REST API security

When to use this skill

Use this skill whenever you expose a custom REST endpoint:

• Any register_rest_route() call.
• Endpoints backing a block editor, admin SPA, or front-end fetch.
• Routes that read private data or perform writes/deletes.
• Adding fields via register_rest_field / extending core routes.

The REST API is reachable by anyone who can reach the site. A missing or permissive permission_callback is broken access control — among the most common WordPress vulnerabilities.

Core principles (and why they matter)