Latest WordPress REST API Plugin. This is the most comprehensive WordPress REST API plugin with secure JWT authentication, complete CRUD operations, and no configuration requirements. Download now and start controlling your WordPress site programmatically.
WordPress REST API Plugin
The CoreNexis WordPress REST API Plugin transforms your WordPress site into a powerful API-driven platform. With secure JWT authentication and comprehensive endpoint coverage, you can programmatically manage every aspect of your WordPress site without any configuration changes.
Key Features
- JWT Authentication - Secure token-based authentication with configurable expiration
- Complete CRUD Operations - Full control over posts, pages, categories, tags, and custom post types
- User Management - Create, update, delete, and manage WordPress users with role-based access
- Plugin Control - Install, activate, deactivate, and delete plugins remotely
- Theme Management - Switch and update themes programmatically
- Comment Moderation - Approve, unapprove, and delete comments via API
- SEO & Meta Management - Complete control over SEO metadata, custom fields, and slugs
- URL Lookup Functions - Convert URLs to post/page IDs and vice versa
- Site Settings - Update WordPress settings and configurations
- Security Features - Capability checking, input sanitization, and secure token storage
- Zero Configuration - No need to modify wp-config.php or .htaccess files
- SEO Plugin Compatibility - Works with Yoast SEO and All in One SEO
Base URL Structure
https://yoursite.com/wp-json/corenexis/v1 Requirements
- WordPress 5.0 or higher
- PHP 7.4 or higher
- MySQL 5.6 or higher
- WordPress REST API enabled (default in WordPress)
Installation
Install the CoreNexis WordPress REST API Plugin using one of the methods below. The plugin is designed to work immediately after activation with no configuration required.
Method 1: Download from CoreNexis
- Download the plugin ZIP file from CoreNexis WordPress Plugin Page
- Go to your WordPress Admin → Plugins → Add New
- Click "Upload Plugin" and select the downloaded ZIP file
- Click "Install Now" and then "Activate"
Installation Complete. After activation, you'll see a new menu item "CoreNexis REST API" under Tools in your WordPress admin. No additional configuration is required!
Setup & Configuration
The plugin requires no configuration changes to your WordPress installation. Simply generate an API token and start using the endpoints immediately.
Generating API Tokens
- Go to WordPress Admin → Tools → CoreNexis REST API
- Click "Generate API Token"
- Choose token expiration:
- 1 Day - For testing and short-term use
- 1 Month - For development projects
- 1 Year - For production applications
- Never Expire - For permanent API access
- Copy the generated token and store it securely
Sample API Token
Your generated token will look like this:
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3lvdXJzaXRlLmNvbSIsImlhdCI6MTY5... Token Management
The admin interface provides complete token management capabilities:
- View Active Tokens - See all active tokens with expiration dates
- Revoke Tokens - Instantly revoke any token for security
- Token Status - Monitor token usage and validity
- One-Click Copy - Easily copy tokens for use in applications
Token Security. Store your API tokens securely and never share them publicly. Tokens provide full access to your WordPress site based on the user's capabilities who generated them.
Authentication
All API endpoints (except the login endpoint) require JWT token authentication. Tokens must be included in the Authorization header of every request.
Authentication Header
Include the following header in all API requests:
Authorization: Bearer YOUR_ACCESS_TOKEN Token-Based Authentication Flow
- Generate Token - Create a token via WordPress admin or login endpoint
- Include in Requests - Add Authorization header to all API calls
- Token Validation - Each request validates the token automatically
- Capability Checking - Actions are authorized based on user capabilities
Alternative: Login Endpoint Authentication
You can also obtain tokens programmatically using the login endpoint:
curl -X POST "https://yoursite.com/wp-json/corenexis/v1/login" \
-H "Content-Type: application/json" \
-d '{
"username": "admin",
"password": "yourpassword"
}' {
"success": true,
"data": {
"token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
"expires_in": "30 days",
"user_id": 1,
"user_login": "admin",
"user_display_name": "Administrator",
"user_capabilities": ["manage_options", "edit_posts", "publish_posts"]
}
} API Endpoints
The plugin provides comprehensive REST API endpoints covering all aspects of WordPress management. All endpoints follow RESTful conventions and return consistent JSON responses.
Authentication Endpoints
Manage user authentication and token operations.
| Method | Endpoint | Description |
|---|---|---|
| POST | /login | Login with username/password to get JWT token |
| POST | /logout | Logout and invalidate current token |
| GET | /token/validate | Validate current token and check expiration |
| GET | /token/info | Get detailed token information and user data |
User Management Endpoints
Complete user lifecycle management with role-based access control.
| Method | Endpoint | Description |
|---|---|---|
| GET | /users | List all users with pagination and filtering |
| POST | /users | Create a new user with specified role and data |
| PUT | /users/{id} | Update user information, role, and metadata |
| DELETE | /users/{id} | Delete user (requires appropriate capabilities) |
| POST | /users/check | Check if user exists by username or email |
User Deletion Warning. CAUTION: The user deletion endpoint can permanently delete users from your WordPress site. While WordPress has built-in protections and this feature is typically disabled by default, use this endpoint with extreme care. Always backup your database before performing user deletion operations.
