Security

Locking things down, and everything that broke while I did.

Who can reach WordPress, and how: visitors and payment providers only talk to the Astro storefront; the storefront, admins and PhantomWP tools reach WordPress only through Cloudflare; the origin accepts Cloudflare only.

11 November 2026 · 14 min read 0bananas

Headless WordPress is not hidden WordPress

Moving shoppers to a separate storefront leaves the content system behind it as exposed as ever. Locking it down without breaking checkout took four outages and a clearer view of who, and what, actually needs access.

Read the article →