WordPress REST API-enable, disable, and use endpoints

The WordPress REST API provides JSON endpoints for reading and writing WordPress data. It powers mobile apps, headless frontends, and block editor features. Available at /wp-json/wp/v2/.

Common endpoints

GET  /wp-json/wp/v2/posts        # All published posts
GET  /wp-json/wp/v2/posts/123    # Single post
GET  /wp-json/wp/v2/pages        # Pages
GET  /wp-json/wp/v2/users        # Users (authenticated)
GET  /wp-json/wp/v2/categories   # Categories

Authentication

Public read operations need no authentication. Write operations require:

• Application Passwords (built-in since WP 5.6): Users → Edit → Application Passwords
• Use HTTP Basic Auth with username and application password

curl -X POST https://site.com/wp-json/wp/v2/posts \
  -u "username:app-password" \
  -H "Content-Type: application/json" \
  -d '{"title":"New Post","status":"publish"}'

Restrict public REST API access

To require authentication for all REST API requests, add to functions.php:

add_filter('rest_authentication_errors', function($result) {
    if (!is_user_logged_in()) {
        return new WP_Error('rest_not_logged_in', 'You must be logged in.', ['status' => 401]);
    }
    return $result;
});

Related: WordPress troubleshooting-common issues and fixes | Advanced WordPress security-protect your site

Related articles