WordPress REST API

Build a custom WooCommerce storefront with the Store API and React The WooCommerce Store API (/wp-json/wc/store/v1) is the API behind the Cart and Checkout blocks. It is made for the front end: public product data needs no authentication, the cart belongs to the visitor’s session, and it returns prices, images and stock in a form…

JWT authentication for the WordPress REST API: when it fits and how to do it safely Cookies and nonces authenticate REST requests from the WordPress site itself. A mobile app or a separate frontend needs something else. WordPress core has Application Passwords since 5.6, which work with Basic Auth over HTTPS. JSON Web Tokens are…

WooCommerce product images from URLs: sideload, gallery and REST API Product data from a supplier usually comes with image URLs, not files. The WooCommerce REST API can take those URLs and download the images itself, and in PHP the same is done with media_sideload_image() plus set_image_id() and set_gallery_image_ids(). The parts that are easy to get…

Extend the WooCommerce REST API: extra fields and custom routes An ERP or a mobile app talks to WooCommerce through /wp-json/wc/v3/. Sooner or later it needs data that WooCommerce does not expose: an internal supplier code on products, a B2B account number on customers, or a resource of the plugin itself. There are two clean…

REST API controllers with WP_REST_Controller A plugin’s first REST route is usually a register_rest_route() call with a closure. By the fifth route, permission checks, argument definitions and response formatting are copied around, and ?_fields= or context=edit do not work like in core routes. Core’s own endpoints are built on WP_REST_Controller, and a plugin can extend…

Harden the WordPress REST API without breaking the editor “Disable the REST API” is common advice and wrong: the block editor, the Site Editor, many plugins and WooCommerce’s checkout blocks run on it. What can be done is smaller and safer: hide the routes that leak data to anonymous visitors, remove routes of features the…

WooCommerce webhooks with HMAC signature verification WooCommerce can push events to another system instead of being polled: when an order is created or updated, it sends a POST request with the order as JSON to a delivery URL. Every request is signed with a secret, and the receiver must check that signature before trusting the…

WooCommerce order notes from a warehouse webhook Order notes are the timeline of a WooCommerce order: status changes, payment messages, and anything a plugin adds with add_order_note(). A note can be private (only the shop staff sees it) or a customer note, which WooCommerce also sends to the customer by email. That makes them a…

Nginx rate limiting for the WordPress login, XML-RPC and the REST API A brute-force attack on wp-login.php is mainly a load problem: every attempt starts PHP, loads WordPress and checks a password hash, which is deliberately slow. A security plugin blocks the attacker only after all that work is done. Nginx can limit the request…