Hatch glossary: headless, Worker, Astro, REST and more
Plain definitions of terms used in the Hatch docs: headless, Astro, Cloudflare Worker, API token, Turnstile, REST API, Application Password and hatch/v1.
Last updated October 29, 2026
Plain definitions of the terms used across the Hatch Connect docs, in alphabetical order within each group.
Architecture
Astro
A web framework for building websites. The frontend Hatch deploys is an Astro project. See the Astro docs.
Back office
The place you write and manage content. With Hatch, that stays WordPress (wp-admin).
Frontend
The website your visitors see. With Hatch, it runs as a Cloudflare Worker.
Headless
The part visitors see and the part you write in are separate. WordPress keeps the content; a separate frontend shows it. See headless WordPress vs a traditional theme.
Theme
The templates WordPress uses to render pages itself. Hatch does not install, bundle, switch or remove any theme.
Cloudflare
Cloudflare API token
A long password created in your Cloudflare account that lets Hatch upload your frontend with only the permissions you tick. Stored encrypted and never shown again.
Route
A rule that sends requests for a domain or path to a Worker. Needed when you use your own domain instead of workers.dev.
Turnstile
Cloudflare’s spam protection for forms. In Hatch it is optional and can protect forms, comments and the login page. See the Turnstile docs.
Worker
A small program that runs on Cloudflare’s network. Hatch uses one to serve your frontend. See the Workers docs.
Worker secret
An encrypted value stored with a Worker. Hatch sets three: the frontend account user name, its Application Password and the cache-refresh secret.
workers.dev
The free address Cloudflare gives Workers. You can use your own domain instead.
Zone
A domain added to your Cloudflare account. Custom-domain deploys need Zone Read permission.
WordPress
Application Password
A separate password for API access tied to a WordPress user. Hatch’s frontend uses one from a Subscriber account you create. See Application Passwords explained.
hatch/v1
The REST address under which Hatch shares posts, pages, menus, search data, custom post types and block output. See the hatch/v1 REST bridge.
Permalinks
The link format of your posts. Plain permalinks stop the frontend reading posts; the setup guide can switch to /%postname%/ if you tick the box.
REST API
The standard way WordPress shares data with apps over HTTP. See the REST API Handbook.
Subscriber
The lowest standard WordPress role. Hatch requires a low-privilege account like this for the frontend.
XML-RPC
An older WordPress remote interface at xmlrpc.php. Hatch can close it. See how to disable XML-RPC.
Hatch features
Cache refresh
When you publish or update content, Hatch tells the frontend to show the change, using a secret sent in a request header.
Connection check
A screen showing whether your frontend is answering, when it last refreshed and what needs attention. A scheduled check runs every 15 minutes once a frontend address is saved.
Disconnect
Turns off the redirect and forgets the saved token and frontend account password. The Worker stays in Cloudflare until you delete it.
Frontend accounts
Optional visitor sign-in (and registration when “Anyone can register” is on). Off by default; uses signed tokens valid for 24 hours.
Setup guide
The wizard that opens after activation and walks through the token, address and Deploy.
FAQ
Is Astro required to use the REST API?
No. The hatch/v1 API works with any frontend you build.
Is Turnstile required?
No. It is off until you turn it on and enter your Turnstile keys.