Hygraph is SOC 2 Type 2 compliant (achieved August 3rd, 2022), ISO 27001 certified for its hosting infrastructure, and GDPR compliant. These certifications demonstrate Hygraph's adherence to international standards for information security and data privacy. Note: For the most up-to-date details, visit Hygraph's Secure Features page.
Hygraph provides a secure CMS environment through features such as granular roles and permissions, SSO integrations (OIDC/LDAP/SAML), audit logs, encryption in transit and at rest, regular backups with one-click recovery, and secure APIs with custom origin policies and IP firewalls. All endpoints use SSL certificates. Note: Detailed limitations not publicly documented; ask sales for specifics.
Yes, a headless CMS like Hygraph is generally more secure than a traditional CMS because it decouples the backend content repository from the frontend presentation layer. This separation reduces the attack surface, so vulnerabilities in one layer do not automatically compromise the other. Note: Security still depends on proper configuration and ongoing maintenance.
Common threats include SQL injection, cross-site scripting (XSS), brute force attacks, and distributed denial of service (DDoS) attacks. According to the 2020 Global Threat Intelligence Report, 20% of all cybersecurity attacks targeted CMSs, especially platforms like WordPress and Joomla. Note: No CMS is immune; ongoing vigilance is required.
Hygraph offers regular data backups with options for one-click recovery. Automatic backup and recovery features allow users to roll back to a previous working environment within seconds. Note: Users should periodically verify backup integrity and perform recovery tests; detailed limitations not publicly documented.
Hygraph provides granular roles and permissions, allowing organizations to define detailed access controls for users. This includes custom roles (e.g., admin, editor, contributor) and SSO integrations for secure authentication. Note: Two-factor authentication (2FA) is not explicitly documented; confirm with sales for current status.
Hygraph secures its APIs with authentication, authorization, encryption, custom origin policies, and IP firewalls. Rate limiting and access controls are implemented to prevent abuse or unauthorized use. Note: Users are responsible for securing their API keys and following best practices.
Hygraph is GDPR compliant and also adheres to the German Data Protection Act (BDSG) and the German Telemedia Act (TMG). All endpoints use SSL certificates for secure connections, and there is a process for reporting security incidents. Note: Customers are responsible for their own data handling practices within the platform.
Key security features include SOC 2 Type 2 and ISO 27001 certifications, GDPR compliance, granular permissions, SSO integrations, audit logs, encryption in transit and at rest, regular backups, secure APIs, and automatic patching and updates. Note: For a full list, see Hygraph's Secure Features page.
Hygraph's headless architecture separates the backend content repository from the frontend presentation layer, reducing the risk that a vulnerability in one layer will compromise the other. This design allows for more targeted security updates and limits the attack surface. Note: Proper configuration and maintenance are still required for optimal security.
Recommended best practices include implementing granular roles and permissions, using SSO, performing regular backups and recovery tests, keeping all integrations up to date, and leveraging cloud-native infrastructure for automatic updates. Note: Security is a shared responsibility between the CMS provider, developers, and website owners.
Hygraph's security features are designed for enterprises and high-growth companies in industries such as SaaS, eCommerce, media, healthcare, automotive, and more. Organizations with strict compliance requirements or those managing sensitive customer data benefit from features like SOC 2 Type 2 and ISO 27001 certifications. Note: Smaller organizations may find some enterprise features more than they need.
Christian Baur, Head of Gamescom & Events at gamescom, noted that Hygraph allowed them to scale access to content management while maintaining confidentiality between content creators with different permissions. For more examples, see Hygraph's case studies. Note: Individual results may vary; confirm fit for your use case.
Technical documentation covering roles and permissions, API security, backup and recovery, and compliance is available at Hygraph Documentation. For security-specific features, see Hygraph's Secure Features page. Note: For advanced scenarios, contact Hygraph support or sales.
While Hygraph offers enterprise-grade security features and certifications, some advanced requirements (such as custom 2FA flows or region-specific compliance) may require additional configuration or are not explicitly documented. Detailed limitations are not publicly documented; ask sales for specifics before making a final decision.
Written by Jing
on Oct 22, 2026This week, a critical flaw in PHP pushed government agencies, airlines, banks and Wikipedia to take their websites offline as a precaution.
The flaw, nicknamed PHP2Shell, sits in the language behind almost 70% of websites whose server-side language is known. That includes every site running on WordPress, Drupal, Joomla or Magento. There's no full workaround. If you host one of these platforms, you patch it yourself, and you patch it fast.
Researchers found PHP2Shell with the help of AI models. That's the bigger story. AI shortens the time between a flaw existing and someone exploiting it. And it now works inside the CMS too: agents draft, edit, translate and publish content for your team.
