The WordPress REST API is an HTTP interface that exposes WordPress data as JSON. A website, mobile app, game companion, headless front end, or automation script can request posts, pages, users, media, and custom content—or create and update that content when it has the required permission.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
This guide explains the API’s URL structure, public access rules, authentication, Application Passwords, custom endpoints, practical requests, security requirements, and the fixes for common errors. The examples assume a current WordPress installation and use https://example.com as a placeholder domain.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhat the WordPress REST API is
REST stands for Representational State Transfer. In WordPress, the REST API applies that style to HTTP: each URL identifies a resource, the HTTP method describes the action, and the response is normally JSON.
- GET reads a resource or collection.
- POST creates a resource or performs an action that changes data.
- PUT or PATCH updates an existing resource when the route supports it.
- DELETE removes a resource when the authenticated user is allowed to do so.
A request such as GET https://example.com/wp-json/wp/v2/posts asks WordPress for a collection of posts. The response contains JSON rather than an HTML page, making it practical for JavaScript applications, native mobile clients, server-side integrations, scheduled jobs, and game-related sites that need to publish or retrieve structured content.
#1 Best Overall
Why it matters for a game-focused site
A front end can display guides, news, reviews, screenshots, or release notes without rendering a WordPress theme for every view. A separate application can import editorial content, create draft posts from a workflow, or show a user’s permitted data. The API also lets a team keep WordPress as the publishing system while building a different interface for desktop, mobile, or an in-game companion experience.
The API does not bypass WordPress roles, post statuses, or privacy controls. It is another way to ask WordPress to perform an operation, so the same authorization rules still apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How an API request is organized
Most built-in routes begin with /wp-json/. The next segment is a namespace, followed by a version and resource name. For core content, the familiar namespace is wp/v2.
| Example URL | Purpose |
|---|---|
/wp-json/ |
API index and route discovery. |
/wp-json/wp/v2/posts |
Post collection; GET lists posts and authenticated POST can create one. |
/wp-json/wp/v2/posts/42 |
Post with ID 42; GET reads it, while supported update or delete methods change it. |
/wp-json/wp/v2/pages |
Page collection. |
/wp-json/wp/v2/media |
Media collection. |
Query parameters refine a collection without changing the route. For example, ?per_page=10&search=zelda asks for up to ten matching posts. Pagination headers and response fields indicate whether more pages are available; do not assume one request returns the entire collection.
Discovering available routes
Open https://example.com/wp-json/ in a browser or request it with a tool such as curl. The index describes namespaces and registered routes that the site exposes. A site without working pretty permalinks may also respond to https://example.com/?rest_route=/; this fallback is commonly documented in third-party WordPress guidance, so test it on the specific host rather than assuming every configuration behaves identically.
The index is the quickest way to check whether a plugin’s custom namespace is active and whether a route supports the method you intend to use. A route can exist while still hiding private fields or denying a method to your current user.
What is public and what requires authentication?
WordPress generally allows unauthenticated reads of public content. Published posts, pages, and other resources configured for public viewing can normally be requested without credentials. Authentication is required for private content, password-protected content, user records, internal users, and metadata that a visitor should not see. Drafts and other non-public post statuses also depend on the requesting user’s capabilities.
“Readable through the API” does not mean “every field is exposed.” A response is filtered according to the resource’s permissions and context. A public post may include its title and rendered content while omitting editing-only data. Treat every response as potentially containing information that should be handled according to your site’s privacy policy.
Use the smallest permission possible
- Use unauthenticated GET requests for genuinely public information.
- Use an account with the narrowest WordPress role that can complete the job.
- Separate publishing automation from an administrator account whenever possible.
- Request only the fields and records your client needs.