Content Management Endpoints
Full CRUD operations for posts, pages, categories, and tags.
| Method | Endpoint | Description |
|---|---|---|
| GET | /posts | List posts with pagination, filtering, and search |
| POST | /posts | Create new post with content, meta, and settings |
| PUT | /posts/{id} | Update existing post content and metadata |
| DELETE | /posts/{id} | Delete post (moves to trash or permanent deletion) |
| GET | /pages | List pages with hierarchy and template information |
| POST | /pages | Create new page with parent, template, and settings |
| PUT | /pages/{id} | Update page content, hierarchy, and settings |
| DELETE | /pages/{id} | Delete page and update menu structures |
| GET | /categories | List categories with hierarchy and post counts |
| POST | /categories | Create new category with parent and metadata |
| PUT | /categories/{id} | Update category information and hierarchy |
| DELETE | /categories/{id} | Delete category and reassign posts |
| GET | /tags | List tags with usage statistics |
| POST | /tags | Create new tag with metadata |
| PUT | /tags/{id} | Update tag information and metadata |
| DELETE | /tags/{id} | Delete tag and remove from posts |
Meta & SEO Management
Complete control over SEO metadata, custom fields, and slugs with support for popular SEO plugins.
| Method | Endpoint | Description |
|---|---|---|
| GET | /posts/{id}/meta | Get post SEO metadata and custom fields |
| POST | /posts/{id}/meta | Update post SEO metadata and custom fields |
| GET | /pages/{id}/meta | Get page SEO metadata and template settings |
| POST | /pages/{id}/meta | Update page SEO metadata and template settings |
| GET | /categories/{id}/meta | Get category SEO metadata and custom fields |
| POST | /categories/{id}/meta | Update category SEO metadata and custom fields |
| GET | /tags/{id}/meta | Get tag SEO metadata and custom fields |
| POST | /tags/{id}/meta | Update tag SEO metadata and custom fields |
Supported Meta Fields
- SEO Metadata: Title, description, keywords, robots directives
- Open Graph: OG title, description, image, and type
- Twitter Cards: Twitter-specific metadata
- Custom Fields: Any custom meta fields for posts, pages, categories, and tags
- Slug Management: Update permalinks and URL slugs
- Yoast SEO: Compatible with Yoast SEO plugin fields
- All in One SEO: Compatible with AIOSEO plugin fields
Comment Management
Moderate comments programmatically with approval workflows.
| Method | Endpoint | Description |
|---|---|---|
| GET | /comments | List comments with filtering by status and post |
| DELETE | /comments/{id} | Delete comment permanently or move to trash |
| POST | /comments/{id}/approve | Approve pending comment |
| POST | /comments/{id}/unapprove | Unapprove comment (move to pending) |
Plugin Management
Install, activate, and manage WordPress plugins remotely.
| Method | Endpoint | Description |
|---|---|---|
| GET | /plugins | List all plugins with status and version info |
| POST | /plugins/install | Install plugin from WordPress repository |
| POST | /plugins/activate | Activate installed plugin |
| POST | /plugins/deactivate | Deactivate active plugin |
| POST | /plugins/delete | Delete plugin files permanently |
Plugin Deletion Warning. EXTREME CAUTION: The plugin deletion endpoint will permanently remove plugin files from your WordPress installation. This action cannot be undone and may break your site if you delete critical plugins. WordPress typically has safeguards against plugin deletion, but use this endpoint with extreme care and always backup your site first.
Theme Management
Switch and update WordPress themes programmatically.
| Method | Endpoint | Description |
|---|---|---|
| GET | /themes | List all themes with status and details |
| POST | /themes/activate | Activate a different theme |
| POST | /themes/update | Update theme to latest version |
Site Management
Manage WordPress site settings and configurations.
| Method | Endpoint | Description |
|---|---|---|
| GET | /site/meta | Get site metadata and settings |
| POST | /site/meta | Update site metadata and settings |
| GET | /site/info | Get WordPress version and basic site information |
Lookup Functions
Utility endpoints for URL resolution and content discovery.
| Method | Endpoint | Description |
|---|---|---|
| POST | /lookup/url | Get post/page ID and type from URL |
| GET | /lookup/recent | Get recently published content |
| POST | /lookup/by-slug | Get content by slug (post name) |
Code Examples
Comprehensive examples showing how to integrate with the WordPress REST API plugin using various programming languages and scenarios.
