Title: Headless Login Guard Author: Andrew Wilkinson Published: 18 maijs, 2026 Last modified: 4 augusts, 2026 --- Meklēt spraudņus ![](https://ps.w.org/headless-login-guard/assets/banner-772x250.png?rev=3536308) ![](https://ps.w.org/headless-login-guard/assets/icon-256x256.png?rev=3536307) # Headless Login Guard Autors [Andrew Wilkinson](https://profiles.wordpress.org/andrew40/) [Lejupielādēt](https://downloads.wordpress.org/plugin/headless-login-guard.1.1.0.zip) * [Sīkāka informācija](https://lv.wordpress.org/plugins/headless-login-guard/#description) * [Atsauksmes](https://lv.wordpress.org/plugins/headless-login-guard/#reviews) * [Uzstādīšana](https://lv.wordpress.org/plugins/headless-login-guard/#installation) * [Attīstība](https://lv.wordpress.org/plugins/headless-login-guard/#developers) [Atbalsts](https://wordpress.org/support/plugin/headless-login-guard/) ## Apraksts A lightweight plugin that **forces login for backend access** in a headless WordPress setup. Keeps your WordPress dashboard private while allowing your front end (e.g. Astro, Next.js) to pull content via GraphQL/REST. #### What it does * Requires authentication for `/wp-admin/` and other backend pages * Always allows the login page to avoid redirect loops * Leaves key endpoints open for headless use: - `/wp-json/` (REST API) - `/graphql` (WPGraphQL) - `/wp-admin/admin-ajax.php` (AJAX) - `/wp-cron.php` (cron) - `/robots.txt` - WordPress core and common SEO sitemap XML paths - `/wp-content/uploads/*` (media) - `/favicon.ico` - `/newrelic` (New Relic monitoring) * Logged-in users visiting the backend root get redirected to the dashboard * Works with Bedrock layouts (handles root path vs `/wp/`) #### Use case * WordPress is the content backend * Public site is built with Astro/Next.js/etc * Editors log in to WordPress. Visitors never see the backend * Front end builds and live pages can still query GraphQL/REST without authentication #### Customization Developers can customize allowed endpoints using the `force_login_allowed_patterns` filter: ``` add_filter('force_login_allowed_patterns', function($patterns) { $patterns[] = '#^/healthz$#'; // custom health check $patterns[] = '#^/status$#'; // uptime checks $patterns[] = '#^/wp-json/acf/v3/.*#'; // specific REST namespace return $patterns; }); ``` ## Uzstādīšana 1. Upload the plugin files to the `/wp-content/plugins/headless-login-guard` directory, or install the plugin through the WordPress plugins screen directly. 2. Activate the plugin through the ‘Plugins’ screen in WordPress. 3. The plugin will automatically start protecting your backend – no configuration needed! ## BUJ ### I’m locked out! How do I access my site? Visit `/wp-login.php` directly to sign in. The plugin always allows access to the login page. ### My front-end requests are failing. What should I do? Verify the endpoint is on the allow list. Check the plugin description for the default allowed patterns, or use the `force_login_allowed_patterns` filter to add custom endpoints. ### Does this work with Bedrock? Yes! The plugin correctly handles both standard WordPress installs and Bedrock layouts where the site URL and home URL may differ. ### Can I add custom endpoints? Yes, use the `force_login_allowed_patterns` filter to add your own regex patterns for additional endpoints that should remain public. ## Atsauksmes ![](https://secure.gravatar.com/avatar/5cabcd69e24eb79ae84b4273aaef12c69ebc5d611de7ea339965f8111fc7770e? s=60&d=retro&r=g) ### 󠀁[Guards my headless WP](https://wordpress.org/support/topic/guards-my-headless-wp/)󠁿 [thewebist](https://profiles.wordpress.org/thewebist/) 