
WordPress Site Hacked? What to Do and How to Recover
A practical recovery guide for business owners: confirm the hack, protect visitors, preserve your data and check the site before reopening.
Your developer says the new website should be headless. The proposal mentions Next.js, an API layer and a “decoupled architecture”. You nod along, then quietly wonder whether you’re paying for a better website or just a more complicated one.
Headless WordPress can be the right call. For many business websites, though, it adds cost without solving a real problem. This guide explains what headless WordPress is, when it pays off, what you give up, and which questions to ask before you approve it.
Headless WordPress is a setup where WordPress only stores and manages your content, while a separate application builds the pages your visitors see. The “head” is the frontend. In a headless build, you remove it from WordPress and replace it with something else, usually a JavaScript framework such as React or Next.js.
The two parts talk through an API. WordPress has shipped with a built-in REST API since version 4.7, when the content endpoints were approved for core in 2016. Many headless projects use WPGraphQL instead, a plugin that became a canonical community plugin on WordPress.org in October 2024.
Your editors still log in to the same WordPress dashboard. Your visitors simply never see a page that WordPress built.
On a regular WordPress site, the theme takes content from the database and turns it into the page. Plugins can add things to that page, like a contact form, SEO tags or a cookie banner, because WordPress controls the output.
On a headless site, WordPress stops at the data. Everything a visitor sees is built and maintained by whoever owns the frontend.
| Traditional WordPress | Headless WordPress | |
|---|---|---|
| Who builds the pages | The WordPress theme | A separate frontend app |
| Live preview for editors | Built in | Needs custom work |
| Plugins that change the page | Work out of the box | Need to be rebuilt or integrated |
| Hosting | One system | Two systems |
| Skills you need | WordPress | WordPress and JavaScript |
| Same content in other channels | Possible | Designed for it |

Headless WordPress makes sense when the same content has to power more than one product, or when your frontend needs to do more than a WordPress theme can reasonably handle. In practice, that usually looks like one of these situations:
In every case above, someone is already committed to paying developers who will own the frontend for years. That’s the real entry ticket.
For a company website, a blog, a portfolio or a typical WooCommerce store, traditional WordPress is usually the better choice. It’s cheaper to build, easier for your team to edit, and one system is simpler to keep secure.
Stay with a regular WordPress site if most of these sound familiar:
That last point deserves a closer look. A slow WordPress site is usually a hosting, caching or plugin problem, and those are much cheaper to fix than a new architecture. Start with how many plugins you’re running and, if you sell online, why WooCommerce stores slow down as they grow.
You give up most of what makes WordPress convenient for people who don’t write code: instant previews, plugins that add features to the page, and the simplicity of one system to update.
Not automatically. A headless frontend that serves pre-built pages from a CDN can be very fast. API calls, browser-side rendering and frequent content updates can cancel out those gains, though, and pages that only render in the browser may be harder for search engines to read unless the frontend renders them on the server.
A well-built traditional WordPress site on good hosting, with caching and a sensible number of plugins, is fast enough for most businesses.
Partly. The WordPress dashboard can live on a separate domain that visitors never see, which hides the login page from casual attacks. At the same time, every extra service, API and deployment pipeline is one more thing to protect.
WordPress itself still needs updates, strong passwords and a regular review of who has access. If security is your main concern, read what the data shows about WordPress security before you change the whole architecture.
Yes. Many projects keep a regular WordPress theme for most pages and use the REST API only for the part that needs it. A product configurator, a mobile app that shows the same news, or a custom calculator can read WordPress content while the rest of the site works as usual.
Your team keeps previews and plugins where they edit every day, and you pay for custom frontend work only where it earns its cost.
If these questions have clear answers, headless may be a good fit. If they lead to “we’ll figure it out later”, that’s your answer too.
A headless CMS is any content management system that stores and organizes content and delivers it through an API, without a front end of its own. Headless WordPress is WordPress used that way. Some systems are built only as headless CMSs, such as Contentful, Strapi or Sanity, while WordPress also brings an admin panel editors already know, plugins and a large ecosystem.
It can be, as long as the frontend renders pages on the server or builds them in advance, and the team rebuilds meta tags, sitemaps, redirects and structured data. On a traditional site, an SEO plugin handles most of that for you.
Yes, but the cart, checkout, payments and many WooCommerce extensions need extra development work on the frontend. For a typical online store, that cost rarely pays off.
Usually, yes. You pay for two codebases, two hosting setups and developers who know both WordPress and a JavaScript framework, and that cost continues after launch.
Yes. Content is written and organized in the same WordPress admin. What changes is how that content reaches visitors.
If someone has suggested a headless build for your website, send us the proposal. We’ll go through it with you and tell you which parts your project actually needs.
Your 24wp website is developed by experts from Cubes — an IT company that has been creating complex IT ecosystems and stable web systems for a decade.
Visit cubes.rs