{"id":10704,"date":"2026-05-19T05:29:48","date_gmt":"2026-05-18T21:29:48","guid":{"rendered":"https:\/\/aeosub.com\/headless-login-guard\/"},"modified":"2026-05-19T05:29:48","modified_gmt":"2026-05-18T21:29:48","slug":"headless-login-guard","status":"publish","type":"post","link":"https:\/\/aeosub.com\/zh\/headless-login-guard\/","title":{"rendered":"Headless Login Guard"},"content":{"rendered":"
\"Headless<\/div>\n
\n\n\n\n\n\n\n\n
Developer<\/th>\nAndrew Wilkinson<\/a><\/td>\n<\/tr>\n
Version<\/th>\nv1.0.1<\/td>\n<\/tr>\n
Active Installs<\/th>\n0 +<\/td>\n<\/tr>\n
Requires \/ Tested<\/th>\n6.0 \/ 6.9.4<\/td>\n<\/tr>\n
Last Updated<\/th>\n2026-05-18 8:47pm GMT<\/td>\n<\/tr>\n
Official Link<\/th>\nView Details \u2192<\/a><\/td>\n<\/tr>\n<\/table><\/div>\n
Forces login for backend access in headless WordPress setups while allowing GraphQL\/REST API endpoints and essential paths.<\/div>\n

A lightweight plugin that forces login for backend access<\/strong> in a headless WordPress setup. Keeps your WordPress dashboard private while allowing your front end (e.g. Astro, Next.js) to pull content via GraphQL\/REST.<\/p>\n

What it does<\/h4>\n
    \n
  • Requires authentication for \/wp-admin\/<\/code> and other backend pages<\/li>\n
  • Always allows the login page to avoid redirect loops<\/li>\n
  • Leaves key endpoints open for headless use:\n
      \n
    • \/wp-json\/<\/code> (REST API)<\/li>\n
    • \/graphql<\/code> (WPGraphQL)<\/li>\n
    • \/wp-admin\/admin-ajax.php<\/code> (AJAX)<\/li>\n
    • \/wp-cron.php<\/code> (cron)<\/li>\n
    • \/robots.txt<\/code><\/li>\n
    • \/sitemap*.xml<\/code> (sitemaps and indexes)<\/li>\n
    • \/wp-content\/uploads\/*<\/code> (media)<\/li>\n
    • \/favicon.ico<\/code><\/li>\n
    • \/newrelic<\/code> (New Relic monitoring)<\/li>\n<\/ul>\n<\/li>\n
    • Logged-in users visiting the backend root get redirected to the dashboard<\/li>\n
    • Works with Bedrock layouts (handles root path vs \/wp\/<\/code>)<\/li>\n<\/ul>\n

      Use case<\/h4>\n
        \n
      • WordPress is the content backend<\/li>\n
      • Public site is built with Astro\/Next.js\/etc<\/li>\n
      • Editors log in to WordPress. Visitors never see the backend<\/li>\n
      • Front end builds and live pages can still query GraphQL\/REST without authentication<\/li>\n<\/ul>\n

        Customization<\/h4>\n

        Developers can customize allowed endpoints using the force_login_allowed_patterns<\/code> filter:<\/p>\n

        add_filter('force_login_allowed_patterns', function($patterns) {\n    $patterns[] = '#^\/healthz$#';           \/\/ custom health check\n    $patterns[] = '#^\/status$#';            \/\/ uptime checks\n    $patterns[] = '#^\/wp-json\/acf\/v3\/.*#';  \/\/ specific REST namespace\n    return $patterns;\n});\n<\/code><\/pre>","protected":false},"excerpt":{"rendered":"
        Forces login for backend access in headless WordPress setups while allowing GraphQL\/REST API endpoints and essential paths.<\/p>","protected":false},"author":1,"featured_media":9317,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[252],"tags":[1290,1291,1028,1085,664,555],"class_list":["post-10704","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-trends","tag-graphql","tag-headless","tag-login","tag-rest-api","tag-security","tag-wordpress-plugin"],"_links":{"self":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts\/10704","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/comments?post=10704"}],"version-history":[{"count":0,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts\/10704\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/media\/9317"}],"wp:attachment":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/media?parent=10704"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/categories?post=10704"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/tags?post=10704"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}