JWT Authentication for WP REST APIs
by miniOrange · Uncategorized
Also makes 43 other plugins · 77.8K+ installs across the portfolio →
Secure and protect WordPress REST API from unauthorized access using JWT token, Basic Authentication, API Key, OAuth 2, or external token.
Try it live opens a temporary test site in your browser, which can take about 20 seconds to load. Plugins that rely on outside services or a full server may not work completely there.
Health
A 86/100
no flags
Active installs
10K+
≈19K estimated
Momentum
-15%
downloads vs prior 30d
Biggest opportunity: Rating quality scores 86/100. Lift the average: resolve the issues driving the low reviews.
86 health vs 58 average across 25,739 Uncategorized plugins
Install conversion
How it's measured →1.7%
of downloads still active
At least 10K of 575.6K lifetime downloads are still running, above its category: the median Uncategorized plugin keeps 0.6%, across 17,773 plugins.
Downloads count every update, not just first installs, so older and more frequently released plugins read lower. Compare against other Uncategorized plugins, not across the directory. wp.org reports active installs as the bottom of a band, so the real rate is this or higher.
This plugin shipped 10 releases in the last 12 months, and every existing install that updated counted as another download. wp.org publishes no split between first installs and updates, so we show the raw rate rather than guess at one.
Details
Directory ranking optimization
How it's scored →How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.
Excellent listing optimization
Well tuned across the board
Updated 23 days ago
Tested up to WordPress 7.1.4, the current branch or newer
4.4★ over 74 reviews, smoothed to 4.28★
5 of 5 tags set · short description in place
Search visibility
How it's tracked →Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.
37
Momentum
Losing ground
-0.4
Velocity
places per keyword, 28d
16%
Breadth
of keywords climbing, 28d
-0.1
Acceleration
recent half vs earlier
wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.
| Keyword | wp.org | On merit | wp.org move, 90 days |
|---|---|---|---|
| rest api your tag | #2 | #2 | 0 |
| jwt authentication your tag | #2 | #2 | 0 |
| api authentication | #1 | #1 | 0 |
| rest your tag | #3 | #2 | up 1 |
| json rest api | #2 | #2 | 0 |
| jwt | #3 | #3 | 0 |
| secure api your tag | #4 | #3 | down 1 |
| basic authentication | #4 | #3 | — |
| json web authentication | #3 | #3 | 0 |
| api rest | #2 | #2 | 0 |
| remove rest api | #2 | #2 | 0 |
| wordpress rest api | #5 | #6 | 0 |
| authentication | #6 | #6 | up 1 |
| api key your tag | #6 | #8 | up 1 |
| oidc | #3 | #3 | 0 |
| wp rest api | #4 | #4 | down 1 |
| 2 step authentication | #4 | #5 | 0 |
| external api | #5 | #5 | 0 |
| token authentication | #3 | #4 | 0 |
| external authentication | #3 | #4 | 0 |
110 searches this plugin appeared in over the last 90 days, 20 listed. 61 left out as unrelated or noise (years, numbers, stray words).
What to do about it
- Your five tags are all earning their place. Each gets you onto page 1 of its own search, so none is worth giving up. “2 step authentication”, “external api” and “authentication” (#4, #5 and #6 untagged) would be the next worth testing if a slot frees up.
Daily downloads
Since 5 Oct 2022 · 1,489 days · wp.org + Plugin Pulse archive
30-day downloads
Rolling 30-day volume · peak 28.1K · peaks are release surges
Directory rank vs rivals
wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you
Rating trend
Star average over time · dips mark rough releases
Health trend
Composite health score, snapshotted daily
Update activity
How busy the existing users are, measured as downloads in the last 30 days for every 1,000 active sites. A spike means a new release everyone's pulling; a long, slow decline means an aging user base that updates less.
Release cadence
Actively maintainedHow often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.
10
releases in the last 12 months
23d ago
latest release · v5.0.0 · 9 Oct 2026
49
tagged releases on record
Recent releases
What its installed base runs
via wordpress.orgShare of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.
Estimated active installs
The public count shows “10K+”. Our estimate pins where the real number sits.
Crossed into this band 59 days ago and the previous band took 2.5 years to cross, so the real count is still just under 20K.
Install history since 15 Nov 2019
Recent reviews
All reviews on wp.org ↗- ★★★★★ idoshariz8mo ago
After 5 years of using the paid version of this plugin, I must say I am beyond impressed. We use this plugin to secure our API and manage the access keys for our REST API, and for nearly the entire time, it has worked flawlessly. In the rare instances where I encountered an issue, the team behind this plugin proved to be absolute professionals. They didn’t just send generic replies; they scheduled screen-sharing sessions with me and solved every problem quickly and efficiently. I want to give a special thanks to Vidushi Gupta. She has been incredibly helpful, kind, and professional throughout our interactions. Having someone like her to rely on makes all the difference. I will likely remain a customer for at least another 5 years. They are professional, highly efficient, and their customer service is top-notch! If you are looking for a reliable company with a team of experts you can trust, this is the one. Thank you so much, guys – and especially Vidushi – you are simply the best!
