Build the product you want without rebuilding WordPress.
Your content, users, media, and editorial workflow stay in WordPress. RESTful JSON API provides the connection your mobile app, web frontend, or AI-assisted build needs.
Mobile apps
Give iOS, Android, Flutter, or React Native apps a consistent way to load content, authenticate users, manage profiles, and submit protected content.
Structured-content apps
Power directories, courses, events, listings, products, recipes, jobs, properties, and other products built around custom post types and taxonomies.
Headless websites
Use WordPress as the editorial system behind a separate frontend while keeping content discovery, media, menus, search, users, and permissions in one place.
AI-assisted builds
Claude, Codex, Gemini, Copilot, Grok, and other coding tools can follow discoverable controller and endpoint patterns instead of inventing a custom integration.
Start with the Free RESTful JSON API Plugin. Upgrade when the app must write and scale.
The free plugin is a capable foundation for content delivery and user flows. Pro is for products that need protected content management, stronger operational controls, and commercial support.
JWT bearer authentication
Cookie auth is gone. Apps log in with user/login, receive a plugin-issued JWT, and send Authorization: Bearer ACCESS_TOKEN on protected endpoints.
Five modular controllers
Core, Posts, Respond, Widgets, User — 40 free endpoints and 54 with the expanded Pro Posts controller. Only Core is on by default; activate others in one click.
CPT and taxonomy discovery
Mobile and web apps can discover public post types, taxonomies, terms, media, attachments, and comments before rendering custom app screens.
Optional API key
Require a shared secret on every request. Off by default, opt-in when needed — also accepts an X-JSON-API-KEY header.
CORS support
Per-origin CORS headers so browser-based JS on a different domain can call your API. Off by default, never a wildcard *.
Require HTTPS setting
API Config includes a Require HTTPS checkbox, enabled by default, with a clear warning before site owners disable SSL protection for password or bearer-token requests.
Six extension hooks
Build custom caching, throttling, or logging without touching core code. Pro and 3rd-party plugins hook these directly.
Settings link on plugin row
A Settings link appears on both the free and Pro plugin rows — instant access without hunting through admin menus.
Documentation tab
Full endpoint documentation now lives inside the plugin settings, with controller groups and sample code for login, token validation, post writes, user meta, comments, and more.
Expanded Posts controller
JWT-protected content management for apps and agents.
- Create, update, and delete posts or CPT entries
- Create, update, delete, and assign taxonomy terms
- Read, set, and delete post meta
- Upload, sideload, or reuse featured media
Caching
Anonymous GET responses cached as WP transients.
- 1 hr to 72 hrs, or off
- Per-endpoint exclude list by controller
- Param-aware cache keys
- Auth & nonce endpoints never cached
Rate Limiting
Token-bucket throttling — no fixed-window boundary burst.
- Limit by IP, the site’s shared API key, or globally
- Fires before controller validation
- Clean 429 + Retry-After header
Audit Logging
Opt-in trail for write-style calls.
- Records time, endpoint, user, object ID, IP
- Never stores request body or payload
- Filterable log viewer with clear-all
Manage Transients
A real WP_List_Table screen over cached responses.
- Filter by endpoint, sort by age
- Row-level or bulk delete
- One-click “Delete All Transients”
Connect your app in three straightforward steps.
Install the plugin, enable only the controllers your project needs, then call plain HTTPS endpoints from your preferred app framework. No vendor SDK is required.
