Ahrens Insights

wp json

📅 October 29, 2026📖 Verified Publication
```html WordPress JSON REST API: The Complete Guide for Developers & Site Owners

WordPress JSON REST API: The Complete Guide for Developers & Site Owners

Whether you're building a headless WordPress site, integrating a third-party app, or troubleshooting a broken API response, the WordPress JSON REST API (version 2) is the backbone that makes it all possible. This guide answers every pressing question developers and site owners actually search for—organized by the problems you're trying to solve.

Key Takeaways

  • The REST API is enabled by default in WordPress 4.7+ at /wp-json/—no plugin required for basic use.
  • Core endpoints cover posts, pages, users, media, categories, and custom post types out of the box.
  • Authentication ranges from cookie-based (logged-in users) to Application Passwords and OAuth 1.0a for external apps.
  • Common errors (404 on /wp-json, CORS issues, 401 Unauthorized) have well-documented fixes.
  • Security best practices include restricting endpoints, using nonces, and validating/sanitizing all input.
  • Headless WordPress relies entirely on the REST API to serve content to front-end frameworks like React, Vue, and Next.js.

What Is the WordPress JSON REST API?

The WordPress JSON REST API (officially the WordPress REST API v2) is a built-in framework that exposes WordPress data as JSON endpoints. Instead of pulling content directly from the database or relying on PHP templates, external applications can request or modify WordPress resources via standard HTTP methods (GET, POST, PUT, DELETE).

Every WordPress installation running version 4.7 or later ships with this API pre-installed. The base URL is always:

https://yoursite.com/wp-json/

Appending endpoint paths returns structured JSON. For example:

https://yoursite.com/wp-json/wp/v2/posts

Why It Matters

  • Decoupled architectures: Serve WordPress content to mobile apps, SPAs, and IoT devices.
  • Plugin & theme development: Build custom endpoints for bespoke functionality.
  • Automation: programmatically create, update, and delete content without logging into the dashboard.
  • Microservices: Connect WordPress to payment gateways, CRMs, email platforms, and CDNs.

How Do I Access the WordPress REST API?

Accessing the API is straightforward because no configuration is needed for public reads. Follow these steps:

Step 1 — Verify the API Is Active

Navigate to https://yoursite.com/wp-json/ in your browser. If the API is working, you'll see a JSON response listing available namespace routes.

Step 2 — Query a Core Endpoint

GET /wp-json/wp/v2/posts?per_page=10&orderby=date

Step 3 — Authenticate for Write Operations

Creating, updating, or deleting content requires authentication. The most common method for self-hosted sites is the Application Passwords feature (WordPress 5.6+):

  1. Go to Users > Profile > Application Passwords in the admin dashboard.
  2. Create a new password with a descriptive app name (e.g., "My React App").
  3. Use the username and application password as Authorization: Basic BASE64(user:pass) in your request headers.

Step 4 — Use a Testing Tool

Tools like Postman, Insomnia, or the browser's developer console make it easy to construct and inspect API requests before integrating them into code.

What Are the Core WordPress REST API Endpoints?

WordPress exposes a rich set of built-in endpoints. Below is a comparison table of the most frequently used ones:

Core REST API Endpoints at a Glance
Endpoint HTTP Method Purpose Authentication Required?
/wp/v2/posts GET / POST List or create blog posts POST only
/wp/v2/pages GET / POST List or create pages POST only
/wp/v2/users GET / POST List or create users All methods
/wp/v2/media GET / POST

© 2026 Ahrens Insights. All rights reserved.