WordPress REST API basics

What the REST API exposes

WordPress ships a REST API that turns site data into JSON. Everything from posts, pages, users and media to settings and plugins can be read and, with the right permissions, written through HTTP. The root of the API is /wp-json, so the endpoint to read recent posts is:

GET /wp-json/wp/v2/posts

The API is versioned under wp/v2, and each resource type has its own set of routes: wp/v2/posts, wp/v2/pages, wp/v2/media, wp/v2/categories, wp/v2/users and wp/v2/settings. The site lists every route it exposes at the discovery endpoint GET /wp-json, which returns a long JSON object naming each route and its accepted methods.

Reading public data

A read that needs no authentication is as simple as requesting the endpoint:

curl https://example.com/wp-json/wp/v2/posts?per_page=10

Public reads return the posts with their title, excerpt, link and other public fields. The API supports pagination (page, per_page), filtering (categories, author, search) and ordering (orderby), so a small script or an external front end can pull the site's content without a database connection.

Authenticating writes

Creating or editing content requires proving you are an allowed user. The safest way on a production site is an application password: create one in the user's profile (Users > Profile > Application Passwords), then send it in the request. For example, to create a draft post:

curl -u USER:APP_PASSWORD \
  -X POST https://example.com/wp-json/wp/v2/posts \
  -H "Content-Type: application/json" \
  -d '{"title":"Draft from API","status":"draft","content":"Hello"}'

With the right permissions the API returns the created post with its new ID; without them it returns a 401 or 403 and makes no change. Keep the application password secret and scope it to an account with only the roles it needs, since it can write through the same API the dashboard uses.

Practical cautions

• Disable XML-RPC for REST-only sites. If you do not use the legacy XML-RPC interface, disabling it removes a different attack surface while the REST API continues to work.
• Watch the settings route. wp/v2/settings can only be read by an authorized user, so do not assume it is public data.
• Respect rate limits on shared hosts. Bulk REST writes from a script can trip the same request limits as any other load.

The WP-CLI scaffold guide shows the command-line alternative for the same operations, which is often the better tool for one-off changes, while a troubleshooting order is covered in WordPress troubleshooting. For the read-heavy side, connect the API to an object cache so repeated calls do not hit the database every time.