by
cccode
0 (0 reviews)
Routemark
Browse every REST API route on your site and send test requests to it from wp-admin.
Routemark ranks #70,033 among WordPress.org plugins with 0+ active installations, is #4,499 of 5,310 in the Utilities & Tools category, and was last updated Oct 30, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1.4
v0.4.1
Current Version v0.4.1
Updated 2 days ago
Last Update on 30 Oct, 2026
Refreshed 2 days ago
Last Refreshed on
#4,499 of 5,310 in Utilities & Tools
Actively maintained
Rank
#70,033
—
No change
Active Installs
0+
—
No change
KW Avg Position
N/A
—
No change
Downloads
43
+63 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 10
0+
10+
42,465
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 10 more installs to reach 10+
Rank Changes
Current
#70,033
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 0.4.1
- Last Updated
- Oct 30, 2026
- Requires WP
- 6.6+
- Tested Up To
- 7.1.4
- PHP Version
- 7.4 or higher
- Author
- cccode
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,757
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,015
Elementor Website Builder – more than just a page builder
10M+ installs
#1
Contact Form 7
10M+ installs
#3
All-in-One WP Migration and Backup
5M+ installs
#10
UpdraftPlus: WP Backup & Migration Plugin
4M+ installs
#14
WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager
3M+ installs
#19
Hostinger Tools
3M+ installs
#20
WordPress Importer
2M+ installs
#23
WPS Hide Login
2M+ installs
#27
Frequently Asked Questions
Common questions about Routemark
Yes. It reads the same route list WordPress uses to answer requests, so anything a plugin or theme registers on rest_api_init shows up, with the plugin's name next to it. The name is worked out from where the route's callback is defined, so a route registered from a custom or must-use plugin is labelled with that file or folder. The one catch is routes a plugin only registers in some situations (say, only on the front end, or only for certain users). Routemark sees what's registered when it asks, which is an admin REST request.
No. It reads the route table WordPress already has and adds a few endpoints of its own under routemark/v1, which only admins can call. Requests you send from the Routemark page carry two extra things: a header asking for the server numbers (query count, PHP time, memory), and, if you picked someone under "Send as", the user to run it as. Both are only honored for administrators. Nothing changes for requests from anywhere else.
When you pick someone under "Send as", Routemark adds two headers to that one request: the user ID and a nonce that belongs to you. On the server, after WordPress has checked your login as usual, Routemark checks the nonce and that you're allowed to switch, then runs the request as that user. As soon as the response is ready it switches back to you. Nothing is saved, no cookies change, and you stay logged in as yourself. You need manage_options, plus permission to edit the user you pick (edit_user). On multisite that means a site admin can't send requests as a super admin. Logged out is always available to admins. Requests sent as someone else are still real. If you send a POST as an editor, the post is created by that editor. After a reload you're always back to sending as yourself.
Its permission callback is __return_true. That's normal for things like oEmbed and the API index. If you see one of your own endpoints there and didn't mean it, that's worth fixing. If it says "No permission check" instead, the route was registered without a permission_callback at all. WordPress logs a notice about that, but still runs it for anyone.
For routes from core's post, term, user and comment controllers (and plugins that extend them), every callback on the per-object hooks, like rest_prepare_post or rest_pre_insert_product. For every route, the callbacks on the hooks that run on all REST requests, like rest_pre_dispatch and rest_post_dispatch. Each one shows its priority, the function or class method, and the plugin or theme it lives in. WordPress core and Routemark's own callbacks are hidden unless you switch them on. It lists what's registered when you open the tab. A plugin that only adds a filter partway through a request won't show up.
When you press Send, Routemark asks your site to measure the request. Counting starts when WordPress begins handling it and stops when the response is ready, so it covers the permission check, the callback and every filter, but not _embed. Hover over the numbers to see the totals for the whole request, including loading WordPress itself. Only administrators get these numbers, and only for requests sent from the Routemark page.
Only how each route was registered. It doesn't send any requests. High: a route with no permission_callback that changes data, or one that changes data and uses __return_true. Medium: a read-only route with no permission_callback, or arguments with no type, validate_callback or sanitize_callback on a route that changes data or is public. Low: the same unchecked arguments on other routes, and routes with no schema. It can't tell what a permission callback actually allows, only that there is one. For that, open the route and try it with "Send as". WordPress core is left out by default, there's a switch to include it. It says "rest_forbidden" for some routes Check who you're sending as. Unless you picked someone under "Send as", you get the same answer your own account would get from any other client. Some endpoints need a specific capability, and some (like application passwords) need a different auth method entirely.
Yes. There are PHP hooks (routemark_loaded, routemark_app_data, routemark_enqueue_assets, routemark_menu_title) and JavaScript filters through wp.hooks for adding panels, workspace tabs, response actions, code languages and Report findings. A broken add-on can't take Routemark down with it. The details and an example add-on are on GitHub.
Yes, Routemark Pro: rules that lock down or rate-limit routes without editing the plugin that added them, API tests that run on a schedule or after updates, a log of the REST traffic your site gets, snapshots with a diff of what each plugin update changed and alerts by email, Slack or webhook, a public API docs page, WP-CLI commands, and export to OpenAPI, Postman and TypeScript. It's a separate plugin that adds to this one. Nothing in this plugin is locked or limited, and it doesn't advertise beyond a link on the Plugins screen and a card at the bottom of Settings. Get Routemark Pro: https://checkout.freemius.com/plugin/42850/plan/74584/
