Skip to content

Hatch v0.7.6.1 — headless WordPress that actually ships

Latest

Choose a tag to compare

@adityaarsharma adityaarsharma released this 13 Aug 12:49
· 5 commits to main since this release

First public post-alpha cut of Hatch. Every route on the CF Worker + WP admin has been walked end-to-end.

What ships

Forms. WPForms + Fluent Forms both render on the Astro frontend and submissions land in a Hatch-owned wp_hatch_form_submissions table (WPForms Lite has no entry->add() — this closes that gap for every provider). Full-width inputs, roomy spacing, single "Sent." confirmation.

SEO bridge. RankMath meta description, og:image, og:title, twitter card all flow from WordPress into the Astro <head> — with Yoast + WP core as fallbacks. Attachment IDs resolve to full URLs. Adds hatch_seo REST field for third-party consumers.

Cloudflare deploy wizard. Honours Root vs Subfolder end-to-end: Worker source, route pattern (/* vs /blog/*), dashboard label. Direct-upload path now allows same-origin /img?url=<self> (SSRF allowlist self-fetch) — fixes broken image thumbnails on every Worker deploy.

Media rewriter. hatch-url-rewrite mu-plugin auto-installs on activation and self-heals on admin_init — no operator step. Emitted URLs always match the deployed frontend host (works on tunnel, workers.dev, or a real domain).

WooCommerce. COD checkout end-to-end verified (guest email persists to WP order). Cart qty=0 routes to remove-item. Explicit per-line Remove button.

Comments. Guest posts land as pending without login. Renders on all five per-theme Single components (Blog / Tech / Docs / AstroPaper / AstroWind / AstroNano).

Themes. Blog / Tech / Docs primary CTAs hit WCAG AAA (15-17:1 contrast). Tech dark-mode comment visibility fixed. Docs skips reading features (progress bar, TOC) that only belong on the Blog theme.

Security. Order-lookup gets per-IP transient rate limit (10 req / 60s, 429 on burst). SSH cred plaintext fallback removed. TOFU host-key pinning. Same-origin allowlist for /img proxy.

Ops. Uninstall.php cleans every namespaced option. Broker honours hatch_wp_public_url override so a dev's local WP behind a tunnel builds correctly on Cloudflare edge.

Upgrade

Drop-in from any 0.7.x. Fresh installs run the 3-step wizard (Welcome → Theme → Deploy).

Requires PHP 7.4+, WordPress 6.2+.

Full changelog

See CHANGELOG.md — this release rolls up 25+ commits since v0.3.15.