See how Gallop powers headless WordPress \u2192<\/a><\/p>\n\nREST endpoints<\/h4>\n\n
All endpoints live under the gallop\/v1<\/code> namespace.<\/p>\n\n\nGET|POST \/gallop\/v1\/post<\/code> \u2014 Resolve a post and return post<\/code>, seo<\/code>, and site<\/code> payloads. Accepts uri<\/code>, id<\/code>, or slug<\/code> with type<\/code>.<\/li>\nGET|POST \/gallop\/v1\/posts<\/code> \u2014 A filtered, paged collection of posts of one type<\/code>. Accepts category<\/code>, include<\/code>, meta_key<\/code> \/ meta_value<\/code> \/ meta_compare<\/code>, orderby<\/code>, order<\/code>, size<\/code>, offset<\/code>, and fields<\/code>.<\/li>\nGET|POST \/gallop\/v1\/posts\/list<\/code> \u2014 Slug, uri, and modified date for every published post of a type<\/code>, for sitemaps and static builds. Optional parent<\/code>.<\/li>\nPOST \/gallop\/v1\/category<\/code> \u2014 Resolve a category URI to a term and return category<\/code>, seo<\/code>, and site<\/code> payloads.<\/li>\nGET \/gallop\/v1\/comments<\/code> \u2014 The approved comments on a post<\/code>, oldest first, as a flat list with parent<\/code> ids. Public.<\/li>\nPOST \/gallop\/v1\/comments<\/code> \u2014 Submit a visitor's or a member's comment. Requires the API key.<\/li>\nPOST \/gallop\/v1\/members\/login<\/code>, POST \/gallop\/v1\/members<\/code>, POST \/gallop\/v1\/members\/confirm<\/code>, POST \/gallop\/v1\/members\/create<\/code>, POST \/gallop\/v1\/members\/reset-request<\/code>, POST \/gallop\/v1\/members\/reset<\/code>, GET|PATCH \/gallop\/v1\/members\/{id}<\/code> \u2014 Members: log in, sign up, confirm an address, create an account the front end confirmed, reset a password, read and edit a profile. All require the API key.<\/li>\nPOST \/gallop\/v1\/auth\/login<\/code>, POST \/gallop\/v1\/auth\/logout<\/code>, GET \/gallop\/v1\/auth\/session<\/code> \u2014 The older cookie-based login, kept for front ends on the same registered domain that use it.<\/li>\n<\/ul>\n\nMembers<\/h4>\n\n
Readers get accounts, and WordPress is the only place they live. Every route takes the API key with the Manage members<\/strong> permission and is called by your front end's server<\/strong>, which keeps its own session for the member; WordPress is asked only when someone logs in or changes something.<\/p>\n\n\n- Log in<\/strong> with an email address or username and a password, checked by
wp_authenticate()<\/code> as the visitor, so login-protection plugins see the visitor's address. No WordPress cookies are set.<\/li>\n- Sign up<\/strong>: nothing is created until the reader opens the confirmation email; then they become a Subscriber, verified, and logged in, with a one-time key so the front end can offer them a password at once. An address that already has an account is only marked subscribed. An email is never a way past a password.<\/li>\n
- Reset a password<\/strong> with WordPress's own reset keys, emailed as a link to your front end.<\/li>\n
- Profiles<\/strong>: name, email, password, and two email choices. Changing the email or password needs the current one and ends every session the front end holds, through a
sessionVersion<\/code> handed back with each request.<\/li>\n- Comments as themselves<\/strong>, recorded as theirs, and accepted where only registered users may comment.<\/li>\n<\/ul>\n\n
A password set through Gallop, by \/members\/create<\/code>, \/members\/reset<\/code>, or a profile change, must be 8 to 128 characters. Logging in accepts whatever password the account already has.<\/p>\n\nFive wrong passwords for one login name from one address within fifteen minutes return HTTP 429; each address is sent at most one email every ten minutes and five a day; login, sign-up and reset answer the same whether or not the address is known.<\/p>\n\n
Comments<\/h4>\n\n
Show WordPress comments on a headless front end, and let visitors leave them, without giving up anything WordPress does with a comment.<\/p>\n\n
