Name: Code and core Headless Fast API – Standalone, cacheable REST endpoints that skip the core load cycle
Author: Code and core

Your headless front end is only as fast as the API behind it. Code and Core Headless Fast API gives your Next.js, Nuxt, Astro, Gatsby, SvelteKit, React Native or Flutter app a WordPress API built for speed. It does not run the whole of WordPress on every request.

Each request to the built-in WordPress REST API starts the full WordPress stack: every active plugin, the theme, init, the REST server, its controllers and WP_Query. On a typical site with 20 to 40 plugins, most of that work has nothing to do with the JSON you asked for. This plugin cuts that work out:

It answers before the theme, init, the REST API and WP_Query load.
In Fast Mode, it answers before any regular plugin loads.
It builds each response with a small number of batched, prepared SQL queries.
It can serve repeat requests from one cached JSON file on disk.

Your front end gets the familiar REST-style data, including ACF fields, Yoast SEO metadata and resolved relationships, with far less work on the server. The result is lower response times, less CPU and database load, and quicker static builds and server-side rendering.

The built-in REST API is not changed or disabled. This plugin adds its own read-only namespace, /code-and-core-headless-fast-api/v1/, next to it, so you can switch over one endpoint at a time.

Why choose Headless Fast API?

Built for headless. Every design decision serves one job: getting content to a decoupled front end as quickly as possible.
Faster, especially on busy sites. Response time no longer grows with each plugin you install (Fast Mode).
Lighter payloads. Remove every field your front end does not use. Smaller JSON means faster transfers, faster parsing and faster pages.
Fewer round trips. Resolve ACF relationships, images, terms and users inside one response, so you don’t need ten follow-up requests.
Easy to adopt. Items use the REST API’s field names (title.rendered, content.rendered, featured_media, …), so existing front-end code needs only small changes.
No setup. No server rules, no extra entry point, no Node.js service, no GraphQL schema to maintain. Activate, choose your content, copy the URLs.
Safe by design. Read-only, GET only, prepared SQL, an allowlist of entities, and capability and nonce checks on every admin action.
Clean to remove. Deactivating removes the Fast Mode file. Deleting removes every option and data file the plugin created.

Built-in REST API compared with Headless Fast API

Plugins loaded per request: REST API: all of them. Headless Fast API: all of them, or none in Fast Mode.
Theme and init: REST API: loaded. Headless Fast API: skipped.
Query engine: REST API: WP_Query and REST controllers. Headless Fast API: direct, batched, prepared SQL.
Response cache: REST API: none built in. Headless Fast API: optional disk cache, with a HIT/MISS header.
Removing fields: REST API: _fields on each request. Headless Fast API: saved per endpoint in the admin, including nested ACF fields and flexible-content layouts.
ACF relationships: REST API: IDs only, so you need extra requests. Headless Fast API: resolved into full objects in the same response.
Yoast SEO head: REST API: provided by Yoast. Headless Fast API: built from Yoast’s own indexable data, without loading Yoast.
List totals: REST API: X-WP-Total headers. Headless Fast API: total and total_pages in the JSON body.
Server configuration: neither needs any.

Perfect for

Next.js, Nuxt, Remix and SvelteKit sites that use server-side rendering or incremental static regeneration.
Static builds with Astro, Gatsby, Eleventy or Hugo, where builds that fetch thousands of pages finish sooner.
React Native and Flutter apps that need small, predictable JSON.
Agencies running content-heavy WordPress back ends with many plugins.
Any site where the REST API has become the slowest part of the stack.

Quick start in 60 seconds

Install and activate the plugin.
In the popup, click Enable Fast Mode (recommended).
Under Entities, choose your post types and taxonomies, then click Save & Sync Schemas.
Open the Dashboard, copy an endpoint URL, and fetch it from your front end.

