wp json
WordPress JSON REST API: The Complete Guide for Developers & Site Owners
Whether you're building a headless WordPress site, integrating a third-party app, or troubleshooting a broken API response, the WordPress JSON REST API (version 2) is the backbone that makes it all possible. This guide answers every pressing question developers and site owners actually search for—organized by the problems you're trying to solve.
Key Takeaways
- The REST API is enabled by default in WordPress 4.7+ at
/wp-json/—no plugin required for basic use. - Core endpoints cover posts, pages, users, media, categories, and custom post types out of the box.
- Authentication ranges from cookie-based (logged-in users) to Application Passwords and OAuth 1.0a for external apps.
- Common errors (404 on /wp-json, CORS issues, 401 Unauthorized) have well-documented fixes.
- Security best practices include restricting endpoints, using nonces, and validating/sanitizing all input.
- Headless WordPress relies entirely on the REST API to serve content to front-end frameworks like React, Vue, and Next.js.
What Is the WordPress JSON REST API?
The WordPress JSON REST API (officially the WordPress REST API v2) is a built-in framework that exposes WordPress data as JSON endpoints. Instead of pulling content directly from the database or relying on PHP templates, external applications can request or modify WordPress resources via standard HTTP methods (GET, POST, PUT, DELETE).
Every WordPress installation running version 4.7 or later ships with this API pre-installed. The base URL is always:
https://yoursite.com/wp-json/
Appending endpoint paths returns structured JSON. For example:
https://yoursite.com/wp-json/wp/v2/posts
Why It Matters
- Decoupled architectures: Serve WordPress content to mobile apps, SPAs, and IoT devices.
- Plugin & theme development: Build custom endpoints for bespoke functionality.
- Automation: programmatically create, update, and delete content without logging into the dashboard.
- Microservices: Connect WordPress to payment gateways, CRMs, email platforms, and CDNs.
How Do I Access the WordPress REST API?
Accessing the API is straightforward because no configuration is needed for public reads. Follow these steps:
Step 1 — Verify the API Is Active
Navigate to https://yoursite.com/wp-json/ in your browser. If the API is working, you'll see a JSON response listing available namespace routes.
Step 2 — Query a Core Endpoint
GET /wp-json/wp/v2/posts?per_page=10&orderby=date
Step 3 — Authenticate for Write Operations
Creating, updating, or deleting content requires authentication. The most common method for self-hosted sites is the Application Passwords feature (WordPress 5.6+):
- Go to Users > Profile > Application Passwords in the admin dashboard.
- Create a new password with a descriptive app name (e.g., "My React App").
- Use the username and application password as
Authorization: Basic BASE64(user:pass)in your request headers.
Step 4 — Use a Testing Tool
Tools like Postman, Insomnia, or the browser's developer console make it easy to construct and inspect API requests before integrating them into code.
What Are the Core WordPress REST API Endpoints?
WordPress exposes a rich set of built-in endpoints. Below is a comparison table of the most frequently used ones:
| Endpoint | HTTP Method | Purpose | Authentication Required? |
|---|---|---|---|
/wp/v2/posts |
GET / POST | List or create blog posts | POST only |
/wp/v2/pages |
GET / POST | List or create pages | POST only |
/wp/v2/users |
GET / POST | List or create users | All methods |
/wp/v2/media |
GET / POST |