Authentication
cURL Examples
Login and Get Token
curl -X POST "https://yoursite.com/wp-json/corenexis/v1/login" \
-H "Content-Type: application/json" \
-d '{
"username": "admin",
"password": "yourpassword"
}' Validate Token
curl -X GET "https://yoursite.com/wp-json/corenexis/v1/token/validate" \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" Get Token Information
curl -X GET "https://yoursite.com/wp-json/corenexis/v1/token/info" \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" JavaScript Examples
class WordPressAPI {
constructor(baseURL) {
this.baseURL = baseURL;
this.token = localStorage.getItem('wp_api_token');
}
async login(username, password) {
try {
const response = await fetch(`${this.baseURL}/wp-json/corenexis/v1/login`, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
},
body: JSON.stringify({ username, password })
});
const data = await response.json();
if (data.success) {
this.token = data.data.token;
localStorage.setItem('wp_api_token', this.token);
console.log('Login successful!');
console.log('Token expires in:', data.data.expires_in);
console.log('User ID:', data.data.user_id);
console.log('User login:', data.data.user_login);
return data;
} else {
console.error('Login failed:', data.message);
throw new Error(data.message);
}
} catch (error) {
console.error('Login error:', error);
throw error;
}
}
async validateToken() {
if (!this.token) {
throw new Error('No token available');
}
try {
const response = await fetch(`${this.baseURL}/wp-json/corenexis/v1/token/validate`, {
headers: {
'Authorization': `Bearer ${this.token}`
}
});
const data = await response.json();
if (data.success) {
console.log('Token is valid');
console.log('Expires:', data.data.expires);
return true;
} else {
console.log('Token is invalid');
this.logout();
return false;
}
} catch (error) {
console.error('Token validation error:', error);
return false;
}
}
async apiRequest(endpoint, method = 'GET', data = null) {
if (!this.token) {
throw new Error('Not authenticated. Please login first.');
}
const config = {
method,
headers: {
'Authorization': `Bearer ${this.token}`,
'Content-Type': 'application/json'
}
};
if (data && (method === 'POST' || method === 'PUT')) {
config.body = JSON.stringify(data);
}
try {
const response = await fetch(`${this.baseURL}/wp-json/corenexis/v1${endpoint}`, config);
const result = await response.json();
if (!response.ok) {
throw new Error(result.message || `HTTP ${response.status}`);
}
return result;
} catch (error) {
console.error(`API request failed (${method} ${endpoint}):`, error);
throw error;
}
}
logout() {
this.token = null;
localStorage.removeItem('wp_api_token');
console.log('Logged out successfully');
}
}
// Usage Example
const wp = new WordPressAPI('https://yoursite.com');
// Login
wp.login('admin', 'password').then(() => {
console.log('Ready to make API calls!');
}).catch(error => {
console.error('Login failed:', error);
}); Python Examples
import requests
import json
from typing import Optional, Dict, Any
class WordPressAPI:
def __init__(self, base_url: str):
self.base_url = base_url.rstrip('/')
self.api_base = f"{self.base_url}/wp-json/corenexis/v1"
self.token: Optional[str] = None
self.session = requests.Session()
def login(self, username: str, password: str) -> Dict[str, Any]:
"""Login and get JWT token"""
url = f"{self.api_base}/login"
data = {
"username": username,
"password": password
}
try:
response = self.session.post(url, json=data, timeout=30)
result = response.json()
if response.status_code == 200 and result.get('success'):
self.token = result['data']['token']
self.session.headers.update({
'Authorization': f"Bearer {self.token}"
})
print("Login successful!")
print(f"Token expires in: {result['data']['expires_in']}")
print(f"User ID: {result['data']['user_id']}")
print(f"User login: {result['data']['user_login']}")
return result
else:
error_msg = result.get('message', 'Login failed')
print(f"Login failed: {error_msg}")
raise Exception(error_msg)
except requests.RequestException as e:
print(f"Login request failed: {e}")
raise
def validate_token(self) -> bool:
"""Validate current token"""
if not self.token:
print("No token available")
return False
try:
response = self.session.get(f"{self.api_base}/token/validate", timeout=30)
result = response.json()
if response.status_code == 200 and result.get('success'):
print("Token is valid")
print(f"Expires: {result['data']['expires']}")
return True
else:
print("Token is invalid")
self.logout()
return False
except requests.RequestException as e:
print(f"Token validation failed: {e}")
return False
def api_request(self, endpoint: str, method: str = 'GET', data: Optional[Dict] = None) -> Dict[str, Any]:
"""Make authenticated API request"""
if not self.token:
raise Exception("Not authenticated. Please login first.")
url = f"{self.api_base}{endpoint}"
try:
if method.upper() == 'GET':
response = self.session.get(url, timeout=30)
elif method.upper() == 'POST':
response = self.session.post(url, json=data, timeout=30)
elif method.upper() == 'PUT':
response = self.session.put(url, json=data, timeout=30)
elif method.upper() == 'DELETE':
response = self.session.delete(url, timeout=30)
else:
raise ValueError(f"Unsupported HTTP method: {method}")
result = response.json()
if not response.ok:
error_msg = result.get('message', f'HTTP {response.status_code}')
raise Exception(error_msg)
return result
except requests.RequestException as e:
print(f"API request failed ({method} {endpoint}): {e}")
raise
def logout(self):
"""Clear token and session"""
self.token = None
self.session.headers.pop('Authorization', None)
print("Logged out successfully")
# Usage Example
if __name__ == "__main__":
wp = WordPressAPI('https://yoursite.com')
try:
# Login
login_result = wp.login('admin', 'password')
print("Ready to make API calls!")
