What you learn
by building it.
Notes and answers to the questions that come up when you actually build a headless WordPress — the things that don’t fit in the guide but are worth knowing.
What is Local, and how do I get WordPress running on my computer?
Before you upload anything to a host, you need a WordPress to tinker with. The easiest option is Local (by WP Engine/Flywheel): a free desktop app that spins up a complete WordPress —server, PHP and database— on your own computer, with absolutely nothing to configure. Where to get it: at localwp.com. There are versions for Mac, Windows and Linux. Why it works […]
How do I keep my headless WordPress out of Google?
When you build a headless WordPress, the CMS still has its front end: if someone visits its domain, they see near-empty pages. We don’t want that, and we don’t want Google indexing them either. 1. Redirect the whole front end to the real one With a must-use plugin, on the template_redirect hook (which touches neither […]
Can I send emails from WordPress without external services?
The short answer: yes. WordPress ships with wp_mail() and sends emails without any external service: wp_mail( $to, $subject, $html, array( 'Content-Type: text/html; charset=UTF-8', ) ); The problem: deliverability From shared hosting, those emails usually lack aligned SPF/DKIM and end up in the spam folder (or bounce outright). For the odd notification to your own inbox […]
What is Cloudflare Turnstile, and how do I protect a form from bots?
Cloudflare Turnstile is the alternative to reCAPTCHA: it checks there’s a real person behind the screen without annoying puzzles (it’s usually invisible, or a simple check). And it’s free. How it works It gives you two keys: a Site Key (public, goes in the front end) and a Secret Key (private, goes on your server). […]
How do I hide the wp-admin login path?
One of the first places bots go after is /wp-login.php. Swapping that path for a secret one cuts almost all of that noise. Without relying on external plugins With a must-use plugin you can serve the login on a secret path, and block direct access to wp-login.php and wp-admin for anyone who isn’t logged in […]
Which subdomain should I put the WordPress on for a headless site?
The convention is clear: your front end (Astro) lives on the root domain (yourdomain.com) and the WordPress on a subdomain like cms.yourdomain.com, which only you use to edit. And the nameservers? Here’s the usual mix-up: where your nameservers sit doesn’t tie down where your hosting lives. You can manage DNS wherever you like (your registrar, […]