Protect Endpoints

The Protect Endpoints feature lets you require a valid JWT for any WordPress REST API route. Use it to lock down sensitive data - such as user profiles, private posts, or custom post types - so they can only be accessed by authenticated callers.

When a protected endpoint is called without a valid JWT, the plugin returns a 403 error immediately, before WordPress processes the request.

The following error will be displayed, when an endpoint is protected and no JWT is provided:

{
"success": false,
  "data": {
    "message": "You are not authorized to access this endpoint.",
    "errorCode": 403,
    "type": "simple-jwt-login-route-protect"
  }
}

Screenshot

Protection Modes

You can choose between two protection modes:

• Protect all endpoints
• Protect only specific endpoints

1. Protect All Endpoints

When enabled, this option secures all endpoints except those explicitly listed in the "Whitelist." To exclude an endpoint from protection, add it to the whitelist using the "Add Endpoints +" button.

2. Protect Only Specific Endpoints

This option protects only the endpoints listed in the "Protect Endpoints" section. To secure an endpoint, add it using the "Add Endpoint" button.

Configuration Options

Request Methods

For each endpoint, you can define which HTTP request methods (GET, POST, PUT, DELETE, etc.) require authentication. Alternatively, selecting ALL will enforce the rule for every request method.

Route Matching

There are two ways to define how an endpoint is matched:

• Starts with: The rule applies to any endpoint that begins with the specified path.
• Exact match: The rule applies only if the accessed endpoint exactly matches the specified path.

Example Configurations

Example 1

Assume you specify /wp/v2/users with ALL and Exact Match in either the Protect or Whitelist settings.

The rule applies to these URLs:

• http://yoursite.com/?rest_route=/wp/v2/users
• http://yoursite.com/wp-json/wp/v2/users

Example 2

Assume you specify /wp/v2/users with GET and Starts With in either the Protect or Whitelist settings.

The rule applies to these URLs when called with GET only:

• http://yoursite.com/?rest_route=/wp/v2/users
• http://yoursite.com/?rest_route=/wp/v2/users/1
• http://yoursite.com/wp-json/wp/v2/users
• http://yoursite.com/wp-json/wp/v2/users/1
• http://yoursite.com/wp-json/wp/v2/users/{any_other_path}

Example 3

Assume you specify /wp/v2 with ALL and Starts With in either the Apply only on Specific Endpoints.

This way, you are making all the endpoints under /wp/v2* protected and they will be accessible only with a JWT.

For example, all these endpoints will be protected:

• /wp/v2/users
• /wp/v2/posts
• /wp/v2/comments

How to Pass the JWT

The JWT token can be provided in multiple ways, depending on the options set in the plugin’s General settings:

• Header
• Request URI
• Request Body
• Session
• Cookie

Examples

Sending JWT in header:

  curl -X POST "http://localhost/wp/v2/users" -H "Authorization: YOUR_JWT"

Sending JWT as query parameters:

  curl -X POST "http://localhost/wp/v2/users?jwt=YOUR_JWT"

or

  curl -X POST "http://localhost?rest_route=/wp/v2/users&jwt=YOUR_JWT"

Sending JWT as request body:

  curl -X POST "http://localhost/wp/v2/users" -H "Content-type: application/json" -d '{"JWT":"JYOUR JWT"}'

By following these instructions, you can efficiently protect and manage API access using Simple JWT Login.