# Validate token
if wp.validate_token():
print("Token is valid, proceeding...")
except Exception as e:
print(f"Error: {e}") PHP Examples
<?php
class WordPressAPI {
private $baseUrl;
private $apiBase;
private $token;
public function __construct($baseUrl) {
$this->baseUrl = rtrim($baseUrl, '/');
$this->apiBase = $this->baseUrl . '/wp-json/corenexis/v1';
$this->token = null;
}
public function login($username, $password) {
$url = $this->apiBase . '/login';
$data = [
'username' => $username,
'password' => $password
];
$response = $this->makeRequest($url, 'POST', $data, false);
if ($response && $response['success']) {
$this->token = $response['data']['token'];
echo "Login successful!\n";
echo "Token expires in: {$response['data']['expires_in']}\n";
echo "User ID: {$response['data']['user_id']}\n";
echo "User login: {$response['data']['user_login']}\n";
return $response;
} else {
$errorMsg = $response['message'] ?? 'Login failed';
echo "Login failed: $errorMsg\n";
throw new Exception($errorMsg);
}
}
public function validateToken() {
if (!$this->token) {
echo "No token available\n";
return false;
}
$url = $this->apiBase . '/token/validate';
$response = $this->makeRequest($url, 'GET', null, true);
if ($response && $response['success']) {
echo "Token is valid\n";
echo "Expires: {$response['data']['expires']}\n";
return true;
} else {
echo "Token is invalid\n";
$this->logout();
return false;
}
}
public function apiRequest($endpoint, $method = 'GET', $data = null) {
if (!$this->token) {
throw new Exception('Not authenticated. Please login first.');
}
$url = $this->apiBase . $endpoint;
return $this->makeRequest($url, $method, $data, true);
}
private function makeRequest($url, $method, $data = null, $useAuth = false) {
$ch = curl_init();
$headers = ['Content-Type: application/json'];
if ($useAuth && $this->token) {
$headers[] = "Authorization: Bearer {$this->token}";
}
curl_setopt_array($ch, [
CURLOPT_URL => $url,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_CUSTOMREQUEST => $method,
CURLOPT_HTTPHEADER => $headers,
CURLOPT_TIMEOUT => 30,
CURLOPT_FOLLOWLOCATION => true,
]);
if ($data && in_array($method, ['POST', 'PUT'])) {
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data));
}
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
$curlError = curl_error($ch);
curl_close($ch);
if ($curlError) {
throw new Exception("cURL Error: $curlError");
}
$result = json_decode($response, true);
if ($httpCode >= 400) {
$errorMsg = $result['message'] ?? "HTTP $httpCode";
throw new Exception($errorMsg);
}
return $result;
}
public function logout() {
$this->token = null;
echo "Logged out successfully\n";
}
}
// Usage Example
try {
$wp = new WordPressAPI('https://yoursite.com');
// Login
$loginResult = $wp->login('admin', 'password');
echo "Ready to make API calls!\n";
// Validate token
if ($wp->validateToken()) {
echo "Token is valid, proceeding...\n";
}
} catch (Exception $e) {
echo "Error: " . $e->getMessage() . "\n";
}
?> Content Management Examples
Create New Post
curl -X POST "https://yoursite.com/wp-json/corenexis/v1/posts" \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"title": "My New Blog Post",
"content": "This is the content of my new blog post with <strong>HTML</strong> formatting.",
"status": "publish",
"categories": [1, 5],
"tags": ["wordpress", "api", "tutorial"],
"featured_image": 123,
"excerpt": "A brief summary of the post content."
}' Update Post with SEO Meta
// Update post SEO metadata
async function updatePostSEO(postId, seoData) {
try {
const response = await wp.apiRequest(`/posts/${postId}/meta`, 'POST', {
meta_title: seoData.title,
meta_description: seoData.description,
meta_keywords: seoData.keywords,
slug: seoData.slug,
og_title: seoData.ogTitle,
og_description: seoData.ogDescription,
og_image: seoData.ogImage,
robots_index: seoData.robotsIndex ? "1" : "0",
robots_follow: seoData.robotsFollow ? "1" : "0",
custom_fields: {
custom_field_1: seoData.customField1,
featured_color: seoData.featuredColor,
external_link: seoData.externalLink
}
});
if (response.success) {
console.log('Post SEO updated successfully!');
console.log('Post title:', response.data.title);
console.log('New slug:', response.data.slug);
console.log('SEO title:', response.data.meta_title);
}
return response;
} catch (error) {
console.error('Failed to update post SEO:', error);
throw error;
}
}
// Example usage
updatePostSEO(123, {
title: "Complete WordPress REST API Guide - 2024",
description: "Learn how to use WordPress REST API with JWT authentication for complete site control.",
keywords: "wordpress, rest api, jwt, authentication, tutorial",
slug: "wordpress-rest-api-guide-2024",
ogTitle: "WordPress REST API Complete Guide",
ogDescription: "Master WordPress REST API development",
ogImage: "https://yoursite.com/wp-content/uploads/api-guide.jpg",
robotsIndex: true,
robotsFollow: true,
customField1: "Featured Tutorial",
featuredColor: "#fe5940",
externalLink: "https://github.com/corenexis/wp-api-examples"
}); Bulk Content Operations
def bulk_update_posts_category(wp_api, old_category_id, new_category_id):
"""Move all posts from one category to another"""
try:
# Get all posts in the old category
posts_response = wp_api.api_request('/posts', 'GET', {
'categories': old_category_id,
'per_page': 100,
'status': 'publish'
})
if posts_response['success']:
posts = posts_response['data']
print(f"📊 Found {len(posts)} posts to update")
updated_count = 0
for post in posts:
# Remove old category and add new category
current_categories = post.get('categories', [])
if old_category_id in current_categories:
current_categories.remove(old_category_id)
if new_category_id not in current_categories:
current_categories.append(new_category_id)
# Update the post
update_response = wp_api.api_request(f'/posts/{post["id"]}', 'PUT', {
'categories': current_categories
})
if update_response['success']:
