by
gallopsoftware
0 (0 reviews)
Gallop
A REST API for headless Next.js sites: a page's post, SEO, and site data in one request, plus comments and member accounts that stay in WordPress.
Gallop ranks #72,465 among WordPress.org plugins with 0+ active installations, is #1,407 of 1,659 in the Authentication category, and was last updated Oct 15, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1.4
v1.4.0
Current Version v1.4.0
Updated 3 weeks ago
Last Update on 15 Oct, 2026
Refreshed 1 week ago
Last Refreshed on
#1,407 of 1,659 in Authentication
Actively maintained
Rank
#72,465
—
No change
Active Installs
0+
-100%
KW Avg Position
27.5
—
No change
Downloads
381
+1 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 10
0+
10+
44,897
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 10 more installs to reach 10+
Rank Changes
Current
#72,465
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.4.0
- Last Updated
- Oct 15, 2026
- Requires WP
- 6.4+
- Tested Up To
- 7.1.4
- PHP Version
- 8.1 or higher
- Author
- gallopsoftware
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,757
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,015
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
5M+ installs
#9
Wordfence Security – Firewall, Malware Scan, and Login Security
5M+ installs
#11
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
Loginizer
1M+ installs
#46
All-In-One Security (AIOS) – Security and Firewall
1M+ installs
#57
Maintenance
1M+ installs
#59
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites
700K+ installs
#86
Frequently Asked Questions
Common questions about Gallop
No. Gallop's REST endpoints are framework-agnostic JSON. Next.js is the reference target and the redirect feature is named for it, but any HTTP client can consume the API.
No. The redirect runs on template_redirect only, skips any request with a preview=true or _wp* query parameter, and never touches /wp-admin or /wp-json. Leave the Next.js URL setting blank to disable redirection entirely.
The front end's server sends the login name, password, and the visitor's address to /gallop/v1/members/login with the API key. Gallop checks the password with wp_authenticate(), the function behind wp-login.php, and answers with the member's details; the front end then keeps a session of its own for them. No WordPress cookies are involved, so the front end can be on any domain. A two-factor plugin on the WordPress login screen does not apply to front-end logins. The older /gallop/v1/auth/* routes, which set WordPress's own cookies for a front end on the same registered domain, still work.
Nothing is written to the users table. Gallop keeps the address and names for up to 48 hours and emails a confirmation link to the front end. When the link is opened the front end calls /gallop/v1/members/confirm, and only then is a user created, with the Subscriber role. If the address already had an account, it is marked verified (and subscribed, if that was asked) and the person is told to log in; the link never logs anyone into an existing account. WordPress's "Anyone can register" setting is not consulted: the Manage members permission is the switch.
Yes. A front end that confirms the address its own way skips the two routes above and calls POST /gallop/v1/members/create with email, password, and optionally firstName, lastName and subscribe, once the address is confirmed. Gallop creates the user at once, with the Subscriber role, marked verified, with that password, and answers 201 with the member. It sends no email and keeps nothing waiting. An address that already has an account is answered 409 gallop_member_exists and left as it is. Gallop takes the front end's word that the address was confirmed: only call this after it was.
Every refusal has a code. Where WordPress gave a reason of its own, it is in data.reason. The key: gallop_key_missing (401), gallop_key_invalid (401), gallop_key_forbidden (403, the key lacks Manage members), gallop_https_required (403), gallop_key_rate_limited (429). Logging in: gallop_member_invalid_credentials (401, the same whether the account is missing or the password is wrong), gallop_member_rate_limited (429). The request: gallop_member_invalid_ip (400, login, sign-up and reset requests need the visitor's ip), gallop_member_invalid_email, gallop_member_invalid_name, gallop_member_weak_password (all 400). A link: gallop_member_link_invalid (400, the confirmation or reset link has expired or was already used). A session: gallop_member_session_invalid (401, the member does not exist or sessionVersion is out of date; ask them to log in again). Commenting as a member can be refused with it too. A profile change: gallop_member_wrong_password (403, the current password is needed to change the email or password and was not right), gallop_member_email_taken (409), gallop_member_update_failed (400). Creating an account: gallop_member_exists (409), gallop_member_create_failed (500). The site: gallop_member_front_end_missing (500, the Next.js Production URL is not set, so no email can link to the front end).
Four, all through wp_mail() and all to the member: a confirmation link, a note that an address already has an account, a password reset link, and, if the member asked for it, a message when someone replies to their comment. Every link points at your Next.js production URL. The gallop_member_email filter can change or suppress any of them.
Yes. Five failed attempts per login name + client IP within fifteen minutes return HTTP 429 until the window expires. Successful logins clear the counter. Login, sign-up, and reset requests also answer the same whether or not the account exists, and take the same time, so they cannot be used to find out who has an account.
By default Gallop uses REMOTE_ADDR for the per-IP portion of the login rate limit. If your site sits behind a trusted reverse proxy (Cloudflare, a load balancer, etc.) that overwrites the client-IP headers, enable Trust proxy IP headers on the Gallop settings screen so CF-Connecting-IP / X-Forwarded-For are used instead. Leave it off on direct-served sites — turning it on without a trusted proxy lets attackers spoof those headers to bypass the rate limit. The setting can also be overridden in code via the gallop_trust_forwarded_ip filter.
Published posts of a public type that are not password protected. Anything else, a missing post included, answers the same 404 gallop_comments_post_not_found, so the route cannot be used to find out that a draft exists. The newest 500 comments are returned by default; truncated is true when there are more, and gallop_comments_max raises the ceiling.