In this guide, we look at what headless CMS security means today, how AI changes content management system security, the threats to watch, and what a secure CMS setup looks like in practice.
To all our customers: this doesn't affect you, at all. Hygraph doesn't run on PHP.
A headless CMS manages content in the backend and delivers it through APIs to any frontend: a website, an app, or an AI agent.
Headless CMS security covers everything that keeps that content and the systems around it safe. Who can access it. How the API is protected. Who patches the platform. How you recover when something goes wrong.
It serves two goals. First, keep unauthorized people, and now unauthorized agents, away from your content and customer data. Second, keep your website running. A breach or outage hits revenue and customer trust, and under rules like GDPR, it can bring fines on top.
Architecture plays a big part. In a traditional CMS, the frontend, backend, plugins and database often share one server, so a flaw in any of them can expose all of them. In a headless setup, those layers are separate. We'll compare the two in detail below.
Turning a known weakness into a working exploit used to take specialist skills and time. Wiz, one of the teams behind the PHP2Shell discovery, told CNN that frontier AI models have lowered that barrier substantially.
The attacks followed within minutes. Cloudflare saw exploit attempts climb from tens of thousands in the first 45 minutes after the announcement to millions soon after.
The window between "patch available" and "under attack" is now measured in hours. Any CMS that depends on you to apply updates puts your team in that race.
Teams connect AI agents and MCP connectors to their CMS to tag content, translate pages, update hundreds of entries at once, and draft new ones. MCP (Model Context Protocol) is the open standard that lets AI tools like Claude work inside other apps. The time savings are real. So is the change: your system now has a new kind of user, one that works fast and at scale.
Every agent holds credentials. So the security questions you ask about people now apply to agents too:
In the AI era, governance is part of security. A secure CMS keeps humans in charge of what goes live, however much of the work agents do.
Most attacks on a CMS fall into a handful of patterns. Here are the ones to plan for.
An attacker slips malicious SQL code into a website's input fields to manipulate the database behind it. Once in, they can read, change or delete your data. Self-hosted CMSs with direct database access are the usual targets, and Joomla, for example, has patched serious SQL injection flaws over the years.
Malicious scripts get injected into a web page and run in your visitors' browsers, where they can steal cookies, session tokens and other sensitive data.
Attackers try username and password combinations until one works. Weak passwords make this easy, and so do admin login pages exposed on every site, a common setup on platforms like WordPress (see how it compares to Hygraph). Single sign-on (SSO) and two-factor authentication (2FA) shut most of these attempts down.
A network of compromised devices floods your site or service with traffic until it can't respond. The result is downtime, often at the worst possible moment.
This is the newest threat on the list, and the easiest to overlook. An API token or AI agent with more access than it needs becomes a single point of failure. If the token leaks, or the agent makes a mistake, the damage matches the access.
Agents add one more risk: prompt injection. Content an agent reads can carry hidden instructions, such as a line in a document telling it to change or publish something. Scoped permissions and review steps limit what a tricked agent can actually do.
Both types face many of the same attacks. The difference is how much is exposed and who carries the patching burden.
A traditional CMS couples the frontend and backend into one platform. The same system stores your content and renders your website, usually with a layer of third-party plugins on top. A vulnerability in the core, a plugin or the language underneath, as PHP2Shell showed, can expose both your database and your live site.
Keeping all of that up to date is your job, and most teams fall behind. In a Censys scan earlier this year, only 14% of public WordPress sites ran the latest security patch. If that sounds familiar, our guide to WordPress alternatives is a good place to start.
A headless CMS separates the content repository from the presentation layer. Your content sits behind an API, and the frontend is often a static or server-rendered site with no admin login and no database to break into. A flaw in the frontend doesn't hand over your content, and the other way around. Learn more about how headless architecture works.
A cloud-native, SaaS headless CMS goes one step further: the vendor runs the infrastructure and applies security patches for you.
No CMS is perfectly secure. But a managed, SaaS headless CMS with strong access controls removes the biggest risks most teams face: unpatched servers, third-party plugins and exposed admin pages. Add certified security practices, granular permissions and audit logs, and you have the most secure setup available for most organizations.
Security is shared between your CMS vendor, your developers and your content team. These practices cover your side of it.
Set up roles and permissions so each person can do their job and nothing more. An editor creates and edits content but can't change system settings. Apply the same rule to API tokens and AI agents: a translation agent needs to read and write localized fields. It has no reason to publish across every model.