JavaScript (fetch)
PHP (wp_remote_*)
# Step 1 — Get recent posts (Posts controller) curl "https://yoursite.com/api/posts/get_recent_posts/?count=5" # Step 2 — Get a JWT bearer token (User controller must be active) curl -X POST "https://yoursite.com/api/user/login/" \ -d "username=editor&password=YOUR_PASSWORD" # Step 3 — Create a CPT post with taxonomy, ACF-style meta, and an image URL curl -X POST "https://yoursite.com/api/posts/create_post/" \ -H "Authorization: Bearer ACCESS_TOKEN_FROM_STEP_2" \ -d "post_type=property" \ -d "title=Downtown Apartment" \ -d "status=publish" \ -d "taxonomies[property_city]=Lahore" \ -d "meta[price]=250000" \ -d "image_url=https://example.com/property.jpg" \ -d "set_featured_image=1"
// Step 1 — Get recent posts const res = await fetch("https://yoursite.com/api/posts/get_recent_posts/?count=5"); const data = await res.json(); // Step 2 — Obtain a JWT bearer token const auth = await fetch("https://yoursite.com/api/user/login/", { method: "POST", body: new URLSearchParams({ username: "editor", password: "YOUR_PASSWORD" }) }).then(r => r.json()); // Step 3 — Create a CPT post with app fields await fetch("https://yoursite.com/api/posts/create_post/", { method: "POST", headers: { "Authorization": `Bearer ${auth.token}`, "Content-Type": "application/x-www-form-urlencoded" }, body: new URLSearchParams({ post_type: "property", title: "Downtown Apartment", status: "publish", "taxonomies[property_city]": "Lahore", "meta[price]": "250000", image_url: "https://example.com/property.jpg", set_featured_image: "1" }) });
// Step 1 — Get recent posts $r = wp_remote_get( 'https://yoursite.com/api/posts/get_recent_posts/?count=5' ); $posts = json_decode( wp_remote_retrieve_body( $r ) )->posts; // Step 2 — Obtain a JWT bearer token $auth = json_decode( wp_remote_retrieve_body( wp_remote_post( 'https://yoursite.com/api/user/login/', [ 'body' => [ 'username' => 'editor', 'password' => 'YOUR_PASSWORD' ] ] ) ) ); $token = $auth->token; // Step 3 — Create a CPT post with app fields wp_remote_post( 'https://yoursite.com/api/posts/create_post/', [ 'headers' => [ 'Authorization' => 'Bearer ' . $token ], 'body' => [ 'post_type' => 'property', 'title' => 'Downtown Apartment', 'status' => 'publish', 'taxonomies' => [ 'property_city' => 'Lahore' ], 'meta' => [ 'price' => '250000' ], 'image_url' => 'https://example.com/property.jpg', 'set_featured_image' => '1', ], ] );
💡 The token from user/login is a plugin-issued JWT. Send it as Authorization: Bearer ACCESS_TOKEN on protected endpoints. Cookie auth and Application Passwords are not used. CPT and ACF-style app fields use post_type, taxonomies[…], and meta[…].
Fit the API into your stack—not your stack into the API.
The plugin uses familiar WordPress concepts and standard HTTPS requests, so teams can evaluate it quickly and keep their existing app framework, hosting, and editorial workflow.
Works with your framework
Use Flutter, native iOS or Android, React Native, JavaScript, PHP, or any client that can make HTTPS requests and parse JSON.
Discoverable and documented
Focused controllers, predictable endpoint patterns, and documentation inside WordPress help both developers and AI coding tools follow the integration.
Upgrade without rebuilding
Start with the free plugin, preserve the same read paths, and add Pro’s write operations and production controls when the product requires them.
Get every Pro feature. Choose the license that fits.
Every paid tier includes the same expanded Posts controller and production controls. Choose by site count, support level, and bundled custom-development time.
Pro
Single site or client project
Single domain · 1 year updates & support
- Expanded Posts controller with protected content, taxonomy, and post-meta writes
- Caching, Rate Limiting, Logging, Manage Transients
- License activation tab in free plugin settings
- Basic email support
- 1 year of plugin updates
- Renew after year one — optional
Secure PayPal checkout
Business
Agencies with a handful of clients
4 domains · 1 year updates & priority support
- Everything in Pro
- Priority email support
- 2 hours custom endpoint development
- License covers up to 4 client installs
Secure PayPal checkout
Developer
Agencies & product builders
Up to 8 domains · 2 years updates & support
- Everything in Business
- License covers up to 8 domains — ideal for agencies
- Priority support + 30-min onboarding call
Secure PayPal checkout
See exactly when Pro becomes the right choice.
