Question 1

What is the WordPress REST API?

Accepted Answer

The WordPress REST API is a built-in interface that allows external applications and services to interact with WordPress data using standard HTTP methods (GET, POST, PUT, DELETE). It exposes endpoints for all major WordPress content types: posts (/wp-json/wp/v2/posts), pages (/wp-json/wp/v2/pages), users (/wp-json/wp/v2/users), media (/wp-json/wp/v2/media), taxonomies, and more. The API is also used internally by the WordPress block editor (Gutenberg) to save content. Third-party plugins can register additional custom endpoints under their own namespaces.

Question 2

What are WordPress Application Passwords?

Accepted Answer

WordPress Application Passwords are unique, randomly generated passwords introduced in WordPress 5.6 that allow external services to authenticate to the REST API without using your main login credentials. Each application password is tied to a specific user account and can be created and revoked independently. To create one: go to Users → Profile in wp-admin → scroll to Application Passwords → enter an application name → click Add New Application Password. Use the generated password with Basic Authentication in the format: username:application-password (Base64-encoded).

Question 3

What are the most useful WordPress REST API endpoints to test?

Accepted Answer

Key WordPress REST API endpoints: GET /wp-json/ — lists all available namespaces and routes; GET /wp-json/wp/v2/posts — lists published posts; GET /wp-json/wp/v2/users (auth required) — lists users; GET /wp-json/wp/v2/settings (auth required) — site settings; POST /wp-json/wp/v2/posts (auth required) — create a post; DELETE /wp-json/wp/v2/posts/{id} (auth required) — delete a post. Third-party plugins: WooCommerce uses /wp-json/wc/v3/, Yoast SEO uses /wp-json/yoast/v1/.

Question 4

How do I disable the WordPress REST API for unauthenticated users?

Accepted Answer

To restrict the REST API to authenticated users only, add to functions.php: add_filter('rest_authentication_errors', function() { if (!empty()) { return ; } if (!is_user_logged_in()) { return new WP_Error('rest_not_logged_in', 'You are not currently logged in.', array('status' => 401)); } return ; }); This returns a 401 for any unauthenticated request. Security plugins like Wordfence also offer this as a setting. Note: completely disabling the API will break the Gutenberg editor and some plugins that use the REST API internally.

REST API Tester

Built-in WordPress REST API endpoints

Frequently asked questions

Related WordPress tools

Test any WordPress REST endpoint instantly

Endpoint	Method	Auth needed	Returns
/wp-json/	GET	No	All registered namespaces and routes
/wp-json/wp/v2/posts	GET	No	Published posts (draft/pending require auth)
/wp-json/wp/v2/pages	GET	No	Published pages
/wp-json/wp/v2/users	GET	Yes	User list (requires administrator role)
/wp-json/wp/v2/settings	GET	Yes	Site settings (title, tagline, URL, etc.)
/wp-json/wp/v2/posts	POST	Yes	Create a new post (author+ role)