{"id":5164,"date":"2026-09-10T13:27:49","date_gmt":"2026-09-10T10:27:49","guid":{"rendered":"https:\/\/www.dchost.com\/blog\/?p=5164"},"modified":"2026-09-10T06:17:22","modified_gmt":"2026-09-10T03:17:22","slug":"wordpress-rest-api-nedir-kullanim-ve-guvenlik","status":"publish","type":"post","link":"https:\/\/www.dchost.com\/blog\/wordpress-rest-api-nedir-kullanim-ve-guvenlik\/","title":{"rendered":"WordPress REST API Nedir? Kullan\u0131m ve G\u00fcvenlik"},"content":{"rendered":"<div class=\"dchost-blog-content-wrapper\"><div id=\"toc_container\" role=\"navigation\" aria-label=\"Table of Contents\" data-nosnippet class=\"toc_transparent no_bullets toc_numbered toc_title_center\"><p class=\"toc_title\">\u0130\u00e7indekiler<\/p><ul class=\"toc_list\"><li><a href=\"#WordPress_REST_API_nedir_ne_ise_yarar\"><span class=\"toc_number toc_depth_1\">1.<\/span> WordPress REST API nedir, ne i\u015fe yarar?<\/a><\/li><li><a href=\"#Istek_ve_yanit_mantigi\"><span class=\"toc_number toc_depth_1\">2.<\/span> \u0130stek ve yan\u0131t mant\u0131\u011f\u0131<\/a><\/li><li><a href=\"#Hangi_projelerde_kullanilir\"><span class=\"toc_number toc_depth_1\">3.<\/span> Hangi projelerde kullan\u0131l\u0131r?<\/a><\/li><li><a href=\"#WordPress_REST_API_ile_veri_okuma\"><span class=\"toc_number toc_depth_1\">4.<\/span> WordPress REST API ile veri okuma<\/a><ul><li><a href=\"#Filtreleme_arama_ve_sayfalama\"><span class=\"toc_number toc_depth_2\">4.1.<\/span> Filtreleme, arama ve sayfalama<\/a><\/li><li><a href=\"#Icerik_durumlari_ve_context_parametresi\"><span class=\"toc_number toc_depth_2\">4.2.<\/span> \u0130\u00e7erik durumlar\u0131 ve context parametresi<\/a><\/li><\/ul><\/li><li><a href=\"#Kimlik_dogrulama_yontemleri\"><span class=\"toc_number toc_depth_1\">5.<\/span> Kimlik do\u011frulama y\u00f6ntemleri<\/a><ul><li><a href=\"#Cerez_ve_nonce_ile_oturum_tabanli_kullanim\"><span class=\"toc_number toc_depth_2\">5.1.<\/span> \u00c7erez ve nonce ile oturum tabanl\u0131 kullan\u0131m<\/a><\/li><li><a href=\"#Application_Passwords\"><span class=\"toc_number toc_depth_2\">5.2.<\/span> Application Passwords<\/a><\/li><li><a href=\"#JWT_ve_OAuth_ne_zaman_dusunulur\"><span class=\"toc_number toc_depth_2\">5.3.<\/span> JWT ve OAuth ne zaman d\u00fc\u015f\u00fcn\u00fcl\u00fcr?<\/a><\/li><\/ul><\/li><li><a href=\"#Ozel_REST_endpoint_yazarken_guvenlik\"><span class=\"toc_number toc_depth_1\">6.<\/span> \u00d6zel REST endpoint yazarken g\u00fcvenlik<\/a><ul><li><a href=\"#Girdi_dogrulama_ve_cikti_temizleme\"><span class=\"toc_number toc_depth_2\">6.1.<\/span> Girdi do\u011frulama ve \u00e7\u0131kt\u0131 temizleme<\/a><\/li><li><a href=\"#Nonce_CORS_ve_HTTPS\"><span class=\"toc_number toc_depth_2\">6.2.<\/span> Nonce, CORS ve HTTPS<\/a><\/li><\/ul><\/li><li><a href=\"#REST_API8217yi_kapatmak_mi_korumak_mi\"><span class=\"toc_number toc_depth_1\">7.<\/span> REST API&#8217;yi kapatmak m\u0131, korumak m\u0131?<\/a><\/li><li><a href=\"#Performans_ve_operasyon_tarafi\"><span class=\"toc_number toc_depth_1\">8.<\/span> Performans ve operasyon taraf\u0131<\/a><\/li><li><a href=\"#Benim_kontrol_siram\"><span class=\"toc_number toc_depth_1\">9.<\/span> Benim kontrol s\u0131ram<\/a><\/li><li><a href=\"#Sik_Sorulan_Sorular\"><span class=\"toc_number toc_depth_1\">10.<\/span> S\u0131k Sorulan Sorular<\/a><ul><li><a href=\"#WordPress_REST_API_herkese_acik_midir\"><span class=\"toc_number toc_depth_2\">10.1.<\/span> WordPress REST API herkese a\u00e7\u0131k m\u0131d\u0131r?<\/a><\/li><li><a href=\"#WordPress_REST_API_kapatilmali_mi\"><span class=\"toc_number toc_depth_2\">10.2.<\/span> WordPress REST API kapat\u0131lmal\u0131 m\u0131?<\/a><\/li><li><a href=\"#REST_API_kullanmak_icin_eklenti_gerekir_mi\"><span class=\"toc_number toc_depth_2\">10.3.