updated_count += 1
print(f"Updated post: {post['title']['rendered']}")
else:
print(f"Failed to update post: {post['title']['rendered']}")
print(f"Successfully updated {updated_count} posts")
return updated_count
else:
print("Failed to fetch posts")
return 0
except Exception as e:
print(f"Bulk update failed: {e}")
return 0
def create_posts_from_csv(wp_api, csv_file_path):
"""Create multiple posts from CSV file"""
import csv
try:
with open(csv_file_path, 'r', encoding='utf-8') as file:
reader = csv.DictReader(file)
created_count = 0
for row in reader:
post_data = {
'title': row['title'],
'content': row['content'],
'status': row.get('status', 'draft'),
'excerpt': row.get('excerpt', ''),
'categories': [int(cat.strip()) for cat in row.get('categories', '').split(',') if cat.strip()],
'tags': [tag.strip() for tag in row.get('tags', '').split(',') if tag.strip()]
}
# Create the post
response = wp_api.api_request('/posts', 'POST', post_data)
if response['success']:
created_count += 1
post_id = response['data']['id']
print(f"Created post: {post_data['title']} (ID: {post_id})")
# Add SEO meta if provided
if row.get('meta_title') or row.get('meta_description'):
meta_data = {}
if row.get('meta_title'):
meta_data['meta_title'] = row['meta_title']
if row.get('meta_description'):
meta_data['meta_description'] = row['meta_description']
if row.get('slug'):
meta_data['slug'] = row['slug']
meta_response = wp_api.api_request(f'/posts/{post_id}/meta', 'POST', meta_data)
if meta_response['success']:
print(f" Added SEO meta for post {post_id}")
else:
print(f"Failed to create post: {post_data['title']}")
print(f"Successfully created {created_count} posts from CSV")
return created_count
except Exception as e:
print(f"CSV import failed: {e}")
return 0
# Usage examples
if __name__ == "__main__":
wp = WordPressAPI('https://yoursite.com')
wp.login('admin', 'password')
# Move all posts from category 5 to category 8
bulk_update_posts_category(wp, 5, 8)
# Create posts from CSV file
create_posts_from_csv(wp, 'posts_to_import.csv') User Management Examples
Create New User
curl -X POST "https://yoursite.com/wp-json/corenexis/v1/users" \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"username": "newuser123",
"email": "newuser@example.com",
"password": "SecurePassword123!",
"first_name": "John",
"last_name": "Doe",
"role": "editor",
"display_name": "John Doe",
"description": "Content editor and blogger",
"send_notification": true
}' User Creation Security. Creating users requires create_users capability. Always use strong passwords and appropriate roles. The API respects WordPress user creation limitations and security measures.
User Management Functions
class UserManager {
constructor(wpAPI) {
this.wp = wpAPI;
}
async createUser(userData) {
try {
const response = await this.wp.apiRequest('/users', 'POST', userData);
if (response.success) {
console.log('User created successfully!');
console.log('User ID:', response.data.id);
console.log('Email:', response.data.email);
console.log('Role:', response.data.role);
return response.data;
}
} catch (error) {
console.error('Failed to create user:', error);
throw error;
}
}
async updateUserRole(userId, newRole) {
try {
const response = await this.wp.apiRequest(`/users/${userId}`, 'PUT', {
role: newRole
});
if (response.success) {
console.log(`User ${userId} role updated to ${newRole}`);
return response.data;
}
} catch (error) {
console.error('Failed to update user role:', error);
throw error;
}
}
async getUsersByRole(role) {
try {
const response = await this.wp.apiRequest('/users', 'GET', {
role: role,
per_page: 100
});
if (response.success) {
console.log(`Found ${response.data.length} users with role: ${role}`);
return response.data;
}
} catch (error) {
console.error('Failed to fetch users:', error);
throw error;
}
}
async checkUserExists(identifier) {
try {
const response = await this.wp.apiRequest('/users/check', 'POST', {
identifier: identifier // can be username or email
});
if (response.success) {
console.log('User exists:', response.data.exists);
if (response.data.exists) {
console.log('Email:', response.data.user.email);
console.log('Role:', response.data.user.role);
}
return response.data;
}
} catch (error) {
console.error('Failed to check user:', error);
throw error;
}
}
async bulkUpdateUsers(userIds, updateData) {
console.log(`Updating ${userIds.length} users...`);
const results = [];
for (const userId of userIds) {
try {
const response = await this.wp.apiRequest(`/users/${userId}`, 'PUT', updateData);
if (response.success) {
console.log(`Updated user ${userId}`);
results.push({ userId, success: true, data: response.data });
}
} catch (error) {
console.error(`Failed to update user ${userId}:`, error);
results.push({ userId, success: false, error: error.message });
}
}
const successCount = results.filter(r => r.success).length;
console.log(`Successfully updated ${successCount}/${userIds.length} users`);
return results;
}
}
// Usage Example
const userManager = new UserManager(wp);
// Create a new editor
userManager.createUser({
username: 'editor123',
email: 'editor@example.com',
password: 'SecurePass123!',
first_name: 'Jane',
last_name: 'Editor',
role: 'editor',
display_name: 'Jane Editor'
});
// Get all subscribers
userManager.getUsersByRole('subscriber').then(subscribers => {
console.log('Subscribers:', subscribers);
});
// Check if user exists
userManager.checkUserExists('admin@example.com'); CRITICAL WARNING - User Deletion. EXTREME CAUTION REQUIRED: This plugin includes user deletion capabilities that can permanently remove users from your WordPress site. While WordPress typically disables user deletion by default and has built-in safeguards, this functionality should be used with utmost care. Always backup your database before attempting user deletion operations. Deleted users cannot be recovered easily.