All paid tiers run the identical Pro plugin — what differs is site count, support level, and bundled dev hours.
| Freewordpress.org | Pro$110 · 1 domain | Business$255 · 4 domains | Developer$399 · 8 domains | |
|---|---|---|---|---|
| Free REST endpoints (40) | ✓ | ✓ | ✓ | ✓ |
| Pro post write endpoints | — | ✓ | ✓ | ✓ |
| CPT create/update/delete with post_type | — | ✓ | ✓ | ✓ |
| ACF-style custom fields via post meta | — | ✓ | ✓ | ✓ |
| Image uploads, image URLs, base64 images | — | ✓ | ✓ | ✓ |
| JWT bearer authentication | ✓ | ✓ | ✓ | ✓ |
| Optional API key auth | ✓ | ✓ | ✓ | ✓ |
| CORS allowed-origins | ✓ | ✓ | ✓ | ✓ |
| Require HTTPS auth setting | ✓ | ✓ | ✓ | ✓ |
| Documentation tab with endpoint samples | ✓ | ✓ | ✓ | ✓ |
| Top-level admin menu | ✓ | ✓ | ✓ | ✓ |
| Settings link on plugin row | ✓ | ✓ | ✓ | ✓ |
| Six developer extension hooks | ✓ | ✓ | ✓ | ✓ |
| Caching (transients, per-endpoint) | — | ✓ | ✓ | ✓ |
| Token-bucket Rate Limiting | — | ✓ | ✓ | ✓ |
| Audit Logging | — | ✓ | ✓ | ✓ |
| Manage Transients screen | — | ✓ | ✓ | ✓ |
| License activation & management | — | ✓ | ✓ | ✓ |
| Support level | Community (wp.org) | Basic email | Priority email | Priority + onboarding call |
| Updates included | Ongoing | 1 year | 1 year | 2 years |
Production controls you can manage from WordPress.
Improve repeat-read performance, slow abusive traffic, review important write activity, and refresh API caches without building separate infrastructure.
Response Caching
Successful anonymous GET responses are cached as WordPress transients, avoiding repeated controller and content-query work on cache hits. Duration: 1 hr to 72 hrs. Cache keys are parameter-aware so ?page=1 and ?page=2 never collide. Auth and nonce endpoints are excluded automatically.
Token-Bucket Rate Limiting
Fires at early_dispatch, before controller validation and endpoint-specific database work. The token bucket refills continuously: normal bursts are absorbed while sustained abuse is capped. Rejected requests receive 429 with a Retry-After header.
Audit Log
Records selected write-style API calls without storing payload bodies, passwords, JWT tokens, or submitted content. Useful for seeing who created, updated, deleted, registered, or changed user meta.
Manage Transients
A real WP_List_Table over all cached responses. Filter by endpoint, sort by age, delete a single row or bulk-clear. One button to purge all API transients at once — useful after a content import or theme change.
Caching
Cache anonymous read endpoints without touching authenticated traffic.
Caching is built for public content reads such as posts, pages, taxonomies, menus, search, and archive indexes. It stores successful anonymous responses as WordPress transients and skips sensitive endpoints automatically.
- Turn caching off, or choose a duration from 1 hour through 72 hours.
- Cache keys include endpoint plus normalized request parameters.
- Authenticated, JWT, nonce, login, signup, and write-style endpoints stay uncached.
- Works with the moved Posts controller paths such as posts/get_recent_posts.
- Stores only the final response payload in WordPress transients.
Rate Limiting
Stop abusive API bursts before controller code runs.
Rate Limiting runs early in dispatch, before expensive controller work. The token-bucket model permits normal bursts but caps sustained abuse with a predictable API response.
- Limit by client IP, the site’s configured shared API key, or one global site-wide bucket.
- Set max burst capacity and sustained refill rate.
- Runs before database-heavy endpoint logic is reached.
- Returns HTTP 429 plus Retry-After for clients that should back off.
- Avoids fixed-window boundary bursts that can double traffic in seconds.
Log
Audit important API activity without storing private payloads.
The Log tab is for operational visibility. It records the facts needed to trace API activity while deliberately avoiding request bodies and sensitive values.
- Enable or disable audit logging from its own tab.
- Choose which endpoints should be logged.
- Default focus is write-style endpoints like post writes, signup, and user meta changes.
- Records timestamp, endpoint, user ID, detectable object ID, and IP address.
- Never stores passwords, JWT tokens, raw request bodies, or submitted post content.
| Time | Endpoint | User | Object ID |
|---|---|---|---|
| 09:42 | posts/create_post | #12 | #248 |
| 09:39 | user/set_meta | #12 | — |
| 09:34 | posts/delete_post | #4 | #241 |
| 09:31 | user/signup | guest | #18 |
Manage Transients
Inspect and clear cached API responses from wp-admin.
Manage Transients turns the hidden cache layer into a visible admin workflow. Site owners can inspect cached endpoint rows and clear only what needs to be refreshed.
