Skip to content

Instantly share code, notes, and snippets.

@joehoyle

joehoyle/private-wp-api.php

Created October 14, 2015 18:37
Show Gist options
  • Save joehoyle/b944d1984701df9dc494 to your computer and use it in GitHub Desktop.
Save joehoyle/b944d1984701df9dc494 to your computer and use it in GitHub Desktop.
Download ZIP
Only allow access to the API for authenticated requests
Raw
private-wp-api.php
<?php
add_filter( 'rest_pre_dispatch', function() {
if ( ! is_user_logged_in() ) {
return new WP_Error( 'not-logged-in', 'API Requests are only supported for authenticated requests', array( 'status' => 401 ) );
}
} );
@joehoyle
Copy link
Author

I'd stress that if you want to lock down the API, you'll probably want to use a capability check rather than is_user_logged_in (such as current_user_can( 'edit_posts' )) as being logged in doesn't meant much if they are logged in as a user with no capabilities.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment