How to Build a WordPress REST API Custom Endpoint (2026 UK Guide)
17 August 2026
Create secure custom WordPress REST API endpoints in 2026. UK-focused tutorial with code, authentication, and caching tips for developers.
What Is a Custom REST API Endpoint in WordPress?
A WordPress REST API endpoint is a URL that returns JSON data from your site. By default, WordPress provides endpoints for posts, pages, and users. A custom endpoint allows you to expose your own data, such as product prices, event listings, or bespoke content. This is essential for headless setups, mobile apps, and third-party integrations. For UK businesses, custom endpoints are often used to deliver dynamic data to a React or Vue frontend while keeping content management in WordPress. We'll show you how to create one safely and efficiently, with examples that align with UK web development standards and data protection requirements.
Registering a Custom Route with register_rest_route
The core function for creating a custom endpoint is register_rest_route(). You add it in a plugin or theme's functions.php file. Start with a namespace, which acts as a prefix, like 'ukbusiness/v1'. Then define your route, e.g., '/vat-rates'. Use the 'methods' argument to specify GET or POST. Your callback function receives a WP_REST_Request object and returns a WP_REST_Response with the payload. Here's a minimal example: add_action('rest_api_init', function() { register_rest_route('ukbusiness/v1', '/vat-rates', array('methods' => 'GET', 'callback' => 'get_uk_vat_rates')); }); Remember to flush permalinks after registering new routes.
Authentication and Permissions for UK Developers
Exposing data via REST API can be risky if left open. Use the 'permission_callback' argument to control access. For public data, return true. For logged-in users, check current_user_can(). Nonces are required for cookie-authenticated requests. UK developers must also consider GDPR. Avoid sending personal data without consent. For machine-to-machine communication, use OAuth or Application Passwords (now standard in WordPress core). For example, a UK delivery calculator might require an API key. Always validate and sanitise input on every request to prevent SQL injection and XSS attacks, especially when dealing with customer data.
Practical UK Example: A VAT Rate Custom Endpoint
Let's build a custom endpoint that returns the current UK VAT rate. This is handy for invoicing plugins or e-commerce sites. Create a callback function that returns a response with the rate and any conditional rules. For example: function get_uk_vat_rate() { $rate = 20; return new WP_REST_Response(array('rate' => $rate, 'country' => 'UK', 'last_updated' => '2026-01-01'), 200); } Register it under 'ukbusiness/v1/vat-rate'. We can extend it to accept a category parameter to return reduced or zero rates. This demonstrates how to structure a real-world endpoint. Don't forget to add error handling and log issues appropriately.
Performance and Security Best Practices
Custom endpoints can slow your site if not optimised. Cache responses using transients or a caching plugin like Redis. For high-traffic UK sites, consider a CDN with edge caching. Limit the number of requests using rate limiting to prevent abuse. Always use HTTPS to encrypt data in transit. Sanitise every input and escape output. Also, set a consistent version in your namespace to avoid breaking changes for API consumers. In 2026, WordPress is focusing on performance and developer experience, so follow the latest coding standards. Test your endpoints with tools like Postman and use Xdebug for debugging.
FAQ
No, you can add custom endpoints directly in your theme's functions.php file or in a site-specific plugin. For maintainability, a custom plugin is recommended. This keeps your code reusable and avoids issues when switching themes.