443 Monkeys

Port 443 · HTTPS · field notes

Headless WordPress, locked down and shipped.

Hands-on write-ups from building Astro storefronts on WordPress and WooCommerce: Cloudflare, Zero Trust, origin hardening and the outages we caused along the way, so you don't have to.

Latest

Who can reach WordPress, and how: visitors and payment providers only talk to the Astro storefront; the storefront, admins and PhantomWP tools reach WordPress only through Cloudflare; the origin accepts Cloudflare only.

11 November 2026 · 13 min read

Headless Doesn't Mean Hidden: Locking Down the WordPress Behind Your Astro Shop

Going headless moves your visitors off WordPress, not your attack surface. How we put a WooCommerce backend behind Cloudflare Zero Trust, a secret-header WAF rule and an origin lock, without breaking checkout (and the outages that taught us how).

Read the article →