With a headless CMS, you can’t access the content publishing platform from a CMS database. This means you are less likely to experience a DDoS attack and be rendered offline, or unable to access systems and network resources. Your headless CMS can tightly secure any administrative, or data-holding, areas because it is separate from the display layer of the website. This gives you the ability to even restrict IP access to the CMS.

As an example, a popular method of hacking a website is through SQL injections—but headless combats this by running on a server without SQL or even without being connected to SQL. When building with a headless CMS, nothing about your CMS is a known entity to an external party.

This is in stark contrast to platforms like WordPress, which are consistently attacked with relative ease.

Our Security and reliability checklist

These are some of the key security parameters that we ask partners to think about when selecting a headless CMS partner for their project.

• Does the solution provider give you a detailed overview of how they manage security and reliability?

• Does the solution have security certifications, such as ISO 27001 or those through AWS, showing independent audits of their security practices?

• Do all content solution components meet your current internal security standards?

• What is the promised uptime and how does the solution ensure it?

• Is content replicated between multiple servers and backed up frequently?

• Does the solution have a secure global delivery network to support expansion into global markets?

• What is the process for notifying customers of a security incident?
  

Contentful Site Security

One of our preferred headless CMS partners and arguably the market leader in this space is Contentful.

Working across numerous projects using the Contenful platform, we’ve been impressed by the range of security features and advantages that it offers clients. Below are some of the Contentful security protocols that make up their approach to security processes. This is not
an exhaustive list but it gives you a good sense of how seriously Contentful takes security.

• ISO 27001 compliant data centers

• Data storage and encryption at rest

• Encryption in transit

• Backups

• Annual penetration tests

• Physical security

• Management of access to data

• Security grouping

• Web Application Firewall

• Threat detection

• Data retention policy

• Brute force protection

• Monitoring and reporting
  

If you feel your project requires any further security protocols, we are happy to discuss these and work with you to implement them.