\nGET \/gallop\/v1\/comments?post=<id><\/code> returns the post's approved comments<\/code>, oldest first, each with id<\/code>, parent<\/code>, authorName<\/code>, authorUrl<\/code>, isPostAuthor<\/code>, avatar<\/code>, dateGmt<\/code>, and rendered content<\/code>. Build the thread from parent<\/code>. It also returns open<\/code>, count<\/code>, requireNameEmail<\/code>, threadDepth<\/code>, and truncated<\/code>. A commenter's email address, IP address, and browser are never returned.<\/li>\nPOST \/gallop\/v1\/comments<\/code> takes post<\/code>, parent<\/code>, authorName<\/code>, authorEmail<\/code>, authorUrl<\/code>, content<\/code>, and the visitor's ip<\/code>, userAgent<\/code>, and referer<\/code>. It answers 201<\/code> with the comment<\/code>, its status<\/code> (approved<\/code>, hold<\/code>, spam<\/code>, or trash<\/code>), and the post's new count<\/code>.<\/li>\n<\/ul>\n\nA submitted comment is handed to wp_handle_comment_submission()<\/code>, the function WordPress's own comment form uses. Your Discussion settings, moderation, the duplicate and flood checks, anti-spam plugins such as Akismet, and notification emails all behave as they do for a comment left on a WordPress site. Core's own REST route for comments sends no notification emails.<\/p>\n\nSend the request from your front end's server<\/strong>, never from the browser: it carries the API key.<\/p>\n\nAPI key<\/h4>\n\n
Reading from Gallop needs no key. Writing does: a request that changes something in WordPress on a visitor's behalf has to prove it comes from your front end's own server.<\/p>\n\n
\n- Generate it<\/strong> under Gallop \u2192 Settings \u2192 Front-end connection. It is shown once. Gallop stores only a hash of it.<\/li>\n
- Send it<\/strong> in the
X-Gallop-WP-Key<\/code> header, over HTTPS.<\/li>\n- Keep it on your server<\/strong>, in a secret environment variable such as
GALLOP_WP_API_KEY<\/code>. Never give it a NEXT_PUBLIC_<\/code> prefix, and never put it in code.<\/li>\n- Or set it in
wp-config.php<\/code><\/strong> with define( 'GALLOP_WP_API_KEY', 'gallopwp_\u2026' );<\/code>. A key set there takes priority over a generated one.<\/li>\n- Permissions are off by default.<\/strong> A key can do only what you tick: \"Submit comments\" and \"Manage members\". A permission added by a later version is never switched on for you.<\/li>\n
- Regenerating<\/strong> replaces the key at once.<\/li>\n<\/ul>\n\n
Gallop removes the key from the request as soon as it has been checked, so other plugins that read or forward request headers never see it.<\/p>\n\n
SEO integration<\/h4>\n\n
When the Yoast SEO<\/a> plugin is active, the seo<\/code> block in the post and category responses is populated from Yoast's indexable data (canonical, meta description, OpenGraph fields, robots flags, reading time, etc.). Without Yoast, seo<\/code> is returned as an empty object so clients can branch safely.<\/p>\n\nData stored<\/h4>\n\n\ngallop_post_types<\/code> (option) \u2014 your custom post type definitions.<\/li>\ngallop_nextjs_production_url<\/code> (option) \u2014 the redirect target, if configured.<\/li>\ngallop_trust_forwarded_ip<\/code> (option) \u2014 whether to trust reverse-proxy IP headers when rate-limiting auth (default off).<\/li>\ngallop_api_key_hash<\/code> (option) \u2014 a hash of your API key, with the date it was generated and its last four characters. Never the key itself.<\/li>\ngallop_api_key_permissions<\/code> (option) \u2014 what the key is allowed to do.<\/li>\ngallop_verified<\/code>, gallop_subscribed<\/code>, gallop_reply_emails<\/code>, gallop_session_version<\/code> (user meta) \u2014 whether a member's address is waiting for confirmation, their email choices, and their session version. _gallop_reply_notified<\/code> (comment meta) \u2014 a reply already emailed about.<\/li>\ngallop_auth_*<\/code> (transients) \u2014 short-lived login rate-limit counters.<\/li>\ngallop_pending_*<\/code> (transients) \u2014 sign-ups awaiting confirmation, up to 48 hours: address, names, and a hash of the link's key.<\/li>\ngallop_confirm_sent_*<\/code> (transients) \u2014 when each address was last emailed, for a day.<\/li>\ngallop_key_fail_*<\/code> (transients) \u2014 short-lived counters of wrong API keys, by address.<\/li>\ngallop_key_reveal_*<\/code> (transient) \u2014 a newly generated key, held for up to two minutes so it can be shown once after the page reloads, then deleted.<\/li>\n<\/ul>\n\nComments submitted through Gallop are ordinary WordPress comments, and members are ordinary WordPress users, stored where WordPress stores them.<\/p>\n\n
