CMSJul 02, 2026 • 9 min read • 18.9k reads
Headless WordPress Done Right: GraphQL + Next.js at 98+ Lighthouse
How DevPortal serves multi-org docs from WordPress without the WordPress slowness — WPGraphQL, ISR, preview, and secure content architecture.
PS
Padam ShankhadevPrincipal Full-Stack Engineer • 10+ yrs production
Why headless WordPress still wins
Editors love WordPress. Users hate slow WordPress. Headless gives you both: familiar authoring, Jamie-fast delivery via static generation.
DevPortal runs WordPress as a private content API (no public theme), WPGraphQL exposes typed content, Next.js pre-renders with ISR every 60s. Preview works via draft tokens without exposing the admin.
Security posture
Lock down wp-admin by IP + SSO, disable REST for anonymous, rate-limit GraphQL by complexity score, and put Cloudflare in front with cache-everything for ISR output. Harden once, sleep well.
verifiedKey takeaways
- arrow_rightWordPress as CMS, never as web server for traffic.
- arrow_rightISR + GraphQL persisted queries = fast + safe.
- arrow_rightPreview tokens bridge authoring and static.
Found this useful? Share it with your team.