Limit REST API CORS to Your Own Apps
Replaces WordPress's permissive cross-origin (CORS) headers with an allow-list, so only the browser apps you name, such as a headless front end, can call the REST API with credentials.
Snippet Library
Developer snippets for WordPress
Snippets for developers: debugging helpers, custom cron schedules, body classes, REST API tweaks and admin tools for checking hooks and queries. Building blocks for people who write code for WordPress every day.