Plugin Management Examples
List All Plugins
curl -X GET "https://yoursite.com/wp-json/corenexis/v1/plugins" \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" Install and Activate Plugin
# Install plugin from WordPress repository
curl -X POST "https://yoursite.com/wp-json/corenexis/v1/plugins/install" \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"slug": "contact-form-7"
}'
# Activate the installed plugin
curl -X POST "https://yoursite.com/wp-json/corenexis/v1/plugins/activate" \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"plugin": "contact-form-7/wp-contact-form-7.php"
}' Plugin Management Class
class PluginManager:
def __init__(self, wp_api):
self.wp = wp_api
def list_plugins(self):
"""Get list of all plugins with their status"""
try:
response = self.wp.api_request('/plugins', 'GET')
if response['success']:
plugins = response['data']
print(f"📊 Found {len(plugins)} plugins:")
active_count = 0
inactive_count = 0
for plugin in plugins:
status = "Active" if plugin['active'] else "⚪ Inactive"
print(f" {status} - {plugin['name']} v{plugin['version']}")
if plugin['active']:
active_count += 1
else:
inactive_count += 1
print(f"\n📈 Summary: {active_count} active, {inactive_count} inactive")
return plugins
else:
print("Failed to fetch plugins")
return []
except Exception as e:
print(f"Error listing plugins: {e}")
return []
def install_plugin(self, slug):
"""Install plugin from WordPress repository"""
try:
print(f"Installing plugin: {slug}")
response = self.wp.api_request('/plugins/install', 'POST', {
'slug': slug
})
if response['success']:
print(f"Plugin {slug} installed successfully!")
plugin_info = response['data']
print(f"Plugin: {plugin_info['name']}")
print(f"Version: {plugin_info['version']}")
print(f"Author: {plugin_info['author']}")
return plugin_info
else:
print(f"Failed to install plugin {slug}: {response['message']}")
return None
except Exception as e:
print(f"Error installing plugin {slug}: {e}")
return None
def activate_plugin(self, plugin_file):
"""Activate an installed plugin"""
try:
print(f"Activating plugin: {plugin_file}")
response = self.wp.api_request('/plugins/activate', 'POST', {
'plugin': plugin_file
})
if response['success']:
print(f"Plugin {plugin_file} activated successfully!")
return True
else:
print(f"Failed to activate plugin {plugin_file}: {response['message']}")
return False
except Exception as e:
print(f"Error activating plugin {plugin_file}: {e}")
return False
def deactivate_plugin(self, plugin_file):
"""Deactivate an active plugin"""
try:
print(f" Deactivating plugin: {plugin_file}")
response = self.wp.api_request('/plugins/deactivate', 'POST', {
'plugin': plugin_file
})
if response['success']:
print(f"Plugin {plugin_file} deactivated successfully!")
return True
else:
print(f"Failed to deactivate plugin {plugin_file}: {response['message']}")
return False
except Exception as e:
print(f"Error deactivating plugin {plugin_file}: {e}")
return False
def delete_plugin(self, plugin_file):
"""DELETE PLUGIN PERMANENTLY - USE WITH EXTREME CAUTION"""
print(" WARNING: This will permanently delete the plugin files!")
print(f" Plugin to delete: {plugin_file}")
# Extra confirmation for safety
confirmation = input(" Type 'DELETE' to confirm plugin deletion: ")
if confirmation != 'DELETE':
print("Plugin deletion cancelled for safety")
return False
try:
print(f" Deleting plugin: {plugin_file}")
response = self.wp.api_request('/plugins/delete', 'POST', {
'plugin': plugin_file
})
if response['success']:
print(f"Plugin {plugin_file} deleted permanently!")
print(" Remember: This action cannot be undone!")
