# WordPress REST API Access

Keep authenticated REST access disabled.
The public check does not use credentials.

## Required variables

- `SITE_URL`: The HTTPS URL of the WordPress site.
- `WP_REST_USER`: The name of the approved WordPress account.
- `WP_REST_APPLICATION_PASSWORD`: The application password from an approved private source.

Do not store credentials in the repository.

## Configuration validation

Run this command after you review `.env`:

```bash
scripts/with-environment.sh rest .env scripts/rest-public-read.sh
```

The REST mode validates configuration only.
The REST mode does not authenticate.
The mode clears stale ambient contract values.
The mode exports only `SITE_URL`, `WP_REST_USER`, and `WP_REST_APPLICATION_PASSWORD`.

## Least-privilege account requirements

Use a dedicated WordPress account.
Give the account only the permissions that the approved read operations require.
Do not give the account permission to create, update, publish, or delete content.
Revoke the application password when access is no longer necessary.

## Public REST verification

Use this unauthenticated check for the public REST index:

```bash
scripts/with-environment.sh rest .env scripts/rest-public-read.sh
```

Use only `https://phyllisschlafly.com` or `https://www.phyllisschlafly.com`.
The command rejects redirects.
The command does not use `WP_REST_USER`.
The command does not use `WP_REST_APPLICATION_PASSWORD`.
The command removes both credential placeholders before it runs `curl`.
Keep TLS certificate verification active.

## Application-password limitation

WordPress updates the application-password `last_used` and `last_ip` metadata after authenticated use.
This metadata update is a production write.
This scaffold cannot validate production application passwords without a WordPress metadata write.
Keep the credential placeholders for future separately approved access.
Do not use the credential placeholders through this scaffold.

## Prohibited actions

Do not use `POST`, `PUT`, `PATCH`, or `DELETE` requests.
Do not create, update, publish, upload, or delete data.
Do not change users, roles, settings, themes, or plugins.
Do not bypass TLS verification.

## Production write boundary

This repository never authorizes production writes.
Operator approval does not enable writes through this template.
Use a separate access method for an approved production write.
Use a change procedure outside this scaffold for that write.

## Required approval

Use a separate access procedure for future authenticated REST API access.
Get operator approval for that specific access.
The approval must identify the account and application password.