As you probably already heard, REST API provides you with the ability to interact with your WordPress site externally, for example, from a mobile application or another website.
Let’s look at a short code example that describes how you can fetch posts from the CSS Tricks website on your site:
// connect to the website endpoint with wp_remote_get() function
// pass params as URL query args, full parameter list is here https://developer.wordpress.org/rest-api/reference/posts/
// at this moment you can use any parameter with Context: View
// it would be strange if you can fetch drafts or private posts, right?
$response = wp_remote_get( add_query_arg( array(), 'https://css-tricks.com/wp-json/wp/v2/posts' ) );
if( !is_wp_error( $response ) && $response['response']['code'] == 200 ) {
$remote_posts = json_decode( $response['body'] ); // our posts are here
foreach( $remote_posts as $remote_post ) {
// display post titles and excerpts
echo '<h2>'. $remote_post->title->rendered . '</h2><p>' . $remote_post->excerpt->rendered . '</p>';
// need more parameters? print_r( $remote_post )
}
}You can also add parameters to the request, for example, the number of posts you want to fetch, by adding parameters to the array. Here is the same code that limits the number of posts fetched from CSS Tricks to only four (pay attention to the difference in lines 5-7):
// connect to the website endpoint with wp_remote_get() function
// pass params as URL query args, full parameter list is here https://developer.wordpress.org/rest-api/reference/posts/
// at this moment you can use any parameter with Context: View
// it would be strange if you can fetch drafts or private posts, right?
$response = wp_remote_get( add_query_arg( array(
'per_page' => 4
), 'https://css-tricks.com/wp-json/wp/v2/posts' ) );
if( !is_wp_error( $response ) && $response['response']['code'] == 200 ) {
$remote_posts = json_decode( $response['body'] ); // our posts are here
foreach( $remote_posts as $remote_post ) {
// display post titles and excerpts
echo '<h2>'. $remote_post->title->rendered . '</h2><p>' . $remote_post->excerpt->rendered . '</p>';
// need more parameters? print_r( $remote_post )
}
}How to Completely Disable REST API /wp-json on Your Site
What if you don’t want anyone to interact with your site’s API to, for example, get posts without permission? In this case, you need to disable /wp-json/. The following code will work in WordPress 4.7 and above:
function sv_no_rest_api( $access ) {
return new WP_Error( 'rest_cannot_access', 'Sorry - Access Denied', array(
'status' => 403
) );
}
add_filter( 'rest_authentication_errors', 'sv_no_rest_api' );
That’s it.