Read on wp.org ↗ - ★★★★★ Remwes, LLC10mo ago
Great support from the MiniOrange team! Atul and Vidushi are very helpful and lightning fast to respond.
Read on wp.org ↗ - ★★★★★ pete20712mo ago
Swapnil was very helpful in resolving my issue. I enjoyed the support received by the mini orange team.
Read on wp.org ↗ - ★★★★★ guglielmino1.1y ago
I needed support for some custom routes using miniOrang auth and support was great, helped me to solve my problems
Read on wp.org ↗ - ★★★★★ rvsg11.5y ago
Fast and easy support – even for the free version. Thank you
Read on wp.org ↗ - ★★★★★ Konafets1.6y ago
This plugin deservers not even one star. It takes your API hostage in exchange of a premium membership. Absolutely insane.
Read on wp.org ↗ - ★★★★★ cavsusainc1.7y ago
Excellent support This topic was modified 1 year, 5 months ago by cavsusainc. This topic was modified 1 year, 4 months ago by cavsusainc.
Read on wp.org ↗ - ★★★★★ seotaro1.7y ago
The plugin works fine, but it keeps showing the horrible promotional banner and doesn’t give an option to hide it permanently.
Read on wp.org ↗
Latest updates
via wp.org changelogRecent releases and news for this plugin
Security history
via Wordfence IntelligenceAll 3 disclosed vulnerabilities are patched in the current version (5.0.0). Sites still on an older version should update.
Vulnerability records provided by Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. License and terms.
CVE records: Copyright 1999-2026 The MITRE Corporation. CVE terms of use.
Behavioral tests
via WP HiveAutomated install-time checks, tested on PHP 8.1.12 · WP 7.0
AI assistants
How it's measured →Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.
Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.
Readme readiness
7 of 8 pass · checked 26 Oct 2026Can an assistant quote this readme? Eight deterministic checks over the wp.org listing, no model involved.
- ✓ Says what it does "Secure and protect WordPress REST API from unauthorized access using JWT token, Basic Authentication, API K..."
- ✓ Has a FAQ 10 questions in the FAQ.
- ✓ FAQ asks real questions 10 of 10 read like questions a user would type.
- ! Names who it is for Never says who the plugin is for or what they use it for.
- ✓ Names what it works with Mentions WooCommerce, Gravity Forms, BuddyPress, LearnDash and 1 more.
- ✓ Headings and lists 8 headings and 6 lists.
- ✓ Enough to quote 3,686 characters of description.
- ✓ Tags match the text 4 of 5 tags appear in the text; "secure api" does not.
Growth timeline
Install-tier crossings we have observed, and how long each tier took to outgrow
- 2026-09-03 20K+ → 10K+ down after 921 days in tier
- 2024-02-25 10K+ → 20K+ up after 365 days in tier
- 2023-02-25 9K+ → 10K+ up after 26 days in tier
- 2023-01-30 8K+ → 9K+ up after 29 days in tier
- 2023-01-01 9K+ → 8K+ down after 3 days in tier
- 2022-12-29 8K+ → 9K+ up after 1 days in tier
- 2022-12-28 9K+ → 8K+ down after 7 days in tier
- 2022-12-21 8K+ → 9K+ up after 71 days in tier
Competes with
The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).
-
Disable REST API 80K+ installs · 4.6★ · 2 shared tags D -
Make Connector 70K+ installs · 3.1★ · 2 shared tags B -
Disable WP REST API 30K+ installs · 4.6★ · 2 shared tags A -
WordPress REST API (Version 2) 10K+ installs · 4.1★ · 2 shared tags D -
WP REST API – OAuth 1.0a Server 7K+ installs · 3.8★ · 2 shared tags D -
REST API Toolbox 1K+ installs · 4.3★ · 2 shared tags C
Embed this report card
Drop a live Pulse card for JWT Authentication for WP REST APIs into a readme, a review or a deck. It updates itself.
<iframe src="https://plugins.wpmayor.com/embed/wp-rest-api-authentication" width="480" height="300" style="border:0" loading="lazy" title="JWT Authentication for WP REST APIs — Plugin Pulse"></iframe> JWT Authentication for WP REST APIs: 10K+ active installs, 4.4★ (74 reviews). Plugin Pulse (WP Mayor), as of 2026-11-01. https://plugins.wpmayor.com/plugin/wp-rest-api-authentication
Spotted a number that looks wrong? Report a data issue and we'll check it against the source.