<\/span> REST API kullanmak i\u00e7in eklenti gerekir mi?<\/a><\/li><li><a href=\"#REST_API_siteyi_yavaslatir_mi\"><span class=\"toc_number toc_depth_2\">10.4.<\/span> REST API siteyi yava\u015flat\u0131r m\u0131?<\/a><\/li><\/ul><\/li><\/ul><\/div>\n<h2><span id=\"WordPress_REST_API_nedir_ne_ise_yarar\">WordPress REST API nedir, ne i\u015fe yarar?<\/span><\/h2>\n<p>Gece gelen bir destek biletinde m\u00fc\u015fterinin ilk c\u00fcmlesi genellikle \u015fudur: &#8220;REST API a\u00e7\u0131k g\u00f6r\u00fcn\u00fcyor, site sald\u0131r\u0131ya m\u0131 u\u011frad\u0131?&#8221; \u00c7o\u011fu zaman cevap hay\u0131rd\u0131r. WordPress&#8217;in herkese a\u00e7\u0131k yaz\u0131lar\u0131 JSON bi\u00e7iminde sunmas\u0131 beklenen bir davran\u0131\u015ft\u0131r; as\u0131l mesele hangi verilerin a\u00e7\u0131ld\u0131\u011f\u0131 ve de\u011fi\u015fiklik yapabilen u\u00e7 noktalar\u0131n nas\u0131l korundu\u011fudur.<\/p>\n<p>WordPress REST API, y\u00f6netim panelini a\u00e7madan site verilerine HTTP istekleri \u00fczerinden eri\u015fmenizi sa\u011flayan aray\u00fczd\u00fcr. Bir yaz\u0131y\u0131 okuyabilir, yeni i\u00e7erik olu\u015fturabilir veya bir \u00fcr\u00fcn\u00fcn bilgisini ba\u015fka bir uygulamaya aktarabilirsiniz.<\/p>\n<p>\u015e\u00f6yle anlatay\u0131m: WordPress paneli, veritaban\u0131 tablolar\u0131n\u0131 ve PHP kodunu do\u011frudan kullanan klasik aray\u00fczd\u00fcr. REST API ise bu verilerin kontroll\u00fc bir kap\u0131dan d\u0131\u015far\u0131 sunulmas\u0131d\u0131r. Kap\u0131 vard\u0131r; fakat her ziyaret\u00e7iye her oday\u0131 a\u00e7mak zorunda de\u011fildir.<\/p>\n<p>Standart REST API adresi genellikle \u015fu bi\u00e7imdedir:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">https:\/\/example.com\/wp-json\/wp\/v2\/posts<\/code><\/pre>\n<p>Bu adres sitenin yaz\u0131lar\u0131n\u0131 d\u00f6nd\u00fcr\u00fcr. <code>\/wp\/v2\/pages<\/code> sayfalar\u0131, <code>\/wp\/v2\/media<\/code> medya dosyalar\u0131n\u0131, WooCommerce kuruluysa uygun kimlik do\u011frulamayla <code>\/wc\/v3\/products<\/code> \u00fcr\u00fcnleri temsil eder.<\/p>\n<p>Bir destek biletinde bu adresi ilk kez g\u00f6ren m\u00fc\u015fterinin sitenin sald\u0131r\u0131ya u\u011frad\u0131\u011f\u0131n\u0131 d\u00fc\u015f\u00fcnd\u00fc\u011f\u00fcn\u00fc hat\u0131rl\u0131yorum. Yaz\u0131lar\u0131n JSON olarak listelenmesi \u00e7o\u011fu WordPress kurulumunda normaldir. \u015e\u00fcphelenmem gereken yer, m\u00fc\u015fteri adresleri veya \u00fcr\u00fcn maliyetleri gibi \u00f6zel verilerin yetkisiz yan\u0131tta g\u00f6r\u00fcnmesidir.<\/p>\n<h2><span id=\"Istek_ve_yanit_mantigi\">\u0130stek ve yan\u0131t mant\u0131\u011f\u0131<\/span><\/h2>\n<p>REST API kaynaklarla \u00e7al\u0131\u015f\u0131r. Bir yaz\u0131, sayfa, kullan\u0131c\u0131 veya medya dosyas\u0131 kaynak olarak d\u00fc\u015f\u00fcn\u00fclebilir. HTTP metodu da yapmak istedi\u011finiz i\u015flemi anlat\u0131r:<\/p>\n<table>\n<thead>\n<tr>\n<th>HTTP metodu<\/th>\n<th>Tipik kullan\u0131m<\/th>\n<th>Kimlik do\u011frulama<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>GET<\/td>\n<td>Veri okuma ve listeleme<\/td>\n<td>Herkese a\u00e7\u0131k i\u00e7erikte \u00e7o\u011funlukla gerekmez<\/td>\n<\/tr>\n<tr>\n<td>POST<\/td>\n<td>Yeni kaynak olu\u015fturma<\/td>\n<td>Gerekir<\/td>\n<\/tr>\n<tr>\n<td>PUT veya PATCH<\/td>\n<td>Mevcut kayna\u011f\u0131 g\u00fcncelleme<\/td>\n<td>Gerekir<\/td>\n<\/tr>\n<tr>\n<td>DELETE<\/td>\n<td>Kaynak silme<\/td>\n<td>Gerekir<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u00d6rne\u011fin son yaz\u0131lar\u0131 g\u00f6rmek i\u00e7in:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">curl -s &#039;https:\/\/example.com\/wp-json\/wp\/v2\/posts?per_page=3&amp;_fields=id,date,link,title&#039;<\/code><\/pre>\n<p>Burada <code>per_page=3<\/code> \u00fc\u00e7 kay\u0131t ister. <code>_fields<\/code> ise gereksiz alanlar\u0131 yan\u0131t\u0131n d\u0131\u015f\u0131nda b\u0131rak\u0131r. \u0130stemciye daha az veri gitti\u011fi i\u00e7in bu se\u00e7enek mobil uygulamalarda ve s\u0131k \u00e7al\u0131\u015fan entegrasyonlarda i\u015fime yarar.<\/p>\n<p>Liste yan\u0131t\u0131n\u0131n yan\u0131nda WordPress toplam kay\u0131t say\u0131s\u0131n\u0131 HTTP ba\u015fl\u0131klar\u0131nda verir. <code>X-WP-Total<\/code> toplam kay\u0131tlar\u0131, <code>X-WP-TotalPages<\/code> toplam sayfa say\u0131s\u0131n\u0131 g\u00f6sterir. B\u00fcy\u00fck bir i\u00e7erik ar\u015fivini aktar\u0131rken yaln\u0131zca JSON g\u00f6vdesine bakmam; bu iki ba\u015fl\u0131\u011f\u0131 da kontrol ederim.<\/p>\n<p>Tek bir yaz\u0131y\u0131 kimli\u011fiyle \u00e7a\u011f\u0131rmak i\u00e7in:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">curl -s &#039;https:\/\/example.com\/wp-json\/wp\/v2\/posts\/123&#039;<\/code><\/pre>\n<p>Buradaki <code>123<\/code> yaz\u0131n\u0131n kimli\u011fidir. Kimlik bulunamazsa veya kaynak yay\u0131nlanmam\u0131\u015fsa 404 benzeri bir REST hatas\u0131 alabilirsiniz. REST API adresinin \u00e7al\u0131\u015fmamas\u0131 her zaman hosting ar\u0131zas\u0131 de\u011fildir; kal\u0131c\u0131 ba\u011flant\u0131 kurallar\u0131, g\u00fcvenlik eklentisi veya sunucu katman\u0131ndaki bir kural da iste\u011fi etkileyebilir.<\/p>\n<h2><span id=\"Hangi_projelerde_kullanilir\">Hangi projelerde kullan\u0131l\u0131r?<\/span><\/h2>\n<p>WordPress REST API, i\u00e7eri\u011fi \u00fcreten sistem ile i\u00e7eri\u011fi g\u00f6steren aray\u00fcz\u00fc birbirinden ay\u0131rman\u0131za izin verir. Bu mimariye headless WordPress denir. API kullanmak i\u00e7in sitenin tamamen headless olmas\u0131 gerekmez.<\/p>\n<ul>\n<li>Mobil uygulamaya yaz\u0131, kategori ve medya bilgisi sa\u011flamak.<\/li>\n<li>React, Vue veya ba\u015fka bir JavaScript aray\u00fcz\u00fcnde WordPress i\u00e7eri\u011fi g\u00f6stermek.<\/li>\n<li>Harici CRM, ERP veya stok sistemiyle i\u00e7erik ve \u00fcr\u00fcn verisi e\u015fitlemek.<\/li>\n<li>\u0130\u00e7erik edit\u00f6rlerinin tekrar eden i\u015flemlerini otomatikle\u015ftirmek.<\/li>\n<li>Birden fazla WordPress sitesindeki duyurular\u0131 ortak bir aray\u00fczde toplamak.<\/li>\n<li>WooCommerce \u00fcr\u00fcnlerini yetkili bir i\u00e7 uygulamada listelemek veya g\u00fcncellemek.<\/li>\n<\/ul>\n<p>Bir sitenin SEO ve \u00f6l\u00e7\u00fcm taraf\u0131n\u0131 API ile beslemek m\u00fcmk\u00fcnd\u00fcr. API \u00fczerinden veri \u00e7ekmek ise Google&#8217;\u0131n o veriyi otomatik olarak arama sonu\u00e7lar\u0131nda kullanaca\u011f\u0131 anlam\u0131na gelmez. Teknik entegrasyon ile arama motoru davran\u0131\u015f\u0131n\u0131 birbirine kar\u0131\u015ft\u0131rmamak gerekir. \u00d6l\u00e7\u00fcm zincirini kontrol etmek isteyenler i\u00e7in <a href=\"https:\/\/www.dchost.com\/blog\/ga4-kurulumu-wordpress-woocommerce-olcumu\/\">GA4 Kurulumu: Web Sitenizi Ad\u0131m Ad\u0131m \u0130zleyin<\/a> yaz\u0131s\u0131nda farkl\u0131 bir do\u011frulama y\u00f6ntemi anlat\u0131l\u0131yor.<\/p>\n<p>WooCommerce taraf\u0131nda \u00fcr\u00fcn ve sipari\u015f u\u00e7 noktalar\u0131 daha hassast\u0131r. Bir \u00fcr\u00fcn\u00fcn herkese a\u00e7\u0131k ad\u0131 ve fiyat\u0131 ile m\u00fc\u015fterinin adres bilgisi ayn\u0131 g\u00fcvenlik s\u0131n\u0131f\u0131nda de\u011fildir. Entegrasyonu tasarlarken veri alanlar\u0131n\u0131 tek tek belirlemek, t\u00fcm nesneyi oldu\u011fu gibi d\u0131\u015far\u0131 vermekten daha g\u00fcvenlidir.