Headless REST API Security

Running a Headless WordPress site often involves exposing the REST API. Headless REST API Security provides tools for administrators to control which endpoints are accessible to the public or external applications.

This plugin restricts public access to REST API endpoints by default and offers a settings interface to allow-list only the specific routes required by a frontend application (such as Next.js, Gatsby, or mobile apps).

Features

• Access Control: Restrict default public access to REST API endpoints.
• Route Allow-Listing: Specific API routes (e.g., /wp/v2/posts ) can be enabled while others remain restricted.
• API Key Authentication: Supports an X-API-KEY header for server-to-server or frontend requests.
• Headless Redirect: Option to redirect users accessing the backend API URL to a specified frontend domain.
• Admin Access: Logged-in Administrators and Editors retain access to the API to support the Block Editor (Gutenberg) functionality.
• Plugin Support: Detects routes registered by third-party plugins for configuration.

Usage

1. 01Navigate to Settings > Headless Security in the WordPress dashboard.
2. 02Enable the Master Switch to activate the access restrictions.
3. 03Review the list of REST API routes and check the Allow box for endpoints the application requires.
4. 04Copy the generated API Key for use in application headers.
5. 05(Optional) Enter a Headless Frontend URL to configure redirects for visitors.

1. 01Upload the plugin files to the /wp-content/plugins/headless-rest-api-security directory, or install the plugin through the WordPress plugins screen.
2. 02Activate the plugin through the ‘Plugins’ screen in WordPress.
3. 03Go to the Headless Security menu to configure allowed routes.