Authentication options
The WordPress handbook describes three broad approaches: cookie authentication for code running in a logged-in WordPress browser session, HTTP Basic Authentication with Application Passwords for remote clients, and authentication plugins that add other schemes.
| Method | Best fit | Important requirement |
|---|---|---|
| Cookie authentication | JavaScript running inside an authenticated WordPress session | Send a WordPress nonce with requests that change data. |
| Application Passwords | Scripts, mobile or desktop clients, and server-to-server jobs | Use HTTPS; Basic Authentication sends the credential with every request. |
| Authentication plugin | Sites that need a scheme not provided by core | Evaluate the plugin’s maintenance, security model, and compatibility. |
Choose one method per client and keep credentials out of browser bundles, public repositories, screenshots, and logs. Authentication proves who is making the request; WordPress capabilities still decide what that identity may do.
Application Passwords: the beginner-friendly remote option
Application Passwords have shipped in WordPress core since version 5.6. They are separate credentials for an individual user, intended for API clients rather than interactive wp-admin login.
Create one in wp-admin
- Sign in to WordPress with the user account that should own the integration.
- Open Users → Edit User in wp-admin.
- Find the Application Passwords section.
- Enter a descriptive name such as
content-importerand generate the password. - Copy the displayed value immediately and store it in a password manager or a server-side secret store. WordPress displays the generated value only once.
Application Passwords are stored hashed, can be revoked individually, and do not replace the account’s main password. They cannot be used to sign in through wp-login.php. If a client is retired or compromised, revoke that application credential without changing unrelated integrations.
Send a request with Basic Authentication
The official handbook’s pattern is HTTP Basic Authentication: the username is the WordPress user name and the password is the generated Application Password. Use HTTPS so the credential is protected in transit.
curl --user "api-user:xxxx xxxx xxxx xxxx xxxx xxxx"
https://example.com/wp-json/wp/v2/users/meReplace the user name, password, and domain. The response should describe the authenticated user if the credential is valid and the host passes the Authorization header through to WordPress.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Create a post from a script
Creating content requires a role and capability that permit post creation. The request body is JSON, and the Content-Type header tells WordPress how to parse it.
curl --user "api-user:xxxx xxxx xxxx xxxx xxxx xxxx"
-H "Content-Type: application/json"
-X POST
-d '{"title":"New game guide","content":"Draft text for review.
","status":"draft"}'
https://example.com/wp-json/wp/v2/postsOn success, WordPress returns the newly created post, including its numeric ID and links. A failed request returns a JSON error object with a code, message, and status that your client should log safely without exposing the credential.
Cookie authentication and nonces
Cookie authentication is designed for code operating inside WordPress while a user is logged in. The browser already has the WordPress login cookie; the client additionally sends a REST nonce so WordPress can verify that the request came from the intended session.
Do not copy this method into a public mobile app or a server-side job. Those clients do not share the browser session and should use a dedicated authentication approach. For browser code, obtain the nonce through the WordPress page or script enqueue process used by your theme or plugin, then include it in the request header expected by WordPress. A missing or expired nonce commonly produces a permission error even when the user appears logged in.
Reading, filtering, and paging content
Read a collection
curl "https://example.com/wp-json/wp/v2/posts?per_page=5&page=1"Collection responses are arrays of resource objects. Use per_page and page deliberately, and preserve the pagination information returned by WordPress. A client that repeatedly asks for page one will never progress through a large archive.
Read one item
curl https://example.com/wp-json/wp/v2/posts/42Use the returned object’s IDs and links rather than trying to construct relationships from titles. Slugs are useful for human-readable URLs, but numeric IDs are the stable identifiers used by core routes.
Request only the fields you need
Where the route supports it, an _fields query parameter can reduce the response to selected properties, such as ?_fields=id,link,title,excerpt. Smaller responses improve mobile performance and reduce the chance that a client stores editorial fields it does not need.
Creating, updating, and deleting content safely
Write operations should be treated as irreversible business actions, even when WordPress provides a trash or draft state. Validate input before sending it, use an explicit status such as draft for human review, and record the returned ID so retries do not accidentally create duplicates.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Create
Send a POST to the collection route with the fields accepted by that resource. A title alone may be valid, but your workflow should also specify the intended status, author behavior, categories, tags, and featured media when those values matter.