Key features

Batched SQL. Meta, terms, authors, images and Yoast data for a whole page of items are loaded together, not one query per item.
Disk cache. A repeat request is served from one JSON file.
Field exclusion. Remove any field per endpoint and per context (list or single), down to ACF sub-fields and flexible-content layouts.
Resolve and append rules. Turn ACF post, term, media and user IDs into full objects, or add extra data such as the latest posts.
ACF and Yoast SEO. acf (repeaters, groups, flexible content, images, options pages), yoast_head and yoast_head_json.
Custom meta. Expose any post meta key as a string, integer, boolean or JSON value.
Live schema builder and API explorer. Test any endpoint from the admin and switch fields on or off in the live response tree.
Import, export and reset of the whole configuration as JSON.

Fast Mode (optional)

On sites with many plugins, most of a request’s time is spent loading those plugins. Fast Mode answers API requests before any regular plugin loads.

Fast Mode is off until an administrator turns it on. After activation the plugin asks once, in a popup on its Dashboard screen, and nothing is installed unless the administrator clicks “Enable Fast Mode”. It can be turned on or off at any time under Advanced.

Turning it on writes one small file, wp-content/mu-plugins/0-cachfa-fast-path.php, using the WordPress filesystem API. That file:

acts only on requests to /code-and-core-headless-fast-api/v1/... and does nothing on any other request;
does nothing if this plugin is deactivated or deleted;
is removed when Fast Mode is turned off or this plugin is deactivated;
is rewritten automatically after a plugin update;
is never written over or deleted if a file of the same name was not created by this plugin.

Because other plugins do not run on API requests in Fast Mode, output they add through filters at runtime is not included in API responses. Data they save to the database is included.

Endpoints

All endpoints are GET only and start with:

https://example.com/code-and-core-headless-fast-api/v1/

home: the static front page (Settings > Reading), or the latest posts if the front page shows posts.
posts, posts/{id_or_slug}: posts.
pages, pages/{id_or_slug}: pages.
media, media/{id_or_slug}: attachments.
{post_type}s, {post_type}s/{id_or_slug}: any public custom post type you enable (for example products, products/blue-shirt).
categories, categories/{id_or_slug}: categories.
tags, tags/{id_or_slug}: tags.
{taxonomy}s, {taxonomy}s/{id_or_slug}: any public custom taxonomy you enable.
users, users/{id_or_slug}: users (can be turned off under Entities).
options/{options_page_slug}: fields from an ACF options page (needs ACF with options pages).

The Dashboard screen lists the exact URL of every active endpoint on your site.

Endpoints are available only for the post types and taxonomies you enable under Entities. Any other type returns a 404 with a JSON error.

Query parameters

Lists take comma-separated values, and include[]=1&include[]=2 also works.

Posts, pages, media and custom post types: page, per_page (1–100, default 10), offset, search, slug, include, exclude, author, author_exclude, parent, parent_exclude, menu_order, after, before, modified_after, modified_before, sticky, categories, categories_exclude, tags, tags_exclude, {taxonomy}, {taxonomy}_exclude, tax_relation (AND/OR), media_type, mime_type, password, orderby (date, title, id, modified, author, parent, slug, menu_order, include, include_slugs) and order (DESC/ASC).
Taxonomies: page, per_page, search, slug, include, exclude, parent, hide_empty, post, orderby (name, id, count, slug) and order.
Users: page, per_page, offset, search, slug, include, exclude, roles, capabilities, who=authors, has_published_posts, orderby (name, id, registered_date, slug, url, include) and order.

Response format

A single item (/posts/hello-world) returns the item object, in the WordPress REST API format. Single posts also contain pagination.previous_post and pagination.next_post (id, title, slug) to make “previous / next” links easy.

A list (/posts?per_page=5) returns a wrapper object instead of a bare array, so you get the totals without reading headers:

{ "type": "post", "count": 5, "total": 42, "total_pages": 9, "data": [ ... ] }

Errors are JSON with the matching HTTP status, for example { "code": "rest_post_invalid_id", "message": "Invalid post ID.", "data": { "status": 404 } }.

Every response includes:

Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: * and Access-Control-Allow-Methods: GET, OPTIONS, so the API can be called from a browser on any domain. OPTIONS preflight requests are answered straight away.
X-HeadlessFastAPI-Cache: HIT or MISS, to show whether the disk cache was used.