<\/p>\n<h2><span id=\"WordPress_REST_API_ile_veri_okuma\">WordPress REST API ile veri okuma<\/span><\/h2>\n<h3><span id=\"Filtreleme_arama_ve_sayfalama\">Filtreleme, arama ve sayfalama<\/span><\/h3>\n<p>REST API sorgu parametreleriyle yan\u0131t\u0131 daraltabilirsiniz. Belirli bir arama terimiyle ve kategori kimli\u011fiyle yaz\u0131 istemek i\u00e7in:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">curl -s &#039;https:\/\/example.com\/wp-json\/wp\/v2\/posts?search=linux&amp;categories=7&amp;per_page=10&amp;page=2&#039;<\/code><\/pre>\n<p>Bu istek Linux kelimesini i\u00e7eren, 7 numaral\u0131 kategoriye ba\u011fl\u0131 yaz\u0131lar\u0131n ikinci sayfas\u0131n\u0131 ister. <code>page<\/code> de\u011feri mevcut sayfa say\u0131s\u0131n\u0131 a\u015farsa API hata yan\u0131t\u0131 d\u00f6nd\u00fcrebilir; otomasyon kodu bu durumu beklemelidir.<\/p>\n<p>Alan se\u00e7imi i\u00e7in <code>_fields<\/code> kullanmak yaln\u0131zca performans ayar\u0131 de\u011fildir. \u0130stemcinin g\u00f6rmesine gerek olmayan alanlar\u0131n ta\u015f\u0131nmas\u0131n\u0131 da azalt\u0131r:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">curl -s &#039;https:\/\/example.com\/wp-json\/wp\/v2\/posts?per_page=5&amp;_fields=id,slug,title.rendered,excerpt.rendered&#039;<\/code><\/pre>\n<p>HTML i\u00e7eren alanlarda <code>title.rendered<\/code> veya <code>excerpt.rendered<\/code> bi\u00e7imini g\u00f6r\u00fcrs\u00fcn\u00fcz. Bu alanlar\u0131 ba\u015fka bir sayfada g\u00f6sterirken ham bi\u00e7imi g\u00fcvenilir kabul etmeyin; kulland\u0131\u011f\u0131n\u0131z aray\u00fcz katman\u0131nda uygun ka\u00e7\u0131\u015f ve temizleme i\u015flemini uygulay\u0131n.<\/p>\n<h3><span id=\"Icerik_durumlari_ve_context_parametresi\">\u0130\u00e7erik durumlar\u0131 ve context parametresi<\/span><\/h3>\n<p>Herkese a\u00e7\u0131k istekler \u00e7o\u011funlukla <code>view<\/code> ba\u011flam\u0131nda \u00e7al\u0131\u015f\u0131r. Yetkili kullan\u0131c\u0131lar i\u00e7in <code>edit<\/code> ba\u011flam\u0131 daha fazla alan d\u00f6nd\u00fcrebilir. Taslak, \u00f6zel alan veya d\u00fczenleme bilgileri bu ba\u011flamda ortaya \u00e7\u0131kabilir.<\/p>\n<p><code>context=edit<\/code> kullanmak tek ba\u015f\u0131na yetki sa\u011flamaz. Sunucu, iste\u011fi yapan kullan\u0131c\u0131n\u0131n ilgili kayna\u011f\u0131 d\u00fczenleme iznini ayr\u0131ca denetler. Bu ayr\u0131m\u0131 bilmeden gizli alanlar\u0131 istemci taraf\u0131nda saklamaya \u00e7al\u0131\u015fmak s\u0131k rastlad\u0131\u011f\u0131m hatalardan biridir.<\/p>\n<h2><span id=\"Kimlik_dogrulama_yontemleri\">Kimlik do\u011frulama y\u00f6ntemleri<\/span><\/h2>\n<h3><span id=\"Cerez_ve_nonce_ile_oturum_tabanli_kullanim\">\u00c7erez ve nonce ile oturum tabanl\u0131 kullan\u0131m<\/span><\/h3>\n<p>WordPress y\u00f6netim panelinde oturum a\u00e7m\u0131\u015f bir kullan\u0131c\u0131, taray\u0131c\u0131 i\u00e7indeki JavaScript koduyla REST API iste\u011fi g\u00f6nderebilir. Bu senaryoda WordPress oturum \u00e7erezine ek olarak <code>wp_rest<\/code> nonce de\u011feri kullan\u0131l\u0131r. Nonce, iste\u011fin panel oturumu i\u00e7indeki beklenen kaynaktan geldi\u011fini kontrol etmeye yard\u0131mc\u0131 olur.<\/p>\n<p>Bu y\u00f6ntem site i\u00e7indeki y\u00f6netim ekranlar\u0131nda kullan\u0131\u015fl\u0131d\u0131r. Harici bir sunucunun uzun s\u00fcreli entegrasyonu i\u00e7in taray\u0131c\u0131 oturum \u00e7erezini kopyalamak do\u011fru yakla\u015f\u0131m de\u011fildir.<\/p>\n<h3><span id=\"Application_Passwords\">Application Passwords<\/span><\/h3>\n<p>WordPress&#8217;in yerle\u015fik Application Passwords \u00f6zelli\u011fi, bir kullan\u0131c\u0131 hesab\u0131 i\u00e7in ayr\u0131 bir uygulama parolas\u0131 \u00fcretir. Bu parola temel kimlik do\u011frulama ba\u015fl\u0131\u011f\u0131yla HTTPS \u00fczerinden g\u00f6nderilebilir:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">curl --user &#039;api-user:uygulama-parolasi&#039; \\\n  -H &#039;Content-Type: application\/json&#039; \\\n  &#039;https:\/\/example.com\/wp-json\/wp\/v2\/users\/me&#039;<\/code><\/pre>\n<p>Yan\u0131t, kimlik do\u011frulamas\u0131n\u0131n hangi kullan\u0131c\u0131yla yap\u0131ld\u0131\u011f\u0131n\u0131 g\u00f6sterir. Uygulama parolas\u0131n\u0131 normal kullan\u0131c\u0131 parolas\u0131 gibi payla\u015fmay\u0131n, kod deposuna yazmay\u0131n ve gerekmiyorsa yetkili bir y\u00f6netici hesab\u0131na ba\u011flamay\u0131n.