I have website on WP. Also I have account in one web service. I need to get a request from this web service to a certain address of my website. This is a webhook that I want to handle with my own plugin.

What to use for requests to the website from outside, wp-ajax or WP REST API? I'm not interested in the speed of processing this request. I'm interested in right way in terms of security and generally accepted practices.

  • 1
    and most modern webservices use REST - ok, but what about security? Jul 18, 2017 at 14:59
  • 1
    Why should one WP service be more secure than another? If anything, I believe WP REST to be more secure as it joined the core much more recently
    – kero
    Jul 18, 2017 at 15:06

2 Answers 2


Each of these have their own advantages and disadvantages. You might need to choose one over another, based on your needs. They are both well secured, otherwise they wouldn't exist in the core.

REST-API, The modern and well known API

The REST API was added to ( or better say, combined with ) the core more recently than Admin-AJAX. It is perfect to be used in mobile apps and API developments.


  • Is simpler to write, develop and debug
  • Does not need separate functions for logged-in and non-logged-in users
  • The core already has some built-in handlers that speed up the development process
  • The response can easily be used in applications or platforms that do not run on WordPress


  • It does not produce any user-friendly response. The output is in JSON, which can't be used in some cases, such as SEO purposes. However, some might find this an advantage
  • Working with JavaScript and JSON needs more knowledge than handling a simple text output

Admin-AJAX, The ancient AJAX handler of WordPress

Admin AJAX existed in the core for as long as I remember, and is the way the core itself deals with the requests in the admin area.


  • It directly outputs the content, which can be used anywhere, even by search engines. Some scripts such as Custombox only support this kind of response
  • It has separate functions for logged-in and logged-out users. While you can do this with a conditional in the REST-API, some may find this useful
  • Working with the response is easier, since all you need is to put it in a div or wherever you need


  • Since the output is plain HTML ( By default ) it shouldn't ( or maybe even can't ) be used in APIs and application development


It's very hard to say which one should be used, they are both useful handlers and if any of them wasn't secure, it certainly would not have existed in the core for so many years. So there is not a problem of security, but still if you are concerned about the security, you need an SSL certificate.

It's rather performance, type of request, and development platform that decides which one should be used.

  • "admin ajax ....and is the way the core itself deals with the requests in the admin area." that is for sure not true any more. There realy was never a reason to use the ajax API after WP 4.5. There were never any advantages to using it.... maybe saves some code if you need to authenticate that a user is logged in is the only one Aug 25, 2021 at 7:05

I know there are ways to allow for Authentication with the Rest API, but it takes additional effort to get it to work properly.

Meaning using functions like is_user_logged_in() will not work right out of the box with the Rest API, but it does with the AJAX method.

So my answer would be when you need it to make requests from the Website to itself ex. when JS needs some data then it is usually best to use the AJAX methods as you will have full access to the WP functions and Authentication if needed.

If you are needing to make requests from third party software that WILL have access to a User's Login and Password that you can pass authentication with


You have no need for user data or any other authenticated data from the website, but just need simple data like "Top Posts", etc then use the Rest API.

  • I don't think it's too complicated to build a proxy of some sort in the request, that simply does wp_set_current_user ( which is for the user session ), based on who owns the authentication and have everything available.
    – Robert
    Feb 25, 2020 at 12:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.