POST /gallop/v1/members/create with email , password , and optionally firstName , lastName and subscribe , once the address is confirmed. Gallop creates the user at once, with the Subscriber role, marked verified, with that password, and answers 201 with the member. It sends no email and keeps nothing waiting. An address that already has an account is answered 409 gallop_member_exists and left as it is. Gallop takes the front end’s word that the address was confirmed: only call this after it was.
What can a members request be refused with?
Every refusal has a code. Where WordPress gave a reason of its own, it is in data.reason .
- The key: gallop_key_missing (401), gallop_key_invalid (401), gallop_key_forbidden (403, the key lacks Manage members), gallop_https_required (403), gallop_key_rate_limited (429).
- Logging in: gallop_member_invalid_credentials (401, the same whether the account is missing or the password is wrong), gallop_member_rate_limited (429).
- The request: gallop_member_invalid_ip (400, login, sign-up and reset requests need the visitor’s ip ), gallop_member_invalid_email , gallop_member_invalid_name , gallop_member_weak_password (all 400).
- A link: gallop_member_link_invalid (400, the confirmation or reset link has expired or was already used).
- A session: gallop_member_session_invalid (401, the member does not exist or sessionVersion is out of date; ask them to log in again). Commenting as a member can be refused with it too.
- A profile change: gallop_member_wrong_password (403, the current password is needed to change the email or password and was not right), gallop_member_email_taken (409), gallop_member_update_failed (400).
- Creating an account: gallop_member_exists (409), gallop_member_create_failed (500).
- The site: gallop_member_front_end_missing (500, the Next.js Production URL is not set, so no email can link to the front end).
What emails does Gallop send?
Four, all through wp_mail() and all to the member: a confirmation link, a note that an address already has an account, a password reset link, and, if the member asked for it, a message when someone replies to their comment. Every link points at your Next.js production URL. The gallop_member_email filter can change or suppress any of them.
Is the login endpoint rate-limited?
Yes. Five failed attempts per login name + client IP within fifteen minutes return HTTP 429 until the window expires. Successful logins clear the counter. Login, sign-up, and reset requests also answer the same whether or not the account exists, and take the same time, so they cannot be used to find out who has an account.
What is the “Trust proxy IP headers” setting?
By default Gallop uses REMOTE_ADDR for the per-IP portion of the login rate limit. If your site sits behind a trusted reverse proxy (Cloudflare, a load balancer, etc.) that overwrites the client-IP headers, enable Trust proxy IP headers on the Gallop settings screen so CF-Connecting-IP / X-Forwarded-For are used instead. Leave it off on direct-served sites — turning it on without a trusted proxy lets attackers spoof those headers to bypass the rate limit. The setting can also be overridden in code via the gallop_trust_forwarded_ip filter.
Which posts can comments be read from?
Published posts of a public type that are not password protected. Anything else, a missing post included, answers the same 404 gallop_comments_post_not_found , so the route cannot be used to find out that a draft exists. The newest 500 comments are returned by default; truncated is true when there are more, and gallop_comments_max raises the ceiling.
What can submitting a comment be refused with?
Every refusal has a code, and WordPress’s own reason in data.reason .
- The key: gallop_key_missing (401), gallop_key_invalid (401), gallop_key_forbidden (403, the key lacks the permission), gallop_https_required (403), gallop_key_rate_limited (429).
- The site does not accept it: gallop_comment_closed (403), gallop_comment_login_required (403), gallop_comments_post_not_found (404).
- The request: gallop_comment_name_email_required , gallop_comment_invalid_email , gallop_comment_empty , gallop_comment_too_long , gallop_comment_name_too_long , gallop_comment_email_too_long , gallop_comment_url_too_long , gallop_comment_invalid_ip (all 400).
- The reply: gallop_comment_invalid_parent , gallop_comment_thread_too_deep , gallop_comment_threading_disabled (all 400). A parent must be an approved comment on the same post.
- WordPress’s checks: gallop_comment_duplicate (409), gallop_comment_flood (429).
- Anything else: gallop_comment_rejected (400, another plugin refused it), gallop_comment_save_failed (500).
How does WordPress see the visitor rather than my server?
Your server passes on the visitor’s IP address, browser, and the page they commented from. While the comment is being saved, Gallop presents those details to WordPress and to other plugins in place of the server’s own, then puts the originals back. That is what lets WordPress record, throttle, and spam-check each comment against the person who wrote it. The details are only accepted from a request whose key has been verified.
The key is refused with gallop_https_required. Why?
The key is only accepted over HTTPS, or in a local environment. If your site is served over HTTPS and you still see this, it is probably behind a proxy that ends TLS without telling WordPress. Fixing is_ssl() in wp-config.php is the right answer, since WordPress’s own Application Passwords need it too. The gallop_api_key_transport_secure filter is there if you cannot.
What happens after too many wrong keys?
After ten wrong keys from one address in fifteen minutes, further wrong keys from it are answered 429 gallop_key_rate_limited . A correct key is never refused for that reason, so nobody can lock your front end out by sending wrong ones. If the key in wp-config.php is not valid, every request that needs a key is refused and an admin notice says so.
Why do comments need an API key when reading does not?
Anyone may read a published post’s comments, as on any WordPress site. Submitting one is different: it arrives from your front end’s server on a visitor’s behalf, carrying the visitor’s IP address for WordPress to record and check. The key is how Gallop knows the request, and that address, really came from your server. Without it, anyone could post straight to WordPress, skip whatever spam checks your front end runs, and claim any address they liked.
I lost my API key. Can I see it again?
No. Gallop stores a hash of the key, not the key. Regenerate it under Gallop → Settings → Front-end connection and install the new one. The old key stops working as soon as you do.
Are comments held for moderation?
That is decided by your Discussion settings, exactly as for a comment left on a WordPress site. The response to a submitted comment reports its status , so your front end can tell a visitor that their comment is waiting for approval.
Do I need Yoast SEO?
No. If Yoast is not active the seo field in responses is an empty object. With Yoast active, Gallop reads from its indexables to populate canonical, OpenGraph, and robots data.
Does Gallop modify core post types?
No. Posts, pages, media, and built-in taxonomies are left alone. Only post types you create through the Gallop admin screen are registered by this plugin.
What happens if I deactivate or delete the plugin?
Deactivating stops Gallop from registering its post types and REST routes; content created under those post types stays in the database. Deleting the plugin (via the Plugins screen) additionally removes every gallop_* option and transient. Posts authored under your custom post types are intentionally left in place so they survive an uninstall/reinstall. So are comments and member accounts; what Gallop recorded about members (a few user meta rows) is removed.
Which actions and filters does Gallop provide?
Actions
- gallop_auth_login_success — fires after a successful REST login. Args: WP_User $user , WP_REST_Request $request .
- gallop_auth_login_failed — fires after a failed REST login. Args: string $username , WP_REST_Request $request .
- gallop_auth_logout — fires after a REST logout. Args: WP_Use