<\/p>\n<p>Bir yaz\u0131 olu\u015fturma \u00f6rne\u011fi \u015f\u00f6yle olabilir:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">curl --user &#039;api-user:uygulama-parolasi&#039; \\\n  -X POST &#039;https:\/\/example.com\/wp-json\/wp\/v2\/posts&#039; \\\n  -H &#039;Content-Type: application\/json&#039; \\\n  -d &#039;{&quot;title&quot;:&quot;API ile olu\u015fturulan taslak&quot;,&quot;content&quot;:&quot;\u0130\u00e7erik burada&quot;,&quot;status&quot;:&quot;draft&quot;}&#039;<\/code><\/pre>\n<p>Bu istek taslak bir yaz\u0131 olu\u015fturur. Komut canl\u0131 sitede \u00e7al\u0131\u015ft\u0131r\u0131lmadan \u00f6nce hedef site, kullan\u0131c\u0131 ve <code>status<\/code> de\u011feri kontrol edilmelidir. Yanl\u0131\u015f endpoint&#8217;e g\u00f6nderilen POST iste\u011fi geri al\u0131nabilir bir \u00f6nizleme de\u011fildir.<\/p>\n<h3><span id=\"JWT_ve_OAuth_ne_zaman_dusunulur\">JWT ve OAuth ne zaman d\u00fc\u015f\u00fcn\u00fcl\u00fcr?<\/span><\/h3>\n<p>JWT veya OAuth, \u00f6zel mobil uygulamalarda ya da ayr\u0131 servis mimarilerinde kar\u015f\u0131n\u0131za \u00e7\u0131kabilir. Bunlar WordPress \u00e7ekirde\u011finin her kurulumda ayn\u0131 \u015fekilde sundu\u011fu tek bir standart \u00e7\u00f6z\u00fcm de\u011fildir; \u00e7o\u011funlukla eklenti, reverse proxy veya ayr\u0131 bir kimlik servisi gerektirir.<\/p>\n<p>Bir eklentinin pop\u00fcler olmas\u0131 g\u00fcvenli yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131 anlam\u0131na gelmez. Token s\u00fcresi, yenileme y\u00f6ntemi, iptal mekanizmas\u0131, TLS kullan\u0131m\u0131 ve hata loglar\u0131nda token s\u0131z\u0131p s\u0131zmad\u0131\u011f\u0131 incelenmelidir. Ben k\u00fc\u00e7\u00fck entegrasyonlarda \u00f6nce yerle\u015fik Application Passwords ile en az yetkili kullan\u0131c\u0131y\u0131 kurar\u0131m. \u0130htiya\u00e7 olu\u015fmadan JWT katman\u0131 eklemem.<\/p>\n<h2><span id=\"Ozel_REST_endpoint_yazarken_guvenlik\">\u00d6zel REST endpoint yazarken g\u00fcvenlik<\/span><\/h2>\n<p>Bir eklenti veya tema ile \u00f6zel endpoint ekleyebilirsiniz:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">register_rest_route( &#039;magaza\/v1&#039;, &#039;\/stok\/(?P&lt;sku&gt;[A-Za-z0-9_-]+)&#039;, array(\n    &#039;methods&#039;             =&gt; WP_REST_Server::READABLE,\n    &#039;callback&#039;            =&gt; &#039;magaza_stok_getir&#039;,\n    &#039;permission_callback&#039; =&gt; &#039;magaza_stok_izni&#039;,\n) );<\/code><\/pre>\n<p>Burada namespace s\u00fcr\u00fcmlendirilmi\u015ftir ve SKU i\u00e7in bir desen tan\u0131mlanm\u0131\u015ft\u0131r. As\u0131l g\u00fcvenlik <code>permission_callback<\/code> i\u00e7inde yer al\u0131r. Bu alan\u0131 bo\u015f b\u0131rakmak veya eski \u00f6rneklerde g\u00f6r\u00fclen <code>__return_true<\/code> yakla\u015f\u0131m\u0131n\u0131 d\u00fc\u015f\u00fcnmeden kullanmak risklidir.<\/p>\n<p>\u0130zin kontrol\u00fcn\u00fc kullan\u0131c\u0131 yetene\u011fine ba\u011flayabilirsiniz:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">function magaza_stok_izni( WP_REST_Request $request ) {\n    return current_user_can( &#039;manage_woocommerce&#039; );\n}<\/code><\/pre>\n<p>Ne yapt\u0131k? \u0130ste\u011fi yapan kullan\u0131c\u0131n\u0131n WooCommerce stoklar\u0131n\u0131 y\u00f6netme yetene\u011fi yoksa callback \u00e7al\u0131\u015ft\u0131r\u0131lm\u0131yor. Capability se\u00e7imi sitenin rol yap\u0131s\u0131na uygun olmal\u0131; her i\u015flem i\u00e7in do\u011frudan <code>manage_options<\/code> vermek en az yetki ilkesini bozar.