Headless WordPress Hosting (India Guide)

Headless WordPress hosting runs two systems: WordPress as the content backend, serving JSON through the REST API or WPGraphQL, and a separate frontend — usually Next.js — that renders the pages visitors see. Editors keep the familiar admin; the public site is the frontend app.

Teams that only need the WordPress editor and theme can stop at standard WordPress hosting; headless adds a second system to build, host and maintain.

Use the built-in REST API for simple decoupled sites; use WPGraphQL when a page needs many related pieces — menus, custom fields, linked posts — in one request.

When an editor publishes, WordPress calls a secret endpoint on the frontend, which expires the cached content so the next visitor gets the new version — no manual deploy. Without a webhook, timed ISR revalidation works at the cost of a short stale window.

In current Next.js (App Router), tag the WordPress fetch, then expire that tag from a Route Handler. The Next.js documentation says a webhook caller should pass { expire: 0 }, and the old one-argument revalidateTag(tag) form is deprecated.

// fetch in a Server Component
fetch('https://cms.example.in/wp-json/wp/v2/posts', { next: { tags: ['posts'] } })

// app/api/revalidate/route.js
import { revalidateTag } from 'next/cache'
export async function POST(request) {
  if (request.headers.get('x-revalidate-secret') !== process.env.REVALIDATE_SECRET) {
    return Response.json({ revalidated: false }, { status: 401 })
  }
  const { tag } = await request.json()
  revalidateTag(tag, { expire: 0 })
  return Response.json({ revalidated: true })
}

On the WordPress side, a small must-use plugin fires the call when a post is published or unpublished:

add_action('transition_post_status', function ($new, $old, $post) {
  if ($new === 'publish' || $old === 'publish') {
    wp_remote_post('https://www.example.in/api/revalidate', [
      'headers' => ['Content-Type' => 'application/json',
                    'x-revalidate-secret' => WJ_REVALIDATE_SECRET],
      'body'    => wp_json_encode(['tag' => 'posts']),
      'timeout' => 5,
    ]);
  }
}, 10, 3);

Define WJ_REVALIDATE_SECRET in wp-config.php and the same value as REVALIDATE_SECRET in the frontend's environment. Code checked against the Next.js revalidateTag reference, 14 November 2026.