Field notes on headless WordPress, WooCommerce, Astro and Cloudflare.http://localhost:4321/http://localhost:4321/blog/headless-wordpress-security/http://localhost:4321/blog/headless-wordpress-security/Going headless moves your visitors off WordPress, not your attack surface. How we put a WooCommerce backend behind Cloudflare Zero Trust, a secret-header WAF rule and an origin lock, without breaking checkout (and the outages that taught us how).Wed, 11 Nov 2026 00:00:00 GMTWordPressCloudflareSecurityAstroWooCommercePhantomWP