Category: REST API

Cookies, Nonces and the WordPress REST API

Your browser sends the WordPress login cookie with every request to your site. Yet a plain fetch(‘/wp-json/wp/v2/users/me’) from a logged-in page still comes back as a logged-out visitor. The missing piece is the nonce, and it’s the whole point of how cookie auth works in the REST API. I kept asking “but what actually happens?”… Continue reading Cookies, Nonces and the WordPress REST API

Headless WordPress Performance: 3 Next.js Bottlenecks to Fix

I’ve been building a side project to work through headless WordPress properly – Next 16 on the Pages Router, WordPress serving content over the REST API. Every page rendered correctly. Nothing was broken. And it was still shipping several seconds of avoidable wait on the paths a real reader would take. That combination is the… Continue reading Headless WordPress Performance: 3 Next.js Bottlenecks to Fix

Mitigating XSS Attacks in WordPress: A Practical Guide for Owner-Developers

Cross-site scripting (XSS) remains one of the most common vulnerabilities affecting WordPress sites, largely because WordPress’s flexibility – themes, plugins, user-submitted content, custom fields – creates so many places where untrusted data can slip into a page and execute as code in a visitor’s browser. An attacker who successfully injects a script can steal session… Continue reading Mitigating XSS Attacks in WordPress: A Practical Guide for Owner-Developers

Validation, Sanitization, and Safe Queries: The Three Layers That Actually Stop SQL Injection

Most developers can define SQL injection. Far fewer can say, precisely, which line of their code is the one preventing it. That gap matters. SQL injection has been on the OWASP Top 10 since the list existed, and it survives not because the fix is hard but because the fix is easy to believe you’ve… Continue reading Validation, Sanitization, and Safe Queries: The Three Layers That Actually Stop SQL Injection