<\/p>\n<h3><span id=\"Girdi_dogrulama_ve_cikti_temizleme\">Girdi do\u011frulama ve \u00e7\u0131kt\u0131 temizleme<\/span><\/h3>\n<p>REST API&#8217;den gelen veriyi g\u00fcvenilir kabul etmeyin. Parametre tipi, izin verilen de\u011ferler, uzunluk ve i\u015f ba\u011flam\u0131 kontrol edilmelidir. \u00dcr\u00fcn miktar\u0131 beklenen bir tamsay\u0131ysa metin olarak gelen de\u011feri sessizce kabul etmek yerine do\u011frulay\u0131n. Metin alanlar\u0131nda uygun WordPress temizleme fonksiyonlar\u0131n\u0131 kullan\u0131n.<\/p>\n<p>Yan\u0131t\u0131 haz\u0131rlarken veritaban\u0131ndan gelen her alan\u0131 oldu\u011fu gibi d\u00f6nd\u00fcrmek de do\u011fru de\u011fildir. E-posta, adres, i\u00e7 not, m\u00fc\u015fteri kimli\u011fi veya \u00f6zel meta alanlar\u0131 gerekmiyorsa yan\u0131t d\u0131\u015f\u0131nda b\u0131rak\u0131lmal\u0131d\u0131r. <code>register_rest_field<\/code> ile eklenen alanlarda \u00f6zellikle dikkatli olun; bir alan\u0131 g\u00f6stermek kolay, yanl\u0131\u015fl\u0131kla herkese a\u00e7\u0131ld\u0131\u011f\u0131n\u0131 sonradan fark etmek pahal\u0131d\u0131r.<\/p>\n<h3><span id=\"Nonce_CORS_ve_HTTPS\">Nonce, CORS ve HTTPS<\/span><\/h3>\n<p>Nonce, kimlik do\u011frulaman\u0131n yerine ge\u00e7mez. CORS da yetki sistemi de\u011fildir; yaln\u0131zca hangi taray\u0131c\u0131 kaynaklar\u0131n\u0131n yan\u0131t\u0131 okuyabilece\u011fini etkiler. Sunucuya gelen iste\u011fin kimli\u011fini ve kullan\u0131c\u0131n\u0131n yetkisini ayr\u0131ca kontrol etmek gerekir.<\/p>\n<p>Kimlik bilgileri, Application Passwords ve i\u00e7erik g\u00fcncelleme istekleri yaln\u0131zca HTTPS \u00fczerinden ta\u015f\u0131nmal\u0131d\u0131r. HTTP y\u00f6nlendirmesinin varl\u0131\u011f\u0131na g\u00fcvenerek parolay\u0131 HTTP URL&#8217;sine g\u00f6ndermeyin; istemci do\u011frudan do\u011fru HTTPS adresini kullanmal\u0131d\u0131r.<\/p>\n<h2><span id=\"REST_API8217yi_kapatmak_mi_korumak_mi\">REST API&#8217;yi kapatmak m\u0131, korumak m\u0131?<\/span><\/h2>\n<p>Bir sitenin REST API \u00e7\u0131kt\u0131s\u0131nda herkese a\u00e7\u0131k yaz\u0131lar\u0131n bulunmas\u0131 tek ba\u015f\u0131na g\u00fcvenlik a\u00e7\u0131\u011f\u0131 de\u011fildir. API&#8217;yi t\u00fcmden kapatmak blok edit\u00f6r\u00fcn\u00fc ve baz\u0131 modern eklentileri bozabilir. Ben \u00f6nce hangi endpoint&#8217;in ger\u00e7ekten sorun olu\u015fturdu\u011funu belirlemeyi tercih ederim.<\/p>\n<p>Kullan\u0131c\u0131 adlar\u0131n\u0131 REST API \u00fczerinden sorgulamay\u0131 s\u0131n\u0131rlamak, hassas \u00f6zel endpoint&#8217;leri yetki kontrol\u00fcne almak ve gereksiz eklentileri kald\u0131rmak \u00e7o\u011fu zaman t\u00fcm API&#8217;yi kapatmaktan daha sa\u011fl\u0131kl\u0131d\u0131r. G\u00fcvenlik eklentisinin genel kural\u0131n\u0131n beklenen mobil uygulamay\u0131 veya edit\u00f6r ba\u011flant\u0131s\u0131n\u0131 kesmedi\u011fini de test edin.<\/p>\n<p><a href=\"https:\/\/www.dchost.com\/blog\/wordpress-site-sagligi-raporu-nasil-okunur\/\">WordPress Site Sa\u011fl\u0131\u011f\u0131 Raporu Nas\u0131l Okunur?<\/a> yaz\u0131s\u0131ndaki kontroller burada da i\u015fe yarar. REST API ile ilgili hata g\u00f6rd\u00fc\u011f\u00fcn\u00fczde yaln\u0131zca g\u00fcvenlik eklentisini su\u00e7lamay\u0131n; PHP s\u00fcr\u00fcm\u00fc, kal\u0131c\u0131 ba\u011flant\u0131lar, REST testi, loopback istekleri ve sunucu loglar\u0131 birlikte incelenmelidir.<\/p>\n<p>\u00d6zel endpoint&#8217;ler y\u00f6netici i\u015flemleri yap\u0131yorsa denetim izi de b\u0131rak\u0131n. Kim, hangi kayd\u0131, ne zaman ve hangi istemci \u00fczerinden de\u011fi\u015ftirdi sorular\u0131 daha sonra cevaplanabilmelidir. <a href=\"https:\/\/www.dchost.com\/blog\/loglama-ve-denetim-izi-mimarisi-yonetici-islemlerini-kvkk-gdpr-uyumlu-kaydetmek\/\">Loglama ve Denetim \u0130zi Mimarisi: Y\u00f6netici \u0130\u015flemlerini KVKK\/GDPR Uyumlu Kaydetmek<\/a> ba\u015fl\u0131\u011f\u0131nda bu kay\u0131tlar\u0131n ki\u015fisel veri taraf\u0131 ayr\u0131ca ele al\u0131n\u0131yor.