Title: Headless Login Guard Author: Andrew Wilkinson Published: می 18, 2026 Last modified: آگست 4, 2026 --- جستجوی افزونه‌ها ![](https://ps.w.org/headless-login-guard/assets/banner-772x250.png?rev=3536308) ![](https://ps.w.org/headless-login-guard/assets/icon-256x256.png?rev=3536307) # Headless Login Guard توسط [Andrew Wilkinson](https://profiles.wordpress.org/andrew40/) [دانلود](https://downloads.wordpress.org/plugin/headless-login-guard.1.1.0.zip) * [جزئیات](https://fa-af.wordpress.org/plugins/headless-login-guard/#description) * [نقد و بررسی‌ها](https://fa-af.wordpress.org/plugins/headless-login-guard/#reviews) * [نصب](https://fa-af.wordpress.org/plugins/headless-login-guard/#installation) * [توسعه](https://fa-af.wordpress.org/plugins/headless-login-guard/#developers) [پشتیبانی](https://wordpress.org/support/plugin/headless-login-guard/) ## توضیحات A lightweight plugin that **forces login for backend access** in a headless WordPress setup. Keeps your WordPress dashboard private while allowing your front end (e.g. Astro, Next.js) to pull content via GraphQL/REST. #### What it does * Requires authentication for `/wp-admin/` and other backend pages * Always allows the login page to avoid redirect loops * Leaves key endpoints open for headless use: - `/wp-json/` (REST API) - `/graphql` (WPGraphQL) - `/wp-admin/admin-ajax.php` (AJAX) - `/wp-cron.php` (cron) - `/robots.txt` - WordPress core and common SEO sitemap XML paths - `/wp-content/uploads/*` (media) - `/favicon.ico` - `/newrelic` (New Relic monitoring) * Logged-in users visiting the backend root get redirected to the dashboard * Works with Bedrock layouts (handles root path vs `/wp/`) #### Use case * WordPress is the content backend * Public site is built with Astro/Next.js/etc * Editors log in to WordPress. Visitors never see the backend * Front end builds and live pages can still query GraphQL/REST without authentication #### Customization Developers can customize allowed endpoints using the `force_login_allowed_patterns` filter: ``` add_filter('force_login_allowed_patterns', function($patterns) { $patterns[] = '#^/healthz$#'; // custom health check $patterns[] = '#^/status$#'; // uptime checks $patterns[] = '#^/wp-json/acf/v3/.*#'; // specific REST namespace return $patterns; }); ``` ## نصب 1. Upload the plugin files to the `/wp-content/plugins/headless-login-guard` directory, or install the plugin through the WordPress plugins screen directly. 2. Activate the plugin through the ‘Plugins’ screen in WordPress. 3. The plugin will automatically start protecting your backend – no configuration needed! ## سوالات متداول ### I’m locked out! How do I access my site? Visit `/wp-login.php` directly to sign in. The plugin always allows access to the login page. ### My front-end requests are failing. What should I do? Verify the endpoint is on the allow list. Check the plugin description for the default allowed patterns, or use the `force_login_allowed_patterns` filter to add custom endpoints. ### Does this work with Bedrock? Yes! The plugin correctly handles both standard WordPress installs and Bedrock layouts where the site URL and home URL may differ. ### Can I add custom endpoints? Yes, use the `force_login_allowed_patterns` filter to add your own regex patterns for additional endpoints that should remain public. ## نقد و بررسی‌ها ![](https://secure.gravatar.com/avatar/5cabcd69e24eb79ae84b4273aaef12c69ebc5d611de7ea339965f8111fc7770e? s=60&d=retro&r=g) ### 󠀁[Guards my headless WP](https://wordpress.org/support/topic/guards-my-headless-wp/)󠁿 [thewebist](https://profiles.wordpress.org/thewebist/) جولای 31, 2026 Does what it says. Guards my headless WP setup. [ خواندن تمامی 1 نقد و بررسی‌ ](https://wordpress.org/support/plugin/headless-login-guard/reviews/) ## توسعه دهندگان و همکاران “Headless Login Guard” نرم افزار متن باز است. افراد زیر در این افزونه مشارکت کرده‌اند. مشارکت کنندگان * [ Andrew Wilkinson ](https://profiles.wordpress.org/andrew40/) [ترجمه “Headless Login Guard” به زبان شما.](https://translate.wordpress.org/projects/wp-plugins/headless-login-guard) ### علاقه‌ مند به توسعه هستید؟ [کد را مرور کنید](https://plugins.trac.wordpress.org/browser/headless-login-guard/), را بررسی کنید [مخزن SVN](https://plugins.svn.wordpress.org/headless-login-guard/), یا مشترک شوید [گزارش توسعه](https://plugins.trac.wordpress.org/log/headless-login-guard/) توسط [RSS](https://plugins.trac.wordpress.org/log/headless-login-guard/?limit=100&mode=stop_on_copy&format=rss). ## گزارش تغییرات #### 1.1.0 * Fixed: Allow WordPress core, Yoast-style, and nested sitemap XML paths * Fixed: Match allowlisted endpoints correctly on subdirectory, Bedrock, and multisite installations * Fixed: Preserve query strings without duplicating the site path in login redirect destinations * Improved: Parse request paths separately from query strings * Improved: Send no-cache headers before login redirects * Improved: Added redirect, sitemap, query-string, and subdirectory integration tests #### 1.0.1 * Added: New Relic monitoring endpoint allowlist pattern (`/newrelic`) to support APM monitoring * Added: WordPress.org plugin directory compatibility * Added: Proper plugin structure with activation/deactivation hooks * Added: Filter hook for customizing allowed patterns * Improved: Code organization and documentation #### 1.0.0 * Initial release * Restricts backend (`/wp-admin/`) to authenticated users * Allows GraphQL and REST API endpoints for headless front-ends * Basic whitelist of essential endpoints (cron, ajax, robots.txt, sitemaps, uploads) ## اطلاعات * Version **1.1.0** * Last updated **1 هفته پیش** * Active installations **کمتر از 10** * WordPress version ** 6.0 یا بالاتر ** * Tested up to **7.0.4** * PHP version ** 8.1 یا بالاتر ** * Language * [English (US)](https://wordpress.org/plugins/headless-login-guard/) * Tags * [GraphQL](https://fa-af.wordpress.org/plugins/tags/graphql/)[headless](https://fa-af.wordpress.org/plugins/tags/headless/) [login](https://fa-af.wordpress.org/plugins/tags/login/)[rest-api](https://fa-af.wordpress.org/plugins/tags/rest-api/) [security](https://fa-af.wordpress.org/plugins/tags/security/) * [نمایش پیشرفته](https://fa-af.wordpress.org/plugins/headless-login-guard/advanced/) ## امتیازها 5 out of 5 stars. * [ 1 5-star review ](https://wordpress.org/support/plugin/headless-login-guard/reviews/?filter=5) * [ 0 4-star reviews ](https://wordpress.org/support/plugin/headless-login-guard/reviews/?filter=4) * [ 0 3-star reviews ](https://wordpress.org/support/plugin/headless-login-guard/reviews/?filter=3) * [ 0 2-star reviews ](https://wordpress.org/support/plugin/headless-login-guard/reviews/?filter=2) * [ 0 1-star reviews ](https://wordpress.org/support/plugin/headless-login-guard/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/headless-login-guard/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/headless-login-guard/reviews/) ## مشارکت کنندگان * [ Andrew Wilkinson ](https://profiles.wordpress.org/andrew40/) ## پشتیبانی چیزی برای گفتن دارید؟ نیاز به کمک دارید؟ [مشاهده انجمن پشتیبانی](https://wordpress.org/support/plugin/headless-login-guard/)