- List RESTful JSON API cache transients in a WordPress admin table.
- Filter rows by endpoint name and sort by age or expiration.
- Delete one cached response, selected rows, or all API transients.
- Useful after imports, migrations, taxonomy edits, or menu changes.
- Designed for API-specific cache cleanup without touching unrelated site transients.
| Endpoint | Age | Expires | |
|---|---|---|---|
| posts/get_recent_posts | 12 min | 23h 48m | |
| core/get_menu | 31 min | 23h 29m | |
| posts/get_category_posts | 1h 08m | 22h 52m |
Token buckets vs. fixed windows — why it matters
The bucket refills at a continuous rate. A client can burst up to the max capacity then is smoothed to the sustained rate. No exploit at any boundary.
A client fires 60 requests at 12:00:59 and 60 more at 12:01:00 — 120 requests in under 2 seconds, technically within the rules. Token bucket closes this exploit entirely.
Move from content access to a production app backend.
Pro lets authenticated app users and services manage CPT content, taxonomy terms, custom fields, and images. It also gives site owners practical controls for performance, abuse prevention, activity visibility, and cache cleanup.
License Activation
RESTful JSON API Pro License Not Activated
Enter your license key to unlock the expanded Posts controller, Caching, Rate Limiting, Log, and Manage Transients. All license types activate the same plugin features.
RESTful JSON API Pro License Active
Activated on: yoursite.com · License type: Business · Expires: 2027-07-01
How licensing works
- Pro announces itself at filter priority 1 (always “installed”)
- Licensing class hooks at priority 10 with the real active/inactive state
- Unlicensed install shows the “Upgrade” mock-up tabs again — not an error
- Deactivate on one site to activate on another within your seat count
Pro settings screen
License Active
yoursite.com · Business
The License box appears at the top of every Pro tab — reachable wherever you are in settings. Pro’s settings expand with each new feature release.
Expose only the API capabilities your project needs.
For implementation teams, the API is divided into five focused controllers. Core is enabled by default; activate the others from RESTful JSON API → Settings → Controllers.
Core controller Active by default · Read-only
API metadata, pages, search, archive indexes, taxonomy indexes, authors, menus, and nonce helper methods. Post read endpoints now live in the Posts controller.
Posts controller
⭐ Read in free · Write in Pro
Free includes post, CPT, taxonomy, media, attachment, and comment read endpoints. Pro expands that controller with JWT-protected post and CPT writes, taxonomy term management and assignment, plus post-meta operations. Use CPTs for products, listings, courses, events, directories, or any app-specific content model; use post meta for ACF-style fields.
attachment, featured_image, image_url, base64 image_data, and existing featured_media.Authorization: Bearer ACCESS_TOKEN- Account needs
edit_postscapability
post_type,status,title,contenttaxonomies[product_cat],categories,tagsmeta[acf_field_name],attachment,featured_image,image_url,image_data
Authorization: Bearer ACCESS_TOKENfor a user that can edit this postid/post_idorslug/post_slug
- Same fields as create_post
Authorization: Bearer ACCESS_TOKEN- Requires
edit_post,delete_posts, anddelete_other_postswhen deleting another user’s post id/post_idorslug/post_slug
User controller
⭐ Spotlight — Auth & Accounts
A rebuilt User controller for signup, JWT login, token validation, profiles, avatars, safe user meta, password reset requests, and authenticated comments. Legacy cookie, Facebook, and BuddyPress xProfile endpoints have been removed.
username,password· HTTPS required by default
seconds— token lifetime
Authorization: Bearer ACCESS_TOKEN
username,email
password,display_name,first_name,last_name,custom_fields
Authorization: Bearer ACCESS_TOKEN
user_id,username,size,avatar_size
Authorization: Bearer ACCESS_TOKENkey/valueorcustom_fields
account— username or email address
Authorization: Bearer ACCESS_TOKENfor commentspost_id,content
Respond controller
Accepts comments from decoupled front ends without a browser session.
Widgets controller
Returns rendered HTML for any registered sidebar — handy for mirroring footers inside an app shell.
Configure the API without editing code.
Use a dedicated WordPress admin area to choose controllers, enforce HTTPS, configure a shared API key and browser origins, read endpoint documentation, manage Pro controls, and find support.
Admin menu structure
Companion plugins hook restful_json_api_admin_menu to add their submenu item — no separate top-level entries scattered through wp-admin.
