Security

​

Security Settings

This page helps you control which websites can connect to your WordPress API. Think of it like a guest list for your site - you decide who gets in!

​

What is CORS?

CORS (Cross-Origin Resource Sharing) is like a security guard for your website. It checks if other websites are allowed to ask for information from your WordPress site.

​

Main Settings

​

Enable CORS

• What it does: Turns on the security check system
• When to use it: Turn this on if other websites need to connect to your WordPress

​

Allow All Origins

• What it does: Lets ANY website connect to your API
• Warning: Only use this for testing! It’s like leaving your front door open
• For real websites: Turn this OFF and use the Allowed Origins list instead

​

Managing Allowed Origins

This is where you make your guest list of approved websites.

​

Adding a New Origin

1. Fill in:
   • Website Address (like https://mywebsite.com)
   • Description (like “My Main Website” or “Mobile App Backend”)
2. Click Add New Origin

​

Example Origins

Good examples:

• https://mywebsite.com
• https://app.mycompany.com
• http://localhost:3000 (for testing)

​

Security Tips

Keep your site safe by following these rules:

1. Don’t use “Allow All Origins” on real websites
2. Always use complete website addresses
3. Double-check your typing
4. Remove origins you don’t use anymore
5. Use HTTPS whenever possible

​

Need Help?

If something’s not working:

1. Check if CORS is turned on
2. Make sure the website address is exactly right
3. Look for typing mistakes
4. Try testing with a simple request first
5. Contact our support team

Remember: Good security is like having a strong front door - you want to know exactly who’s coming in!

​

Testing Your Settings

After setting up your allowed origins, you can test them like this:

// Replace with your site's address
fetch("https://yoursite.com/wp-json/wp/v2/posts", {
  headers: {
    "X-WP-API-Key": "your_api_key",
  },
});

If it works from your allowed website, you’re all set! If not, double-check your CORS settings.