Frontend Comments and Visitor Accounts in Hatch

By the end of this guide you will understand how visitors comment on your headless frontend, how optional visitor accounts work, and which WordPress settings control registration.

Comments on the frontend

Hatch adds a small REST endpoint so the Astro frontend can show and post comments without sending visitors to wp-comments-post.php:

• GET /hatch/v1/comments?post=ID returns the approved comments for a post.
• POST /hatch/v1/comments submits a new comment.

Commenting is guest-friendly, just like WordPress by default: name, email and the comment are enough. Submissions are rate-limited per IP address. If you switch on Cloudflare Turnstile, it is checked on the server. New comments follow your normal WordPress moderation settings.

Visitor accounts (Frontend accounts)

Visitor accounts are off by default. While off, Hatch registers no sign-in, sign-up or session route and adds no authentication filter. When you switch on Frontend accounts on the Content tab, these routes appear under hatch/v1:

• POST /auth/login, POST /auth/register, POST /auth/logout, GET /auth/me and POST /auth/refresh.

Sign-in uses WordPress’s own authentication, so login-limit and security plugins still apply. A signed-in visitor gets an HttpOnly hatch_jwt cookie and can comment as themselves. Requests that change data using the cookie must send a valid X-WP-Nonce.

Staff accounts get no frontend session: accounts with staff capabilities sign in at wp-admin, and their tokens are never honoured on the frontend.

Turn on visitor accounts

1. Open Hatch, then the Content tab.
2. Switch on Frontend accounts and save.
3. To allow sign-ups, go to Settings, General and tick Anyone can register. New accounts get the core New User Default Role.
4. Redeploy so the frontend picks up the change.

Protect forms with Turnstile

Turnstile helps keep spam out of comments and sign-ups. See add Turnstile.

What to do next

• Add Cloudflare Turnstile
• Hatch endpoints reference
• Hatch security hardening