WP Toon
Mirror selected WordPress REST endpoints under a new `/wp-toon/*` prefix and return their payloads in **TOON** (Text-Oriented Object Notation).
by Gerard Cuadras · github.com/gerardcuadras/wp-toon · website
★ 0stars
0forks
Install
No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:
wp plugin install https://github.com/gerardcuadras/wp-toon/archive/refs/heads/master.zipMirror selected WordPress REST endpoints under a new /wp-toon/* prefix and return their payloads in TOON (Text-Oriented Object Notation). TOON keeps the same structure as JSON but removes redundant characters so AI pipelines consume fewer tokens without touching your WordPress content model.
Features
- Drop-in alias for any whitelisted endpoint: keep
https://example.com/wp-json/wp/v2/postsfor JSON, addhttps://example.com/wp-toon/wp/v2/posts(orwp-json/toon/v1/...) for TOON. - Uses the official
php-toonencoder under the hood and exposes savings via response headers (X-WP-Toon-*) and optional debug logs. - Whitelist-based proxy ensures only approved routes are mirrored; defaults cover core post/page endpoints and can be extended via filters.
- No schema changes: the plugin simply replays the original REST request inside WordPress and converts the successful JSON body to TOON before streaming it back as
text/plain.
Security Model
- Authentication & permissions: the proxy never bypasses WordPress checks. Requests hit the WP REST API stack exactly once, so the same rules apply:
- Logged-in users rely on cookies +
X-WP-Nonce. - Application Passwords keep working (Basic Auth processed before our proxy runs).
- OAuth/JWT plugins remain in charge if the site already uses them.
- Logged-in users rely on cookies +
- Authorization:
rest_do_request()executes the original endpoint, so if the upstream route returns401/403, the TOON mirror returns that error untouched. - Attack surface: no new roles, caps, or custom auth handlers. The whitelist (
includes/Whitelist.php) restricts which routes are exposable; anything not explicitly approved returns403. - Transport: responses are emitted as plain text with the same HTTP headers (cache-control, pagination, etc.) except for
Content-Type, which becomestext/plain; charset=utf-8.
Installation
- Download the latest release ZIP (or clone the repo) and upload the entire folder to
wp-content/plugins/wp-toon/. - Activate “WP Toon” in
Plugins → Installed Plugins. - Visit
Settings → Permalinksand click “Save” once to flush rewrite rules (or deactivate/activate the plugin) so/wp-toon/*becomes available.
Requirements: PHP 8.1+, WordPress 6.0+.
Usage
JSON → https://example.com/wp-json/wp/v2/posts?per_page=5
TOON → https://example.com/wp-toon/wp/v2/posts?per_page=5
Alt. → https://example.com/wp-json/toon/v1/wp/v2/posts?per_page=5
- Query parameters, methods, and pagination behave exactly the same as the upstream endpoint.
- Successful responses include:
X-WP-Toon-JSON-BytesX-WP-Toon-TOON-BytesX-WP-Toon-Savings-Percent
- Enable
WP_DEBUG(or thewp_toon_enable_loggingfilter) to log the same metrics towp-content/debug.log.
Configuration
| Filter | Purpose |
|---|---|
wp_toon_allowed_routes |
Return the list of REST routes that may be mirrored (e.g. add custom post types or remove low-value endpoints). |
wp_toon_encode_options |
Override the TOON EncodeOptions before encoding each payload. |
wp_toon_enable_logging |
Toggle token-savings logs (defaults to WP_DEBUG). |
wp_toon_endpoint_slug |
Change the pretty permalink base (wp-toon → ai-api, etc.). |