Block User Enumeration
Stops visitors from discovering usernames through ?author=N URLs, the public REST API users endpoint, the users sitemap and oEmbed data.
WPIDE Team 6 installs
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
Add Invoice, Tracking and Delivery Data to Order API Responses
Includes invoice numbers, tracking details, delivery dates and other order fields you list in WooCommerce REST API order responses, for accounting and shipping integrations.
Add Language and Translations to the REST API (WPML)
Adds wpml_language and wpml_translations fields to posts and pages in the REST API, so headless front ends and apps know each item's language and the IDs of its translations.
Allow Application Passwords on Local Sites Without HTTPS
Turns on Application Passwords for local and development copies of the site that run on plain http, so you can test REST API integrations and apps locally the same way as in production.
Allow Only Chosen REST API Namespaces for Visitors
Blocks REST API routes for logged-out visitors except the namespaces you list (for example oEmbed, contact forms and the WooCommerce Store API), shrinking the public attack surface without breaking front-end features.
Allow Random Order in REST API Post Lists
Lets REST API clients request posts with orderby=rand, for example to show a few random articles in an app, which WordPress does not allow by default.
Application Passwords for Administrators Only
Keeps Application Passwords available for administrators (for integrations and apps) but removes them for every other user.
Author Name and Avatar in REST API Posts
Adds an author_details field with the author's display name, profile link and avatar URL to every post in the REST API, saving apps a second request or a heavy _embed call.
Cache Public REST API Responses for Visitors
Stores the responses of public GET requests to the REST API (such as post lists used by headless front ends and block widgets) for a few minutes for logged-out visitors, and clears the cache when content changes.
Category and Term Names in REST API Responses
Adds a "term_names" field to REST API responses for posts and custom post types, so apps get category and tag names without extra requests.
Disable Application Passwords
Removes the Application Passwords feature, which lets external apps authenticate to the REST API. Disable it if you do not use it.
Enable the Block Editor and REST API for a Plugin's Post Type
Turns on REST API support for post types registered without it, which also switches them to the block editor and makes them available to apps and headless sites.
Example Custom REST API Endpoint
Registers a read-only endpoint at /wp-json/wpide/v1/latest that returns your latest posts in a compact format, as a starting point for your own API routes.
Expose Chosen ACF Fields in the REST API
Adds an "acf_fields" property with the ACF fields you list to the REST API responses of chosen post types, for headless front ends and apps.
Expose Custom Product Fields in the WooCommerce REST API
Adds the product meta fields you list to WooCommerce REST API product responses as a tidy "custom_fields" object, and lets API clients update them.
Expose a Custom Field in the REST API and Block Editor
Registers a post meta field (a subtitle by default) so it is saved safely, available in the REST API and usable by the block editor and block bindings.
Featured Image URL in the REST API
Adds a featured_image_url field to posts and pages in REST API responses, so headless front ends do not need a second request.
Filter REST API Results by Allowed Custom Fields
Lets REST API requests filter posts by custom fields you allow, e.g. /wp-json/wp/v2/posts?meta_key=location&meta_value=paris, for apps and headless front ends.
Hide the REST API Index From Visitors
Stops logged-out visitors from listing every REST API route and plugin namespace at /wp-json/, while the routes themselves keep working.
Hide the REST Users Endpoint From Subscribers and Customers
Blocks the REST API users endpoint for logged-in users who cannot edit posts, such as subscribers and shop customers, so a low-level account cannot list your authors and their usernames.
Image Sizes REST Endpoint for Headless Front Ends
Adds a public /wp-json/site/v1/image-sizes endpoint listing every registered image size with its width, height and crop setting, so headless front ends can pick the right size for each layout.
Instant Search Suggestions
Shows a dropdown of matching posts and pages under every search box as the visitor types, using the built-in REST API search.
Keep REST API Responses Out of Search Results
Sends an X-Robots-Tag: noindex header with every REST API response so search engines do not index raw JSON from /wp-json/ next to your real pages.
Limit REST API CORS to Your Own Apps
Replaces WordPress's permissive cross-origin (CORS) headers with an allow-list, so only the browser apps you name, such as a headless front end, can call the REST API with credentials.