Enable CORS for WordPress API on Apache

October 31, 2019

Option 1: Apache Headers (.htaccess)

code

sudo a2enmod headers
sudo service apache2 reload

.htaccess:

code

<IfModule mod_headers.c>
  Header set Access-Control-Allow-Origin "*"
  Header set Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE"
  Header set Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
</IfModule>

Option 2: functions.php (WP REST)

code

function my_customize_rest_cors() {
  remove_filter('rest_pre_serve_request', 'rest_send_cors_headers');
  add_filter('rest_pre_serve_request', function($value) {
    header('Access-Control-Allow-Origin: *');
    header('Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE');
    header('Access-Control-Allow-Headers: X-Requested-With, Content-Type, Authorization');
    return $value;
  });
}
add_action('rest_api_init', 'my_customize_rest_cors', 15);

Option 3: Apache vhost

code

<Directory /var/www/mysite.com/public_html>
  AllowOverride All
  Header set Access-Control-Allow-Origin "https://www.mysite.com"
</Directory>

Hinweis

Bei Redirects kann Origin zu null werden. Dann blockt der Browser trotzdem.

Link

https://www.w3.org/wiki/CORS_Enabled