To build a headless site with WordPress, keep WordPress as the content backend and have a separate front end request its REST API for JSON. Start by discovering the routes available on your site, fetch public content with HTTP GET requests, and handle collection pagination. For private data or write operations, authenticate the request and ensure the WordPress user has the necessary capability.
What the WordPress REST API does in a headless site
The WordPress REST API lets another application work with a WordPress site by sending and receiving JSON over HTTP. In a headless setup, WordPress manages content while a separate application renders the public-facing pages. WordPress describes a separate front-end experience as a supported use case; the API also underpins the Block Editor. As WordPress Developer Resources puts it, “The WordPress REST API provides an interface for applications to interact with your WordPress site by sending and receiving data as JSON (JavaScript Object Notation) objects.” WordPress REST API Handbook
As an Amazon Associate I earn from qualifying purchases.
“Headless” does not require a particular JavaScript framework or change the API itself. It describes the separation between content management and presentation. The front end makes HTTP requests; WordPress responds with the requested resource data, subject to the site’s configuration and content visibility.
How to find your site’s API routes
The REST API is distributed: each WordPress site exposes its own API index, which describes available routes and supported methods. With pretty permalinks enabled, open https://example.com/wp-json/, replacing the domain with your site’s address. If pretty permalinks are not enabled, WordPress can receive the REST route through the rest_route query parameter. The site’s base path can vary. WordPress Routes and Endpoints
#1 Best Overall
Common core resource routes include:
/wp/v2/postsfor posts/wp/v2/pagesfor pages/wp/v2/mediafor media/wp/v2/categoriesfor categories/wp/v2/searchfor search
These are core routes, not a guarantee that every site exposes exactly the same resources or data. Plugins and site configuration may add routes or affect what is available. The API index and REST API reference are the place to check the resources on a specific site. WordPress describes the API as individually available on sites that support it.
How to request and render WordPress content
A route identifies a resource path; an endpoint is the operation available at that route for a particular HTTP method. The usual conventions are GET to read, POST to create, PUT to update, and DELETE to delete. Requests use ordinary HTTP and successful responses contain JSON. WordPress Requests
For example, this command requests the posts collection from a site using pretty permalinks:
curl https://example.com/wp-json/wp/v2/postsThis is an illustrative public read request. The response can differ with site configuration, plugins, and whether content is public. In a front end, the application uses returned resource fields to render its own pages. WordPress also provides ._links and, where requested and available, ._embedded data for following or including related resources. The exact relationship fields depend on the resource and request. WordPress Using the REST API
How to get a collection’s posts and paginate results
Collection responses are paginated rather than returning an unlimited number of records at once. Use per_page to choose a page size from 1 to 100, page to select a page, and offset to start at a specified position. For example, to request 20 posts from the second page:
/wp-json/wp/v2/posts?per_page=20&page=2The response headers X-WP-Total and X-WP-TotalPages report the number of matching records and the total number of pages. A client that needs the entire collection must make multiple requests, using the page count to know when to stop. Large queries can affect site performance, so avoid fetching a full library when the front end only needs a subset. WordPress Pagination
Which authentication method should you use?
Public content is generally readable without authentication. When an operation requires a logged-in identity or changes data, the request must use a supported authentication method, and the WordPress user still needs the capability required for that operation. Choose the method based on where the request runs.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Request context | WordPress method | Key constraint |
|---|---|---|
| Logged-in user making a same-site request | WordPress cookies and a REST nonce | The user must be logged in; action requests need a nonce, commonly sent in X-WP-Nonce. |
| External server-side application | Application Password over HTTPS using Basic Authentication | Keep the credential confidential; the WordPress user must have the capability needed for the operation. |
Same-site requests from a logged-in user
Cookie authentication is the standard approach for a request made within WordPress while a user is logged in. Requests that perform actions need a REST nonce, commonly sent in the X-WP-Nonce header. Without the nonce, WordPress treats the request as unauthenticated. WordPress documents that “The API uses nonces with the action set to wp_rest.” WordPress Authentication
Best Value
Requests from an external server
For an external server-side application that needs protected data or write access, WordPress documents Application Passwords sent over HTTPS using Basic Authentication. Application Passwords were introduced in WordPress 5.6. Use an appropriately permissioned WordPress user and store its password on the server, not in code delivered to a browser. Browser users can inspect client-side code and requests, so a secret embedded there is not confidential. Authentication does not grant more access than the associated WordPress user’s capabilities allow. WordPress Authentication
What public browser access and CORS mean for security
CORS controls whether a browser permits front-end code from one origin to read a response from another; it is not authorization. WordPress does not verify the incoming Origin header for REST API requests, so public endpoints may be requested from any site. A public endpoint should therefore be treated as public data, not as protected merely because the front end is hosted elsewhere. WordPress REST API Frequently Asked Questions
For cookie-authenticated requests, WordPress uses nonces to address cross-site request forgery (CSRF). CORS headers can be customized when a site needs stricter browser-origin behavior, but CORS does not replace authentication, nonce checks, or capability checks. Disabling the REST API can also interfere with WordPress Admin functionality; if access needs to be restricted, requiring authentication is preferable to turning the API off entirely. WordPress REST API Frequently Asked Questions
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
