內容簡介
Headless Login Guard 是一款輕量級外掛，專為無頭 WordPress 設定設計，強制要求後端訪問進行登入，確保 WordPress 控制台的私密性，同時允許前端透過 GraphQL/REST 獲取內容。
【主要功能】
• 強制後端頁面登入
• 避免重定向迴圈
• 開放關鍵端點供無頭使用
• 支援 Bedrock 佈局
• 可自訂允許的端點
外掛標籤
開發者團隊
原文外掛簡介
A lightweight plugin that forces login for backend access in a headless WordPress setup. Keeps your WordPress dashboard private while allowing your front end (e.g. Astro, Next.js) to pull content via GraphQL/REST.
What it does
Requires authentication for /wp-admin/ and other backend pages
Always allows the login page to avoid redirect loops
Leaves key endpoints open for headless use:
/wp-json/ (REST API)
/graphql (WPGraphQL)
/wp-admin/admin-ajax.php (AJAX)
/wp-cron.php (cron)
/robots.txt
WordPress core and common SEO sitemap XML paths
/wp-content/uploads/* (media)
/favicon.ico
/newrelic (New Relic monitoring)
Logged-in users visiting the backend root get redirected to the dashboard
Works with Bedrock layouts (handles root path vs /wp/)
Use case
WordPress is the content backend
Public site is built with Astro/Next.js/etc
Editors log in to WordPress. Visitors never see the backend
Front end builds and live pages can still query GraphQL/REST without authentication
Customization
Developers can customize allowed endpoints using the force_login_allowed_patterns filter:
add_filter('force_login_allowed_patterns', function($patterns) {
$patterns[] = '#^/healthz$#'; // custom health check
$patterns[] = '#^/status$#'; // uptime checks
$patterns[] = '#^/wp-json/acf/v3/.*#'; // specific REST namespace
return $patterns;
});