Update
Send the resource ID in the URL and use the method supported by the route. Update only fields that changed. If two systems edit the same post, add conflict detection to your workflow rather than blindly overwriting the latest value.
Delete
Confirm the target ID and the account’s capability before issuing a delete request. Many core resources support a trash operation that is safer than permanent deletion, but the exact behavior depends on the post type and route.
Building a custom endpoint with register_rest_route()
Plugins and themes can expose their own JSON resources. The central function is register_rest_route(), documented at developer.wordpress.org/reference/functions/register_rest_route/. Register routes from a callback attached to the rest_api_init hook so they are loaded when the REST API initializes.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchNamespace and route design
The namespace is required and must be unique. Use a vendor or plugin identifier followed by a version, such as arcade-tools/v1, rather than a generic name that could collide with another extension. The route portion follows the namespace and can include regular-expression captures. Core controllers commonly use an item pattern such as (?P<id>[d]+).
A minimal read-only endpoint
<?php
add_action( 'rest_api_init', function () {
register_rest_route(
'arcade-tools/v1',
'/score/(?P<id>[d]+)',
array(
'methods' => WP_REST_Server::READABLE,
'callback' => 'arcade_tools_get_score',
'permission_callback' => '__return_true',
'args' => array(
'id' => array(
'required' => true,
'sanitize_callback' => 'absint',
'validate_callback' => function ( $value ) {
return (int) $value > 0;
},
),
),
)
);
} );
function arcade_tools_get_score( WP_REST_Request $request ) {
$id = (int) $request['id'];
return new WP_REST_Response(
array(
'id' => $id,
'score' => 0,
),
200
);
}This example returns a public placeholder score. A production endpoint should load real data, return a meaningful 404 when the record does not exist, and avoid exposing fields that the caller does not need.
Every method needs a permission_callback
Set permission_callback for every route method, including read-only methods. Public data can use __return_true, as in the example, while protected data should check a capability or another authorization rule.
'permission_callback' => function ( WP_REST_Request $request ) {
return current_user_can( 'edit_posts' );
},A missing permission callback is a common security gap. Do not treat a hidden URL, an obscure namespace, or a client-side check as authorization. The server-side callback must make the decision on every request.
Recommended Free Tools
Validate and sanitize arguments
Declare required arguments and validate their type, range, and allowed values. Sanitizing changes input into a safer representation; validation decides whether the result is acceptable. Return a clear error when an argument fails instead of silently substituting a dangerous default.
Custom collection and item routes
If your integration exposes multiple records, model it as a collection plus an item route. For example, /arcade-tools/v1/scores can list scores, while /arcade-tools/v1/scores/(?P<id>[d]+) can read one score. Give each HTTP method its own callback and permission behavior when the capabilities differ.
| Route shape | Typical methods | Typical use |
|---|---|---|
/scores |
GET, POST | List scores or submit a new score. |
/scores/{id} |
GET, PATCH/POST, DELETE | Read, edit, or remove one score. |
Document the JSON schema your client should send and receive. Decide how dates, IDs, empty values, pagination, and errors are represented before publishing the endpoint; changing those shapes later can break every consumer.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Security checklist for beginners
- Use HTTPS. Basic Authentication sends the Application Password with every request, so protect the connection and avoid transmitting credentials over plain HTTP.
- Give every route a permission callback. Check capabilities on the server for each method.
- Use least privilege. A publishing bot rarely needs administrator access.
- Keep secrets server-side. Never embed an Application Password in JavaScript shipped to anonymous visitors.
- Revoke unused credentials. Application Passwords can be revoked one at a time.
- Validate input. Constrain IDs, statuses, search terms, and uploaded values.
- Limit data exposure. Return only the fields a client requires.
