Everything you'd want to know before you install.
A detailed look at how Headless Starter Kit works, why we built it the way we did, and the thinking behind the features above.
Why go headless?
Decoupling the frontend from the WordPress backend buys you performance (green Core Web Vitals thanks to ISR), design flexibility (modern Tailwind and React components), and security (your back-office stays invisible to the public). Headless Starter Kit provides the ready-made bridge — no need to reinvent auth, cart or checkout.
JWT auth, no dependency
The plugin ships its own HS256 implementation — no Composer, no third-party library, no fork of simple-jwt-auth. Short-lived access tokens (60 min by default) and long-lived refresh tokens (30 days), all configurable. Refresh tokens are stored on the Next.js side inside httpOnly cookies encrypted via iron-session.
Cart: pick your mode
JWT mode (default): the full cart is serialised into a signed token returned via the X-DFHSK-Cart header. No database involved, ideal for Vercel edge or multi-instance setups. Server mode: the cart lives in native WC_Session. Essential if you use WooCommerce extensions that hook into the cart (subscriptions, dynamic pricing, etc.).
Checkout: everything WooCommerce still works
The plugin does not re-implement checkout. It creates a real WooCommerce order, fires every usual hook (notifications, stock, taxes, payment gateways) and returns the redirect URL to the gateway. Stripe, PayPal, Mollie, bank transfer, cheque — anything that works on WooCommerce works here.
ISR without the headache
Whenever a product, category, page or order is updated, the plugin POSTs a signed request to /api/revalidate on your Next.js front. You decide in the settings which events to propagate and which paths or tags to revalidate. No stale cache, no cron, no full rebuild.
Next.js starter included, ready to ship
The delivered ZIP contains a complete Next.js 15 (App Router) project: home, listing, ISR product page, cart, checkout, login, register, customer account. Environment variables already filled in with your WordPress URLs and secrets. Vercel zero-config or Hetzner via docker-compose and bash script.
Built-in diagnostics
Diagnostics tab in the WordPress admin: 11 automated checks (WooCommerce active, clean permalinks, REST reachable, HTTPS, GraphQL detected, JWT secret defined, frontend URL set, CORS origins valid, revalidation token, WooCommerce REST keys, cart mode). Green, amber or red to instantly spot what is blocking.
There are no reviews yet.