return True
else:
print(f"Failed to delete plugin {plugin_file}: {response['message']}")
return False
except Exception as e:
print(f"Error deleting plugin {plugin_file}: {e}")
return False
def install_and_activate(self, slug):
"""Install and activate plugin in one operation"""
# First install the plugin
plugin_info = self.install_plugin(slug)
if not plugin_info:
return False
# Find the main plugin file (usually slug/slug.php)
plugin_file = f"{slug}/{slug}.php"
# Activate the plugin
return self.activate_plugin(plugin_file)
def bulk_plugin_operations(self, operations):
"""Perform multiple plugin operations"""
results = []
for operation in operations:
action = operation['action']
plugin = operation.get('plugin', operation.get('slug'))
try:
if action == 'install':
result = self.install_plugin(plugin)
results.append({'action': action, 'plugin': plugin, 'success': bool(result)})
elif action == 'activate':
result = self.activate_plugin(plugin)
results.append({'action': action, 'plugin': plugin, 'success': result})
elif action == 'deactivate':
result = self.deactivate_plugin(plugin)
results.append({'action': action, 'plugin': plugin, 'success': result})
elif action == 'delete':
result = self.delete_plugin(plugin)
results.append({'action': action, 'plugin': plugin, 'success': result})
else:
print(f" Unknown action: {action}")
results.append({'action': action, 'plugin': plugin, 'success': False})
except Exception as e:
print(f"Error with {action} on {plugin}: {e}")
results.append({'action': action, 'plugin': plugin, 'success': False, 'error': str(e)})
# Summary
successful = len([r for r in results if r['success']])
print(f"\n Bulk operations complete: {successful}/{len(results)} successful")
return results
# Usage Examples
if __name__ == "__main__":
wp = WordPressAPI('https://yoursite.com')
wp.login('admin', 'password')
plugin_manager = PluginManager(wp)
# List all plugins
plugins = plugin_manager.list_plugins()
# Install and activate a plugin
plugin_manager.install_and_activate('contact-form-7')
# Bulk operations
operations = [
{'action': 'install', 'slug': 'yoast-seo'},
{'action': 'install', 'slug': 'jetpack'},
{'action': 'activate', 'plugin': 'yoast-seo/wp-seo.php'},
{'action': 'activate', 'plugin': 'jetpack/jetpack.php'}
]
plugin_manager.bulk_plugin_operations(operations) EXTREME WARNING - Plugin Deletion. CRITICAL DANGER: The plugin deletion endpoint can permanently destroy plugin files and potentially break your WordPress site. While WordPress has built-in protections and typically disables plugin deletion, this functionality bypasses normal restrictions. NEVER use plugin deletion without: 1) Complete site backup, 2) Understanding the consequences, 3) Testing in staging environment first. Plugin deletion CANNOT BE UNDONE and may require manual file recovery or site restoration.
Security
The CoreNexis WordPress REST API Plugin implements multiple security layers to protect your WordPress site while providing powerful remote access capabilities.
Security Features
JWT Authentication
Secure, stateless token-based authentication
Capability Checking
Respects WordPress user permissions and roles
Token Expiration
Configurable token lifetimes from 1 day to permanent
Token Revocation
Instant token invalidation for security breaches
Secure Storage
Encrypted token storage in WordPress database
Input Sanitization
All inputs properly validated and sanitized
WordPress Capabilities Required
The plugin respects WordPress's built-in capability system. Different endpoints require specific capabilities:
| Operation | Required Capability | Typical Roles |
|---|---|---|
| User Management | list_users, create_users, edit_users, delete_users | Administrator |
| Content Management | publish_posts, edit_posts, delete_posts | Editor, Author, Administrator |
| Plugin Management | install_plugins, activate_plugins, delete_plugins | Administrator only |
| Theme Management | switch_themes, update_themes | Administrator only |
| Comment Moderation | moderate_comments | Editor, Administrator |
| Site Settings | manage_options | Administrator only |
Security Best Practices
- Token Management
- Use appropriate token expiration times
- Revoke tokens immediately if compromised
- Generate new tokens for production vs development
- Store tokens securely in your applications
- User Access Control
- Generate tokens with users who have minimum required capabilities
- Avoid using administrator accounts for routine operations
- Regularly audit user permissions and token usage
- Network Security
- Always use HTTPS for API requests
- Implement IP restrictions where possible
- Monitor API usage for unusual patterns
- Use proper firewall rules
- Backup Strategy
- Always backup before using destructive operations
- Test API operations in staging environment first
- Keep recent database backups available
WordPress Security Integration. This plugin integrates seamlessly with WordPress's existing security features including user roles, capabilities, nonces, and input sanitization. It does not bypass WordPress security - it works within it.
Error Handling
The plugin provides consistent, detailed error responses to help you handle different scenarios and debug issues effectively.