Caching

When Enable Disk Caching is on (Advanced screen), each response is stored as a JSON file. The key is the full request URL, so every combination of path and query string is cached separately.

Cached responses are kept for 1 hour, then built again on the next request.
The cache is not cleared automatically when content changes. To show changes at once, turn on Clear Cache on Save and save the settings, or wait for the hour to pass.

Advanced Custom Fields

With the ACF integration on, each item has an acf object built from the stored field values and a field map generated from your field groups. The map is rebuilt when you save the settings, when you press Force Sync, and whenever an ACF field group is saved.

Repeaters, groups and flexible content are returned as nested arrays and objects. Flexible-content rows include acf_fc_layout.
Image fields set to return an array come back with url, alt, width, height, mime_type and every generated size.
Options pages are available at options/{menu_slug}.
Resolve rules (Schema screen) turn ID fields such as Post Object, Relationship, Taxonomy, Image/File and User into full objects in the same response, with an optional limit per field.
Field exclusion paths can target a single flexible-content layout, for example acf.sections.[hero_banner].subtitle.

Yoast SEO

With Yoast SEO active and the integration on, post items include yoast_head (ready-made HTML for <head>) and yoast_head_json (title, description, robots, canonical, Open Graph, Twitter and schema.org graph). The data is read from Yoast’s yoast_indexable table and settings. Make sure Yoast’s SEO data optimisation (indexing) has run, so every post has an indexable.

Files this plugin writes

The plugin keeps its data in its own folder inside the uploads directory, resolved with wp_upload_dir():

wp-content/uploads/code-and-core-headless-fast-api/

api-schema.json: the saved configuration (entities, integrations, exclusions and rules).
api-schema-preview.json: a temporary copy used by the Schema screen’s live preview.
acf-map.json, acf-options.json: the generated ACF field maps.
cache/: cached responses, when caching is on.

If Fast Mode is on, it also writes the must-use plugin file described above.

Deactivating the plugin removes the Fast Mode file. Deleting the plugin also removes its options (including the usage-data choice) and its folder in the uploads directory.

Security and privacy

The API is read-only. It only answers GET (and OPTIONS) requests and never writes content.
Only the post types, taxonomies and entities you enable are served.
Every request value is sanitized, and every value that reaches the database goes through $wpdb->prepare(), an allowlist or an integer cast.
All admin actions check the manage_options capability and a nonce. Imported JSON is decoded and sanitized key by key.
The API is public, like the core REST API. Use field exclusion to remove anything your front end does not need, and do not use the API to publish data that must stay private.
User email addresses are not included in responses.

External services

This plugin does not load any scripts, stylesheets, fonts or images from a third-party server. All admin assets, including the Inter font, are bundled with the plugin.

Optional usage data (wordpress-plugins.pro). The plugin asks once, in a popup on its own screens, whether you want to share anonymous usage data. Nothing is sent unless an administrator clicks Allow, and you can turn it off at any time under Advanced > Usage Data, where you can also preview the exact data.

What is sent: a random installation ID (not linked to your site address), the plugin, WordPress and PHP versions, the site language, whether the site is a multisite, and the active theme’s name and version. Your site address, content, users and visitors are not sent.
When: once when you allow it, and when the plugin is activated, deactivated, updated or deleted.
Where: https://dashboard.wordpress-plugins.pro/receiver.php.

Deactivation feedback (wordpress-plugins.pro). When you deactivate the plugin from the Plugins screen, a form asks why. It is optional: Skip & Deactivate sends nothing. If you submit it, the reason and comment you entered are sent with the same data as above to https://dashboard.wordpress-plugins.pro/deactive-receiver.php. Your name and email address are included only if you tick the box allowing us to contact you.

Both services are provided by wordpress-plugins.pro: Privacy policy, Terms and conditions.

API responses include each author’s avatar URL as returned by WordPress core’s get_avatar_url(), exactly as the core REST API does. The plugin does not request these URLs itself, and the site’s avatar settings and filters apply.

Credits

Inter font family, Copyright 2020 The Inter Project Authors (https://github.com/rsms/inter), licensed under the SIL Open Font License 1.1. Bundled in assets/fonts/inter/ with its license file.