Active installations50Adoption metric — not a quality score
WordPress.org rating5.0 / 5 from 2 ratings
Official packageDirect from WordPress.org
Repository metrics are context, not quality scores. Active installations measure adoption and can strongly reflect a plugin’s age and historical popularity. Ratings, recent updates and “Tested up to” metadata also do not guarantee modern code, error-free operation, security, feature completeness or suitability for a particular site. Why active installs don’t tell the whole story →
WP PlugIndex currently records Headless REST API Security version 2.2 as active, updated 8mo ago and tested up to WordPress 6.9.
Overview
About this plugin
Running a Headless WordPress site often involves exposing the REST API. Headless REST API Security provides tools for administrators to control which endpoints are accessible to the public or external applications.
js, Gatsby, or mobile apps).
Features
Access Control: Restrict default public access to REST API endpoints.
Route Allow-Listing: Specific API routes (e.g., /wp/v2/posts ) can be enabled while others remain restricted.
API Key Authentication: Supports an X-API-KEY header for server-to-server or frontend requests.
Headless Redirect: Option to redirect users accessing the backend API URL to a specified frontend domain.
Admin Access: Logged-in Administrators and Editors retain access to the API to support the Block Editor (Gutenberg) functionality.
Plugin Support: Detects routes registered by third-party plugins for configuration.
Usage
Navigate to Settings > Headless Security in the WordPress dashboard.
Enable the Master Switch to activate the access restrictions.
Review the list of REST API routes and check the Allow box for endpoints the application requires.
Copy the generated API Key for use in application headers.
(Optional) Enter a Headless Frontend URL to configure redirects for visitors.
WordPress.org metadata
Plugin tags
Topics listed for this plugin in the WordPress.org directory.
access control
rest api
authentication
headless
permissions
Compatibility & maintenance
Compatibility & maintenance
Tested up to WordPress 6.9
Not yet marked as tested with WordPress 7.1. WordPress.org currently lists Tested up to 6.9.
Current WordPress releaseWordPress 7.1
WordPress.org Tested up to6.9
Minimum requirementsWordPress 5.8 · PHP 7.4
Update activity22 Feb 20268mo ago
“Tested up to” is directory metadata supplied by the plugin author. WP PlugIndex does not turn an older declaration into a claim that the plugin is incompatible.
Changes recorded by WP PlugIndex
Recent tracked changes
No tracked version or compatibility changes have been recorded by WP PlugIndex yet.
Tracking & source
WP PlugIndex tracks public WordPress.org directory metadata and records selected version, compatibility and availability changes as they are detected.
