Hatch Hooks and Filters for Developers
Developer reference for the PHP filters Hatch Connect exposes, from revalidated post types and form limits to content HTML and the Cloudflare API root.
Last updated October 29, 2026
By the end of this page you will know the hatch_* filters Hatch Connect applies and where they hook in, so you can adjust behaviour from a small plugin or your theme’s functions file.
Filters
hatch_revalidate_post_typesthe post types that trigger a frontend refresh. Default: post and page.hatch_content_htmlthe content HTML Hatch sends to the frontend.hatch_form_rate_limitrate limit for headless form submissions. Default: 10.hatch_form_max_body_bytesmaximum size of a form submission body. Default: 64 KB.hatch_form_retention_dayshow long stored form submissions are kept. Default: 90 days.hatch_turnstile_fail_openwhether a Turnstile check may pass when Turnstile cannot be verified. Default: true.hatch_plugin_bridge_catalogthe catalog of plugin bridges Hatch knows about.hatch_seo_internal_urlinternal URLs in SEO output.hatch_sync_wp_layoutwhether Hatch pins its content width on your theme’s containers. Default: off (set by thehatch_sync_wp_layoutoption).hatch_url_rewriter_neededwhether the URL rewriter is needed.hatch_diagnostic_include_webhook_checkwhether the diagnostic includes the webhook check. Default: off.hatch_deploy_providersthe list of deploy providers.hatch_cloudflare_api_rootthe Cloudflare API base URL. Default:https://api.cloudflare.com/client/v4.hatch_dynamic_block_namesthe block names treated as dynamic when Hatch serialises a post’s blocks. Add names for blocks that render on the server.
Example: refresh a custom post type
- Create a small plugin or open your child theme’s
functions.php. - Add the filter below.
- Publish a product and check the Status tab for the refresh time.
add_filter( 'hatch_revalidate_post_types', function ( $types ) {
$types[] = 'product';
return $types;
} );
WordPress core hooks Hatch respects
Frontend sign-up runs WordPress’s own register_post, registration_errors, illegal_user_logins and register_new_user hooks, and sign-in fires wp_login, so security plugins keep working.