- Log safely. Record route, status, and request ID, but redact Authorization headers and password values.
- Plan for abuse. Add rate limiting, caching, or queueing at the edge or application layer when an endpoint can be called frequently.
Troubleshooting common failures
| Symptom | Likely cause | What to check |
|---|---|---|
404 for /wp-json/ |
Permalink or rewrite configuration is not reaching WordPress. | Save the permalink settings, verify the site URL, and test the ?rest_route=/ form. |
| 401 or “incorrect username/password” | Wrong user, revoked Application Password, or malformed Basic Auth. | Generate a new credential, copy it exactly once, and test /wp/v2/users/me. |
| 403 or “rest_cookie_invalid_nonce” | Cookie-authenticated browser request lacks a valid nonce. | Refresh the logged-in page and send the current nonce. |
| Public GET works but POST fails | The account lacks the required capability or the route denies the method. | Inspect the user role, route methods, and permission callback. |
| Authorization header is missing on Apache or behind a proxy | The web server or proxy stripped the header before PHP received it. | Inspect the host’s rewrite and proxy configuration and ask the host to preserve the Authorization header. |
| JSON parsing error | The request body is not valid JSON or the content type is wrong. | Send Content-Type: application/json, quote the JSON correctly, and test with a small payload. |
| Unexpected empty fields | The resource is private, the user lacks permission, or the response context hides fields. | Authenticate as an allowed user and compare the documented response for that context. |
Designing a reliable integration
Separate reading from writing
Public readers can use cached GET requests, while a controlled server process handles authenticated writes. This keeps secrets away from visitors and lets you apply retries, validation, and audit logging in one place.
Free tools Windows power users keep installed
One-click scans. No signup required.
Make retries idempotent
Networks fail after a server accepts a request but before the client receives the response. For publishing jobs, store an external idempotency key or search for an existing record before retrying. Otherwise one timeout can become two identical posts.
Cache public responses
News lists and evergreen guides do not need a fresh origin request for every visitor. Cache GET responses for a short, explicit period and invalidate or refresh the cache after a successful write. Never cache authenticated responses in a shared public cache unless you have proved that no private data can appear.
Best Value
Handle pagination and rate limits
Request bounded pages, back off after transient failures, and stop when the API indicates that no next page exists. A mobile client should not download an entire archive simply to show ten cards on screen.
Version your custom namespace
Use a namespace such as arcade-tools/v1. When a breaking response change is unavoidable, publish v2 rather than silently changing the meaning of existing fields. Keep old versions long enough for clients to migrate.
Choosing the right first project
Read-only content widget
Start with an unauthenticated GET to /wp-json/wp/v2/posts, request a small page, select only the fields needed, and render the result in your front end. This teaches routes, JSON parsing, pagination, and error handling without handling secrets.
Editorial automation
Use an Application Password owned by a dedicated user, create drafts rather than immediately publishing, and keep the credential in a server-side secret store. Log the returned post ID and provide a manual review step.
Game-data service
Define a custom namespace and schema, register collection and item routes on rest_api_init, validate every argument, and write capability checks before implementing the mutation methods. Test unauthenticated, authenticated-but-unauthorized, and authorized requests separately.
Compatibility and maintenance
WordPress core, plugins, hosting proxies, and security layers can change API behavior. Test against the same WordPress major and minor versions your production site runs, and retest after upgrades. Application Password behavior, REST routes, and handbook wording are subject to change, so verify current documentation before a 2027 deployment.
Keep a small contract test suite that checks the API index, one public GET, one authenticated request, one denied request, and each custom route’s status codes. This catches disabled rewrites, expired credentials, missing permissions, and accidental schema changes before users encounter them.
The Bottom Line
The WordPress REST API is a JSON-over-HTTP layer: discover routes at /wp-json/, use public GET requests for public data, authenticate remote writes with a carefully managed Application Password, and require an explicit permission callback on every custom route.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