<\/p>\n<h2><span id=\"Performans_ve_operasyon_tarafi\">Performans ve operasyon taraf\u0131<\/span><\/h2>\n<p>Bir istemci her sayfa y\u00fcklemesinde binlerce yaz\u0131y\u0131 \u00e7ekerse API do\u011fru \u00e7al\u0131\u015fsa bile mimari yanl\u0131\u015f kurulmu\u015f olur. Sayfalama, <code>_fields<\/code>, uygun \u00f6nbellekleme ve de\u011fi\u015fmeyen veriler i\u00e7in <code>ETag<\/code> veya <code>Last-Modified<\/code> ba\u015fl\u0131klar\u0131 kullan\u0131labilir.<\/p>\n<p>Cache katman\u0131 kullan\u0131rken yetkili ve yetkisiz yan\u0131tlar\u0131 birbirine kar\u0131\u015ft\u0131rmay\u0131n. <code>context=edit<\/code> ile al\u0131nan veya kullan\u0131c\u0131ya \u00f6zel veriler herkese a\u00e7\u0131k \u00f6nbellekte tutulmamal\u0131d\u0131r. CDN \u00fczerinde <code>Authorization<\/code> ba\u015fl\u0131\u011f\u0131 ta\u015f\u0131yan isteklerin nas\u0131l i\u015flendi\u011fini ayr\u0131ca kontrol edin.<\/p>\n<p>Rate limit yaln\u0131zca sald\u0131r\u0131 an\u0131nda d\u00fc\u015f\u00fcn\u00fclmemeli. Hatal\u0131 yaz\u0131lm\u0131\u015f bir senkronizasyon g\u00f6revi ayn\u0131 endpoint&#8217;e saniyede y\u00fczlerce istek g\u00f6ndererek PHP worker&#8217;lar\u0131n\u0131 t\u00fcketebilir. Hosting taraf\u0131nda bunu access log, uygulama logu ve CPU\/RAM g\u00f6zlemiyle birlikte de\u011ferlendiririm. &#8220;API yava\u015f&#8221; biletinde \u00f6nce istek say\u0131s\u0131n\u0131, yan\u0131t boyutunu ve sorgu parametrelerini \u00f6l\u00e7erim; sunucuyu b\u00fcy\u00fctmek sonraki ad\u0131md\u0131r.<\/p>\n<p>\u0130zleme eklerken parola veya token de\u011ferlerini loglamay\u0131n. Ba\u015far\u0131s\u0131z isteklerde endpoint, HTTP kodu ve gerekiyorsa kullan\u0131c\u0131 kimli\u011fi \u00e7o\u011fu te\u015fhis i\u00e7in yeterlidir. Hassas veriyi saklamadan da yeterli bir denetim izi kurulabilir.<\/p>\n<h2><span id=\"Benim_kontrol_siram\">Benim kontrol s\u0131ram<\/span><\/h2>\n<p>Yeni bir WordPress REST API entegrasyonunu canl\u0131ya almadan \u00f6nce \u015fu listeyi kullan\u0131yorum:<\/p>\n<ol>\n<li>Endpoint&#8217;in namespace ve s\u00fcr\u00fcm\u00fc belirli mi?<\/li>\n<li>GET ile a\u00e7\u0131lan veriler ger\u00e7ekten herkese a\u00e7\u0131k m\u0131?<\/li>\n<li>POST, PATCH ve DELETE isteklerinde yetenek kontrol\u00fc var m\u0131?<\/li>\n<li>\u0130zin kontrol\u00fc ba\u015far\u0131s\u0131z oldu\u011funda 401 veya 403 yan\u0131t\u0131 do\u011fru d\u00f6n\u00fcyor mu?<\/li>\n<li>Girdi do\u011frulama, tip kontrol\u00fc ve \u00e7\u0131kt\u0131 temizleme yap\u0131l\u0131yor mu?<\/li>\n<li>Yan\u0131tta parola, token, m\u00fc\u015fteri adresi veya gereksiz \u00f6zel alan kal\u0131yor mu?<\/li>\n<li>HTTPS, CORS, rate limit ve cache davran\u0131\u015f\u0131 test edildi mi?<\/li>\n<li>Bir hata durumunda loglarda yeterli ama \u00f6l\u00e7\u00fcl\u00fc bilgi bulunuyor mu?<\/li>\n<li>Geri d\u00f6n\u00fc\u015f plan\u0131 ve veritaban\u0131 yede\u011fi haz\u0131r m\u0131?<\/li>\n<\/ol>\n<p>De\u011fi\u015fiklikten \u00f6nce <code>wp db export<\/code> almadan WordPress g\u00fcncellemesi yapmad\u0131\u011f\u0131m gibi, canl\u0131 entegrasyonda da \u00f6nce staging testini tamamlar\u0131m. API \u00e7a\u011fr\u0131s\u0131n\u0131 staging&#8217;de denemek kolayd\u0131r; yanl\u0131\u015fl\u0131kla ger\u00e7ek m\u00fc\u015fteriye e-posta g\u00f6nderen veya canl\u0131 \u00fcr\u00fcn\u00fc g\u00fcncelleyen otomasyonu geri almak o kadar kolay de\u011fildir.