HTTP Status Codes
| Status Code | Error Type | Example Response |
|---|---|---|
| 200 | Success | {"success": true, "data": {...}} |
| 400 | Bad Request | {"success": false, "message": "Invalid request parameters", "error_code": "INVALID_PARAMS"} |
| 401 | Unauthorized | {"success": false, "message": "Invalid or expired token", "error_code": "INVALID_TOKEN"} |
| 403 | Forbidden | {"success": false, "message": "Insufficient permissions", "error_code": "INSUFFICIENT_PERMISSIONS"} |
| 404 | Not Found | {"success": false, "message": "Post not found", "error_code": "POST_NOT_FOUND"} |
| 422 | Validation Error | {"success": false, "message": "Invalid email format", "error_code": "VALIDATION_ERROR"} |
| 500 | Server Error | {"success": false, "message": "Internal server error", "error_code": "SERVER_ERROR"} |
Common Error Codes
| Error Code | Description |
|---|---|
INVALID_TOKEN | JWT token is invalid, expired, or malformed |
TOKEN_EXPIRED | JWT token has expired and needs renewal |
INSUFFICIENT_PERMISSIONS | User doesn't have required WordPress capabilities |
INVALID_LOGIN | Username or password is incorrect |
USER_NOT_FOUND | Requested user ID doesn't exist |
POST_NOT_FOUND | Requested post/page ID doesn't exist |
PLUGIN_NOT_FOUND | Plugin slug or file doesn't exist |
VALIDATION_ERROR | Input data failed validation rules |
OPERATION_FAILED | WordPress operation failed (e.g., couldn't save post) |
PLUGIN_INSTALL_FAILED | Plugin installation from repository failed |
Error Response Format
All error responses follow a consistent JSON structure:
{
"success": false,
"message": "Human-readable error description",
"error_code": "MACHINE_READABLE_ERROR_CODE",
"data": {
"additional_info": "Optional additional error details",
"validation_errors": ["Array of specific validation errors if applicable"]
},
"timestamp": "2024-01-15 10:30:45"
} Error Handling Best Practices
-
Always check the
successfield before processing response data -
Use
error_codefor programmatic error handling -
Display
messagefield to users for context - Implement retry logic for temporary failures (5xx errors)
- Handle token expiration gracefully with automatic renewal
async function handleAPIResponse(response) {
try {
const data = await response.json();
if (data.success) {
// Handle successful response
console.log('Operation successful:', data.data);
return data.data;
} else {
// Handle error response
console.error('Operation failed:', data.message);
switch (data.error_code) {
case 'INVALID_TOKEN':
case 'TOKEN_EXPIRED':
// Token issues - try to refresh or redirect to login
console.log('Token issue, attempting refresh...');
await refreshToken();
break;
case 'INSUFFICIENT_PERMISSIONS':
// Permission denied - show appropriate message
showError('You don\'t have permission for this operation');
break;
case 'VALIDATION_ERROR':
// Show validation errors to user
if (data.data?.validation_errors) {
showValidationErrors(data.data.validation_errors);
}
break;
default:
// Generic error handling
showError(data.message);
}
throw new Error(data.message);
}
} catch (error) {
console.error('Response parsing failed:', error);
throw error;
}
} Download Plugin
Download the CoreNexis WordPress REST API Plugin and start controlling your WordPress site programmatically with secure JWT authentication.
What's Included
- Complete Plugin Files - Ready-to-install WordPress plugin
- Admin Interface - Beautiful token management interface
- Documentation - Comprehensive README and inline docs
- Code Examples - Sample implementations in multiple languages
- Security Features - Built-in JWT authentication and capability checking
Installation Requirements
| Requirement | Specification |
|---|---|
| WordPress Version | 5.0 or higher (tested up to 6.4) |
| PHP Version | 7.4 or higher (PHP 8.0+ recommended) |
| MySQL Version | 5.6 or higher (MySQL 8.0+ recommended) |
| Server Requirements | Standard WordPress hosting with REST API enabled |
| Configuration | No wp-config.php or .htaccess changes required |
Ready to Get Started? Download the plugin now and have your WordPress REST API running in minutes. No complex configuration required - just activate and generate your first API token!
Support & Resources
Get help with installation, configuration, and development using the CoreNexis WordPress REST API Plugin. Our team provides comprehensive support for all users.
Support Channels
Support
Documentation & Resources
| Resource | Description |
|---|---|
| Code Examples | Ready-to-use code samples in multiple programming languages |
| API Reference | Complete endpoint reference with parameters and responses |
| Best Practices Guide | Security recommendations and optimization tips |
| Migration Guide | Help with migrating from other WordPress API solutions |
Professional Services
Need custom development or integration assistance? Our team offers professional services:
- Custom Integration - Tailored API integration for your specific needs
- Performance Optimization - Optimize your WordPress site for API usage
- Security Audits - Review and enhance your API security setup
- Training & Consultation - Team training on WordPress REST API development
- Custom Endpoints - Development of specialized API endpoints
- Migration Services - Complete migration from other API solutions
Frequently Asked Questions
Do I need to modify wp-config.php or .htaccess?
No! The plugin works out of the box without any configuration file changes. Simply activate and start using.
Is this plugin compatible with other security plugins?
Yes, the plugin works alongside most WordPress security plugins. It uses WordPress's built-in security features and doesn't conflict with standard security measures.
Can I use this with WordPress multisite?
Yes, the plugin supports WordPress multisite installations. Each site in the network can have its own API tokens and settings.
How do I backup before using destructive operations?
Always create a complete site backup before using user deletion or plugin deletion endpoints. Use your hosting provider's backup tools or WordPress backup plugins.
What happens if my token is compromised?
Immediately revoke the compromised token through the WordPress admin interface (Tools → CoreNexis REST API) and generate a new one. The revocation is instant.
Can I limit API access to specific IP addresses?
While the plugin doesn't have built-in IP restriction, you can implement this at the server level using .htaccess rules or your hosting provider's security features.
Need More Help? Can't find the answer you're looking for? Our support team is here to help! Send us an email with your specific question and we'll get back to you within 24 hours.