WordPress offers two ways to handle AJAX requests: the traditional admin-ajax.php and the modern REST API. Both allow you to send and receive data without reloading the page, but they have different performance characteristics, security models, and use cases.
This guide covers the differences between admin-ajax and the REST API, and when to use each approach in your plugins and themes.
How admin-ajax.php Works
admin-ajax.php is WordPress’s original AJAX handler. It loads the full WordPress environment — plugins, theme, database connections — for every request, even if the AJAX function only needs to do something simple like update a single option. This has led to a performance reputation that’s well-deserved: admin-ajax.php is slow because it loads the entire WordPress stack.
To use admin-ajax, create a JavaScript file that sends a POST request to /wp-admin/admin-ajax.php with an ‘action’ parameter. Add a PHP handler function and register it with wp_ajax_{action} for logged-in users and wp_ajax_nopriv_{action} for guests.
How the REST API Handles Requests
The WordPress REST API handles requests more efficiently than admin-ajax. REST endpoints only load the parts of WordPress needed for the specific request. The REST API also uses standard HTTP methods (GET, POST, PUT, DELETE) and returns structured JSON responses, making it more intuitive for modern frontend development.
Register a custom REST endpoint with register_rest_route(). Define the route, HTTP methods, permission callbacks, and handler function. The REST API handles data formatting, response headers, and error responses automatically.
When to Use admin-ajax.php
admin-ajax.php is still the right choice for admin-side AJAX requests — operations that happen within the WordPress admin interface. These requests are made by logged-in users with admin privileges, so the performance penalty is less of a concern. admin-ajax is also simpler for trivial operations that don’t need the structure of a full REST API endpoint.
Use admin-ajax for: admin settings page interactions, quick edit operations, and dashboard widget updates.
When to Use the REST API
The REST API is the better choice for frontend AJAX requests made by visitors. It’s faster, more scalable, and follows modern web development conventions. Use the REST API for: loading more posts on scroll, submitting contact forms, updating cart quantities in WooCommerce, and any AJAX operation that could be called frequently.
The REST API also enables headless WordPress setups, mobile app integrations, and third-party API access — capabilities that admin-ajax doesn’t support.
Security Considerations
Both AJAX methods require proper security. For admin-ajax, use nonces with wp_create_nonce() and verify them with check_ajax_referer(). For the REST API, use WordPress’s built-in permission callbacks and nonce verification through the X-WP-Nonce header. Never trust user input in either method — sanitize and validate all data received from AJAX requests.
Log failed AJAX attempts. Brute force attacks often target AJAX endpoints because they bypass the normal login page.
The Bottom Line
For new plugin development, use the REST API by default. It’s faster, more secure, and more aligned with modern web development practices than admin-ajax.php. Use admin-ajax only for admin-side operations that don’t need the REST API’s structure. Both approaches are fully supported, but the REST API is the recommended path forward for WordPress AJAX functionality.