Privacy<\/h3>\n\n
Gallop does not send any data to external services. All data stays on your WordPress site.<\/p>\n\n
The login endpoints authenticate users with WordPress's built-in functions. To mitigate brute-force attacks, Gallop temporarily stores failed-login counters in WordPress transients keyed by a hash of the login name and the visitor's IP address. These counters expire automatically (typically within 15 minutes) and are removed on plugin uninstall.<\/p>\n\n
A sign-up is kept as a transient for up to 48 hours (the address, the names typed, and a hash of the confirmation key), then becomes a WordPress user or expires. Gallop emails members through wp_mail()<\/code> only what they asked for: confirmation and reset links, a note that an address already has an account, and replies to their comments if they turned that on. It records when each address was last emailed, for a day, to limit how often one can be written to.<\/p>\n\nWhen a request presents a wrong API key, Gallop counts it in a transient keyed by a hash of the requesting IP address. That counter also expires within 15 minutes and is removed on uninstall.<\/p>\n\n
A comment submitted through \/gallop\/v1\/comments<\/code> is stored by WordPress with the commenter's name, email address, IP address, and browser, as WordPress stores every comment. Those details are supplied by your front end, and the IP address and browser are presented to other active plugins while the comment is saved, as they would be for a comment left on the site itself: an anti-spam plugin may send them to its own service, under its own privacy terms. Comments are returned by \/gallop\/v1\/comments<\/code> without the email address, IP address, or browser. If avatars are switched on, each comment includes an avatar address from your avatar service (Gravatar by default), which contains a hash of the commenter's email address, as WordPress's own themes and REST API expose.<\/p>\n\nNo personal data is shared with third parties. No tracking, analytics, or telemetry is performed.<\/p>\n\n\n
\n- Upload the
gallop<\/code> folder to \/wp-content\/plugins\/<\/code>, or install the ZIP from the Plugins screen.<\/li>\n- Activate Gallop<\/strong> from the Plugins screen.<\/li>\n
- Point your Next.js front end at
https:\/\/your-wp-site.example\/wp-json\/gallop\/v1<\/code> and start fetching the post<\/code> and category<\/code> endpoints.<\/li>\n- (Optional) Open Gallop<\/strong> in the admin menu to register custom post types and set your Next.js production URL.<\/li>\n
- (Optional) To accept comments or members from your front end, generate an API key under Front-end connection<\/strong>, tick Submit comments<\/strong> and Manage members<\/strong>, and give the key to your front end's server. Member emails link to the Next.js production URL, so set it first.<\/li>\n<\/ol>\n\n
Requires PHP 8.1 or higher. The plugin will refuse to boot and show an admin notice on older PHP versions.<\/p>\n\n\n
\nDo I have to use Next.js?<\/h3><\/dt>\nNo. Gallop's REST endpoints are framework-agnostic JSON. Next.js is the reference target and the redirect feature is named for it, but any HTTP client can consume the API.<\/p><\/dd>\n
Does the redirect break the WordPress admin or previews?<\/h3><\/dt>\nNo. The redirect runs on template_redirect<\/code> only, skips any request with a preview=true<\/code> or _wp*<\/code> query parameter, and never touches \/wp-admin<\/code> or