{"id":15765,"date":"2026-11-12T08:05:00","date_gmt":"2026-11-12T07:05:00","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/?p=15765"},"modified":"2026-10-26T13:33:23","modified_gmt":"2026-10-26T12:33:23","slug":"what-the-public-wordpress-api-reveals-checking-rest-routes-and-data-access","status":"publish","type":"post","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/tutorials-en-web-development\/what-the-public-wordpress-api-reveals-checking-rest-routes-and-data-access\/","title":{"rendered":"What the Public WordPress API Reveals: Checking REST Routes and Data Access"},"content":{"rendered":"

A WordPress REST index describes publicly visible API routes. A route is an addressable path; an endpoint combines that path with an HTTP method and a handler. An index entry therefore does not imply anonymous access to every associated record or write operation.<\/p>\n

\"Public
Public route index, response content and operation permissions.<\/figcaption><\/figure>\n

Finding the index<\/h2>\n

The entry point is often \/wp-json\/<\/code>. A better starting point is the discovery link published by WordPress with the relation https:\/\/api.w.org\/<\/code>, for example in an HTTP header or HTML. Subdirectories, changed prefixes and intermediate systems can affect the actual API URL.<\/p>\n

WordPress also supports ?rest_route=\/<\/code>, including configurations with pretty permalinks. Blocking one URL path therefore does not prove complete access restriction. Conversely, a 404 at a guessed path proves neither that the API is disabled nor that the site runs WordPress.<\/p>\n

A route count is not a plugin inventory<\/h2>\n

A namespace such as vendor\/v1<\/code> groups routes. The version number normally denotes an API version, not an installed plugin release. Extensions can register several namespaces, add routes to existing namespaces or operate without REST routes. Themes and custom code can also add routes. Publicly visible index data can additionally be filtered.<\/p>\n

The count therefore describes entries in the particular index response. It is neither a complete list of installed plugins nor a measure of vulnerabilities. Similar counts do not prove a shared platform either. A complete extension inventory requires administrative inventory data.<\/p>\n

A declared method such as POST<\/code> or DELETE<\/code> documents an interface. An anonymous GET sample does not test write permissions. The relevant evidence is the actual permission check and the data returned under the specific request conditions.<\/p>\n

Status and content belong together<\/h2>\n