The WordPress REST API Explained for Business Owners
The WordPress REST API explained without jargon: what it lets apps and systems do with your site, common business uses, security settings.
The WordPress REST API lets other software talk to your WordPress site. It can read content, create posts, update records or trigger actions, without anyone logging into the admin. It is what makes WordPress useful as more than a website. A mobile app can show your latest content. A dashboard can pull in enquiries, and an external system can keep stock or bookings in sync, all through one standard interface.
This guide explains the REST API without code, through three business use cases. It also covers what the API exposes, how to secure it, custom endpoints and when you need a developer.
Key takeaways
- An API is a structured way for software to request and send data; the REST API is WordPress's version.
- By default it exposes public content such as posts and pages, and more when a request is authenticated.
- Common business uses include mobile apps, dashboards and syncing data with other systems.
- Lock it down: use proper authentication, limit what is exposed and protect any keys.
- Custom endpoints let a developer expose exactly the data and actions your business needs.
What an API is
An API, or application programming interface, is a set of rules that lets one piece of software ask another for information or ask it to do something. When a weather app shows the forecast, it is asking a weather service's API. When a payment form charges a card, it is calling a payment provider's API.
The WordPress REST API does the same for your website. Other software sends a request to a web address on your site, and WordPress replies with data in a standard format called JSON.
What the WordPress REST API exposes
Out of the box, the API can return public content such as published posts, pages, categories and media. With authentication, a request can do more: create or update content, manage users or access private data, depending on the permissions of the account used.
Plugins can add their own endpoints, the addresses that accept requests. WooCommerce, for example, adds endpoints for products and orders, and many form, booking and SEO plugins add theirs. The official REST API handbook documents the core endpoints.
| Endpoint area | What it covers | Typical business use |
|---|---|---|
| Posts and pages | Published content | Showing news or guides in an app |
| Media | Images and files | Galleries in an app or another site |
| Users | Account information | Login and profile features |
| Plugin endpoints | Products, orders, bookings, forms | Syncing with stock, CRM or booking systems |
Business uses: apps, dashboards, syncing
A mobile app
A mobile app can use WordPress as its back end, showing content, products or account information managed in the familiar WordPress admin. The app team builds the screens; WordPress manages the content. Our guide to app backend development explains when that is a good fit.
A dashboard
Managers can see enquiries, bookings or orders from the website in an internal dashboard alongside data from other systems, without logging into WordPress.
Syncing with other systems
Stock levels, prices, leads and bookings can move automatically between WordPress and other software, such as a CRM, accounting package or warehouse system. Our guide to WordPress CRM integration covers lead syncing in detail. We have also looked at managing a restaurant client's site content through the REST API, so routine updates can be handled efficiently from other tools.
Security and what to lock down
The REST API is secure when it is configured sensibly:
- Use proper authentication for anything beyond public content, such as application passwords tied to a specific user, or OAuth for more complex setups.
- Give API users the lowest role they need, never a full administrator account unless essential.
- Limit what is exposed. For example, the users endpoint can reveal usernames, so many sites restrict it.
- Protect keys and passwords, keeping them out of code repositories and shared documents.
- Use HTTPS everywhere, and consider rate limiting at the server or firewall.
- Remove plugins you do not use, because their endpoints remain available while they are active.
Custom endpoints
Sometimes the standard endpoints do not fit. A developer can build custom endpoints in a plugin to expose exactly what an app or system needs. Examples include available booking slots, a simplified product feed or a single action such as "create an enquiry". Custom endpoints should check permissions on every request, validate every input and return only the data needed.
Our booking plugin for a vaccination clinic shows where custom logic lives in a plugin. The same plugin can expose that logic to other systems if needed. See our custom booking plugin case study.
When you need a developer
You can explore the REST API yourself by visiting your site's /wp-json/ address in a browser, which shows what is exposed publicly. Anything beyond that, such as connecting an app, building a sync, creating custom endpoints or securing the API, is developer work. Our guide to custom WordPress plugin development explains how such projects are scoped, and our wider guide to WordPress for business covers the platform. You can see our integration work on our custom WordPress plugins and web development pages.
Frequently asked questions
What is the WordPress REST API used for?
The WordPress REST API lets other software read and update a WordPress site. Businesses use it to power mobile apps with WordPress content, show website data such as enquiries or orders in dashboards, and sync products, stock, leads or bookings with other systems such as CRMs, accounting software and warehouse tools.
Is the WordPress REST API secure?
It is secure when configured sensibly. Public content is visible by design, while anything else requires authentication. Use application passwords or OAuth, and give API users the lowest role they need. Restrict endpoints you do not use, protect keys, use HTTPS and remove unused plugins, whose endpoints would otherwise stay available.
Can a mobile app use WordPress as a backend?
Yes. A mobile app can use WordPress as its back end through the REST API, displaying content, products or account information managed in the WordPress admin. It works well for content-led apps. Apps with complex real-time features, heavy data or custom logic may need a dedicated back end instead, possibly alongside WordPress.
Connect your systems
If you want WordPress to talk to your other software, talk to us about an integration.