Plugin page Settings links
API Config tab — all settings
CachingRate Limiting
LogManage Transients
LicenseDocumentationSupport
URL segment for pretty permalink requests. With api set, calls look like yoursite.com/api/posts/get_recent_posts/. Leave blank for ?json= query variable fallback.
Optional, blank by default. When set, every request must include this as a key param or X-JSON-API-KEY header — rejected with a 401 if missing.
Comma-separated list of origins permitted to call this API from browser JavaScript (e.g. https://app.example.com). Leave blank to send no CORS headers. Matched origin is reflected back specifically — never a literal wildcard *. CORS is a browser-only mechanism and doesn’t affect mobile apps or server calls.
Blocks password and JWT bearer-token requests unless the request is HTTPS. Site owners can uncheck it for local or non-SSL environments, but the field includes a warning because production sites should keep it enabled.
Preview Pro controls before you buy.
The free plugin shows accurate previews of Pro settings. After installing Pro and activating a license, those controls become available in the same RESTful JSON API admin area.
With Pro active
Controllers
CachingPRO
Rate Limiting
Log
Documentation
Caching
Cache successful anonymous read-only responses using WordPress transients.
All four Pro tabs are already visible — accurate layout, disabled fields, upgrade overlay.
Pro detects the free plugin, announces itself, enter the license key in the License tab.
Disabled fields become live settings in the exact same positions. Try the toggle above.
Click the dots to preview each Pro tab.
A separate Pro add-on built on stable extension points.
The free plugin remains the API foundation. Pro depends on it, replaces the Posts controller when licensed, and attaches operational features through named hooks.
Get every Pro feature. Choose the license that fits.
Every paid tier includes the same expanded Posts controller and production controls. Choose by site count, support level, and bundled custom-development time.
Frequently Asked Questions
No. The free plugin includes Core, Posts read, Respond, Widgets, and User endpoints. Pro adds post create/update/delete plus caching, rate limiting, logging, and the transients manager around the API you’re already running.
Pro replaces the free read-only Posts controller with an expanded controller for protected post and CPT writes, taxonomy term management, taxonomy assignment, and post-meta operations. It also adds anonymous response caching, token-bucket rate limiting, audit logging, API-cache transient management, and license-managed settings screens.
Yes. The free Posts controller can discover post types, taxonomies, terms, media, attachments, and comments. Pro write endpoints accept post_type, taxonomies[…], and meta[…], so an app can create and update CPT content with ACF-style custom fields and featured images.
Yes. Claude, Codex, Gemini, Copilot, Grok, and other AI builders can follow a simple pattern: install RESTful JSON API, enable the needed controllers, call user/login for a JWT, then use controller endpoints such as posts/get_post_types, posts/get_taxonomies, and Pro posts/create_post.
No. Cookie auth endpoints were removed. Clients now authenticate with user/login, receive a JWT, and send it as Authorization: Bearer ACCESS_TOKEN on protected endpoints.
No. The plugin issues its own JWT tokens, so users do not need to manually create WordPress Application Passwords before using a mobile app or external client.
Only when a web app hosted on a different domain calls this API directly from browser JavaScript. Mobile apps, cron jobs, and server-to-server calls are never affected by CORS — it’s a browser-only mechanism.
No. Logging records only the timestamp, endpoint, user ID (if any), affected object ID, and IP address. The actual request body — including passwords or tokens — is never written to the log.
Yes. Click “Deactivate License” on the current site to free the seat, then enter the same key on the new site and activate. Licenses are seat counts, not domain locks.
The plugin keeps working as installed. You won’t receive new feature updates or priority support until you renew — but there’s no expiry on the software itself.
Resources & Articles
In-depth guides on caching, rate limiting, migration, and how RESTful JSON API Pro works under the hood.
Questions? Custom requirements?
Pre-sales questions, custom endpoints, or agency licensing — send a message and we’ll reply within one business day.
Not sure which plan fits? Describe your use case and we’ll tell you.
Business and Developer plans include bundled dev hours. Need more? Get a quote.
Running 10+ sites? We can discuss volume arrangements.
Start free. Upgrade when your app is ready to publish and scale.
Use the free plugin to connect WordPress, read content, and build user flows. Choose Pro when you need protected CPT writes, taxonomy and custom-field management, caching, rate limiting, audit logs, and commercial support.