31 jūlijs, 2026 Does what it says. Guards my headless WP setup. [ Lasīt 1 atsauksmes ](https://wordpress.org/support/plugin/headless-login-guard/reviews/) ## Autori un izstrādātāji “Headless Login Guard” ir atvērtā pirmkoda programmatūra. Šo spraudni ir veidojuši šādi cilvēki. Līdzdalībnieki * [ Andrew Wilkinson ](https://profiles.wordpress.org/andrew40/) [Tulkot “Headless Login Guard” savā valodā.](https://translate.wordpress.org/projects/wp-plugins/headless-login-guard) ### Vai jūs interesē attīstība? [Pārlūkojiet kodu](https://plugins.trac.wordpress.org/browser/headless-login-guard/), apmeklējiet[ SVN krātuvi ](https://plugins.svn.wordpress.org/headless-login-guard/) vai abonējiet[ attīstības žurnālu](https://plugins.trac.wordpress.org/log/headless-login-guard/), ko izveidojis [RSS](https://plugins.trac.wordpress.org/log/headless-login-guard/?limit=100&mode=stop_on_copy&format=rss). ## Izmaiņu žurnāls #### 1.1.0 * Fixed: Allow WordPress core, Yoast-style, and nested sitemap XML paths * Fixed: Match allowlisted endpoints correctly on subdirectory, Bedrock, and multisite installations * Fixed: Preserve query strings without duplicating the site path in login redirect destinations * Improved: Parse request paths separately from query strings * Improved: Send no-cache headers before login redirects * Improved: Added redirect, sitemap, query-string, and subdirectory integration tests #### 1.0.1 * Added: New Relic monitoring endpoint allowlist pattern (`/newrelic`) to support APM monitoring * Added: WordPress.org plugin directory compatibility * Added: Proper plugin structure with activation/deactivation hooks * Added: Filter hook for customizing allowed patterns * Improved: Code organization and documentation #### 1.0.0 * Initial release * Restricts backend (`/wp-admin/`) to authenticated users * Allows GraphQL and REST API endpoints for headless front-ends * Basic whitelist of essential endpoints (cron, ajax, robots.txt, sitemaps, uploads) ## Meta * Versija **1.1.0** * Pēdējo reizi atjaunots: **pirms 3 nedēļas** * Aktīvās instalācijas: **Mazāk par 10** * WordPress versija ** 6.0 vai jaunāka ** * Pārbaudīts līdz: **7.0.4** * PHP versija ** 8.1 vai jaunāka ** * Valoda * [English (US)](https://wordpress.org/plugins/headless-login-guard/) * Birkas: * [GraphQL](https://lv.wordpress.org/plugins/tags/graphql/)[headless](https://lv.wordpress.org/plugins/tags/headless/) [login](https://lv.wordpress.org/plugins/tags/login/)[rest-api](https://lv.wordpress.org/plugins/tags/rest-api/) [security](https://lv.wordpress.org/plugins/tags/security/) * [Papildu skats](https://lv.wordpress.org/plugins/headless-login-guard/advanced/) ## Vērtējumi 5 no 5 zvaigznēm. * [ 1 5-star review ](https://wordpress.org/support/plugin/headless-login-guard/reviews/?filter=5) * [ 0 4-star reviews ](https://wordpress.org/support/plugin/headless-login-guard/reviews/?filter=4) * [ 0 3-star reviews ](https://wordpress.org/support/plugin/headless-login-guard/reviews/?filter=3) * [ 0 2-star reviews ](https://wordpress.org/support/plugin/headless-login-guard/reviews/?filter=2) * [ 0 1-star reviews ](https://wordpress.org/support/plugin/headless-login-guard/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/headless-login-guard/reviews/#new-post) [Skatīt visasatsauksmes](https://wordpress.org/support/plugin/headless-login-guard/reviews/) ## Līdzdalībnieki * [ Andrew Wilkinson ](https://profiles.wordpress.org/andrew40/) ## Atbalsts Jums ir kaut kas ko teikt? Vajadzīga palīdzība? [Skatīt atbalsta forumu](https://wordpress.org/support/plugin/headless-login-guard/)