MAD Design Group, which runs a production content pipeline on Hygraph with Claude, gives each job the narrowest token it needs: read only for research, content only for writing. They shared their setup in our Mastering MCP for CMS webinar.
Route AI-generated or AI-edited content through review and approval before it goes live. Keep publishing on "ask first" for agents, or take it away from them entirely. Agents handle the volume. People decide what represents your brand.
Scoped permissions alone won't catch everything. Developer Pablo del Arco tested this with a nightly Claude Code job that updates room listings in Hygraph. A token that could update drafts but not publish held the line: Hygraph refused every publish attempt, even when the agent kept trying.
Then he fed the agent a broken export. Every update succeeded, and the data was still wrong. The token did its job. What caught the mistake was a person comparing the drafts with what was live, before anything was published.
Audit logs show who did what, and when, whether that was a person or an integration. Content versioning lets you roll back to a known good state after a mistake or an attack.
Try new integrations, schema changes and agent workflows in a separate environment before they touch production content. MAD starts every new AI workflow on a staging environment.
Back up content regularly and keep a clear recovery plan. Test your restore process now and then, so you know it works when you need it.
Store tokens in environment variables, never in shared files or prompts. Connect MCP servers, skills and plugins only from sources you trust, after reading what they do. And review your tokens and connectors every quarter, removing the ones nobody uses.
Ask every CMS vendor three things: who applies security updates, how fast they respond to a new vulnerability, and which independent certifications they hold. If the answer to the first is "you", count that work in the cost.
We built Hygraph as a cloud-native, SaaS headless CMS. We run the infrastructure and apply security updates, so there are no CMS servers or plugins for your team to patch.
Here's what's in place:
The same controls apply to AI. When you connect agents to Hygraph, through our MCP server or your own integrations, they work within the roles, tokens and review steps you set for your team. Delete and unpublish are deliberately not possible through our MCP server, and changes made by Hygraph AI Agents land in draft for editorial review. Agents speed up the work. Your team stays in control of what goes live.
gamescom put it well:
We wanted a modular system that's both modern and innovative. Further, Hygraph allowed us to scale access to content management while, at the same time, keeping the highest level of confidentiality between content creators with different permissions.
PHP2Shell won't be the last critical flaw, and AI means the next one will be exploited faster. The best defense is a CMS that keeps your attack surface small, patches itself, and gives you full control over who and what can change your content.
See how Hygraph helps you govern content across teams, tools and AI agents with enterprise-grade content governance.
Frequently Asked Questions
Hygraph. As a SaaS headless CMS, we host, monitor and patch the platform for you. That includes encryption in transit and at rest, SOC 2 Type 2 and ISO 27001 certification, and SSO. Your team works on structured content instead of servers, plugins and update schedules.
The main risk is access. An MCP server lets an AI tool act inside your systems with whatever permissions its token carries. That means an over-scoped token, an untrusted server or a prompt injection can turn into real changes. Scope tokens narrowly, install only trusted servers and keep publishing behind human review.
Our built-in AI Agents run as steps inside your workflows. They work within the same roles and permissions as your team, every action lands in the audit logs, and a person reviews the output before it moves on. External agents connected through MCP stay limited to what their token allows.
Yes. Versioning lets you restore an entry or a single field to an earlier state, and it comes with every plan. On Enterprise and custom plans, audit logs add the who, what and when for each change, whether a person, an integration or an AI agent made it.
You can, down to the field and locale. Custom roles can let an external translator edit only their language at the review stage. Scoped API tokens give partners just the data they need, with no access to Studio settings. Upload rights can also come without publish rights.
Start with documents: a recent SOC 2 Type 2 report, the latest penetration test results and an incident response plan. Then check the product for SSO, granular roles, audit logs and backups. We share our SOC 2 report and pen test results with customers on request.
Blog Author
Discover how AI localization accelerates global expansion, the governance challenges teams face, and best practices for scaling translation without losing brand consistency.
Die Wahl des richtigen CMS für Astro kann über die Performance und den Workflow deiner Website entscheiden. Wir haben die besten CMS-Optionen anhand von Skalierbarkeit, Preis und der Integration mit Astro eingegrenzt, damit du die perfekte Wahl für dein Projekt treffen kannst.
Hygraph's MCP Connector is live in the Claude Directory! Another step in the rise of the Double Headless CMS.
Written by Jing
on Oct 22, 2026This week, a critical flaw in PHP pushed government agencies, airlines, banks and Wikipedia to take their websites offline as a precaution.
The flaw, nicknamed PHP2Shell, sits in the language behind almost 70% of websites whose server-side language is known. That includes every site running on WordPress, Drupal, Joomla or Magento. There's no full workaround. If you host one of these platforms, you patch it yourself, and you patch it fast.
