Is WP Ghost Compatible with the AppMySite Plugin?
This tutorial has moved to the new WP Ghost Knowledge Base where each feature is presented in detail.
Yes, WP Ghost is compatible with the AppMySite plugin. AppMySite communicates with your WordPress site through the REST API, so you need to keep the REST API path at its default and not disable REST API access. All other WP Ghost features, including path security, firewall, brute force protection, and 2FA, work alongside AppMySite without conflict.
What to Keep in Mind
AppMySite turns your WordPress site into a mobile app by pulling content, products, and user data through the WordPress REST API. When WP Ghost is active, two settings need to stay at their defaults to keep AppMySite working.
Leave the REST API path unchanged. Go to WP Ghost > Change Paths > API Security and make sure the Custom wp-json Path field is either empty or set to the default wp-json. WP Ghost leaves this at the default in both Safe Mode and Ghost Mode, so if you haven’t manually changed it, no action is needed. If you changed it to a custom path, AppMySite will not be able to connect because it expects the standard /wp-json/ endpoint.
Do not disable REST API access. In the same API Security section, make sure Disable REST API Access is switched OFF. AppMySite needs unrestricted REST API access to fetch content and handle user authentication for the mobile app.
Every other WP Ghost feature works normally with AppMySite. You can change the admin path, hide the login page, enable the firewall, activate brute force protection, add 2FA, hide plugin and theme names, and use all hardening options. These do not affect AppMySite’s REST API communication. For the full REST API configuration guide, see the Change REST API Path tutorial.
Troubleshooting
If AppMySite cannot connect to your site after activating WP Ghost, check these settings in order. First, verify the REST API path is at the default wp-json in WP Ghost > Change Paths > API Security. Second, confirm that Disable REST API Access is switched off. Third, check that security headers in WP Ghost > Firewall > Header Security are not blocking AppMySite’s requests. If you are still having issues, temporarily revert the REST API path to default and test the connection. If it works with the default path, the issue was the path configuration.
Frequently Asked Questions
Can I hide plugin names and still use AppMySite?
Yes. Hiding plugin names and changing the plugins path only affects how plugin files are served through URLs. AppMySite communicates through the REST API, which is a separate endpoint. Plugin name hiding does not interfere with REST API responses.
Does AppMySite need XML-RPC enabled?
No. AppMySite uses the REST API, not XML-RPC. You can safely disable XML-RPC in WP Ghost without affecting AppMySite. See the Disable XML-RPC tutorial.
Will WP Ghost’s firewall block AppMySite requests?
Not by default. The 7G/8G firewall targets malicious request patterns, not legitimate REST API traffic. If you experience issues, you can whitelist AppMySite’s IP addresses in WP Ghost > Firewall > Whitelist.
Does WP Ghost modify WordPress core files?
No. WP Ghost uses rewrite rules and WordPress filters. No core files are modified. Deactivating WP Ghost restores all default paths, including the REST API endpoint AppMySite uses.