<\/p>\n<p>Bir keresinde g\u00fcvenlik eklentisi nedeniyle blok edit\u00f6r\u00fcn\u00fcn REST iste\u011fi 403 d\u00f6n\u00fcyordu. Panel a\u00e7\u0131l\u0131yor, yaz\u0131 kaydetme i\u015flemi ise sessizce ba\u015far\u0131s\u0131z oluyordu. <code>curl -i<\/code> ile yan\u0131t ba\u015fl\u0131klar\u0131n\u0131 ve web sunucusu logunu birlikte kontrol etti\u011fimde sorunun WordPress \u00e7ekirde\u011finde de\u011fil, g\u00fcvenlik eklentisinin genel REST kural\u0131nda oldu\u011funu g\u00f6rd\u00fcm. Kural\u0131 t\u00fcm API&#8217;yi kapatmadan daraltt\u0131k ve staging&#8217;de yaz\u0131 olu\u015fturma, medya y\u00fckleme ve yetkisiz istek testlerini tekrarlad\u0131k. Benim i\u00e7in ders basitti: \u00f6nce hangi iste\u011fin, hangi katmanda reddedildi\u011fini bulun.<\/p>\n<h2><span id=\"Sik_Sorulan_Sorular\">S\u0131k Sorulan Sorular<\/span><\/h2>\n<h3><span id=\"WordPress_REST_API_herkese_acik_midir\">WordPress REST API herkese a\u00e7\u0131k m\u0131d\u0131r?<\/span><\/h3>\n<p>Herkese a\u00e7\u0131k yaz\u0131 ve sayfa gibi kaynaklar\u0131n baz\u0131 alanlar\u0131 \u00e7o\u011fu kurulumda kimlik do\u011frulama olmadan okunabilir. \u0130\u00e7erik olu\u015fturma, g\u00fcncelleme, silme ve \u00f6zel veriler i\u00e7in yetkilendirme gerekir; sitenizdeki eklentiler bu davran\u0131\u015f\u0131 de\u011fi\u015ftirebilir.<\/p>\n<h3><span id=\"WordPress_REST_API_kapatilmali_mi\">WordPress REST API kapat\u0131lmal\u0131 m\u0131?<\/span><\/h3>\n<p>Genellikle t\u00fcm API&#8217;yi kapatmak yerine hassas endpoint&#8217;leri ve kullan\u0131c\u0131 bilgisi s\u0131z\u0131nt\u0131lar\u0131n\u0131 s\u0131n\u0131rlamak daha do\u011fru olur. Kapatma i\u015flemi blok edit\u00f6r\u00fc, mobil uygulamalar veya baz\u0131 eklentilerle uyumsuzluk olu\u015fturabilir.<\/p>\n<h3><span id=\"REST_API_kullanmak_icin_eklenti_gerekir_mi\">REST API kullanmak i\u00e7in eklenti gerekir mi?<\/span><\/h3>\n<p>WordPress \u00e7ekirde\u011fi yaz\u0131lar, sayfalar, medya ve kullan\u0131c\u0131lar gibi bir\u00e7ok kaynak i\u00e7in yerle\u015fik endpoint sunar. JWT gibi \u00f6zel kimlik do\u011frulama y\u00f6ntemleri veya \u00f6zel i\u015f ak\u0131\u015flar\u0131 i\u00e7in eklenti ya da kendi geli\u015ftirdi\u011finiz kod gerekebilir.<\/p>\n<h3><span id=\"REST_API_siteyi_yavaslatir_mi\">REST API siteyi yava\u015flat\u0131r m\u0131?<\/span><\/h3>\n<p>API&#8217;nin kendisi otomatik olarak yava\u015fl\u0131k olu\u015fturmaz; gere\u011finden fazla kay\u0131t \u00e7ekmek, a\u011f\u0131r meta sorgular\u0131 ve kontrols\u00fcz otomasyon y\u00fck olu\u015fturabilir. Sayfalama, <code>_fields<\/code>, \u00f6nbellekleme ve rate limit kullanarak bu y\u00fck\u00fc \u00f6l\u00e7\u00fclebilir bi\u00e7imde azaltabilirsiniz.<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>WordPress REST API ile i\u00e7erik okuma, veri g\u00fcncelleme ve harici uygulama entegrasyonlar\u0131n\u0131 g\u00fcvenli bi\u00e7imde kurmak i\u00e7in endpoint, yetkilendirme ve performans temelleri.<\/p>\n","protected":false},"author":4,"featured_media":5160,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[23],"tags":[481,476,356,116,475,480],"class_list":["post-5164","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wordpress","tag-api-guvenligi","tag-rest-api","tag-woocommerce","tag-wordpress","tag-wordpress-guvenligi","tag-wordpress-rest-api"],"_links":{"self":[{"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/posts\/5164","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/comments?post=5164"}],"version-history":[{"count":1,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/posts\/5164\/revisions"}],"predecessor-version":[{"id":5166,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/posts\/5164\/revisions\/5166"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/media\/5160"}],"wp:attachment":[{"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/media?parent=5164"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/categories?post=5164"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/tags?post=5164"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}