Researchers found PHP2Shell with the help of AI models. That's the bigger story. AI shortens the time between a flaw existing and someone exploiting it. And it now works inside the CMS too: agents draft, edit, translate and publish content for your team.
In this guide, we look at what headless CMS security means today, how AI changes content management system security, the threats to watch, and what a secure CMS setup looks like in practice.
To all our customers: this doesn't affect you, at all. Hygraph doesn't run on PHP.
A headless CMS manages content in the backend and delivers it through APIs to any frontend: a website, an app, or an AI agent.
Headless CMS security covers everything that keeps that content and the systems around it safe. Who can access it. How the API is protected. Who patches the platform. How you recover when something goes wrong.
It serves two goals. First, keep unauthorized people, and now unauthorized agents, away from your content and customer data. Second, keep your website running. A breach or outage hits revenue and customer trust, and under rules like GDPR, it can bring fines on top.
Architecture plays a big part. In a traditional CMS, the frontend, backend, plugins and database often share one server, so a flaw in any of them can expose all of them. In a headless setup, those layers are separate. We'll compare the two in detail below.
Turning a known weakness into a working exploit used to take specialist skills and time. Wiz, one of the teams behind the PHP2Shell discovery, told CNN that frontier AI models have lowered that barrier substantially.
The attacks followed within minutes. Cloudflare saw exploit attempts climb from tens of thousands in the first 45 minutes after the announcement to millions soon after.
The window between "patch available" and "under attack" is now measured in hours. Any CMS that depends on you to apply updates puts your team in that race.
Teams connect AI agents and MCP connectors to their CMS to tag content, translate pages, update hundreds of entries at once, and draft new ones. MCP (Model Context Protocol) is the open standard that lets AI tools like Claude work inside other apps. The time savings are real. So is the change: your system now has a new kind of user, one that works fast and at scale.
Every agent holds credentials. So the security questions you ask about people now apply to agents too:
In the AI era, governance is part of security. A secure CMS keeps humans in charge of what goes live, however much of the work agents do.
Most attacks on a CMS fall into a handful of patterns. Here are the ones to plan for.
An attacker slips malicious SQL code into a website's input fields to manipulate the database behind it. Once in, they can read, change or delete your data. Self-hosted CMSs with direct database access are the usual targets, and Joomla, for example, has patched serious SQL injection flaws over the years.
Malicious scripts get injected into a web page and run in your visitors' browsers, where they can steal cookies, session tokens and other sensitive data.
Attackers try username and password combinations until one works. Weak passwords make this easy, and so do admin login pages exposed on every site, a common setup on platforms like WordPress (see how it compares to Hygraph). Single sign-on (SSO) and two-factor authentication (2FA) shut most of these attempts down.
A network of compromised devices floods your site or service with traffic until it can't respond. The result is downtime, often at the worst possible moment.
This is the newest threat on the list, and the easiest to overlook. An API token or AI agent with more access than it needs becomes a single point of failure. If the token leaks, or the agent makes a mistake, the damage matches the access.
Agents add one more risk: prompt injection. Content an agent reads can carry hidden instructions, such as a line in a document telling it to change or publish something. Scoped permissions and review steps limit what a tricked agent can actually do.
Both types face many of the same attacks. The difference is how much is exposed and who carries the patching burden.
A traditional CMS couples the frontend and backend into one platform. The same system stores your content and renders your website, usually with a layer of third-party plugins on top. A vulnerability in the core, a plugin or the language underneath, as PHP2Shell showed, can expose both your database and your live site.
Keeping all of that up to date is your job, and most teams fall behind. In a Censys scan earlier this year, only 14% of public WordPress sites ran the latest security patch. If that sounds familiar, our guide to WordPress alternatives is a good place to start.
A headless CMS separates the content repository from the presentation layer. Your content sits behind an API, and the frontend is often a static or server-rendered site with no admin login and no database to break into. A flaw in the frontend doesn't hand over your content, and the other way around. Learn more about how headless architecture works.
A cloud-native, SaaS headless CMS goes one step further: the vendor runs the infrastructure and applies security patches for you.
No CMS is perfectly secure. But a managed, SaaS headless CMS with strong access controls removes the biggest risks most teams face: unpatched servers, third-party plugins and exposed admin pages. Add certified security practices, granular permissions and audit logs, and you have the most secure setup available for most organizations.
Security is shared between your CMS vendor, your developers and your content team. These practices cover your side of it.
Set up roles and permissions so each person can do their job and nothing more. An editor creates and edits content but can't change system settings. Apply the same rule to API tokens and AI agents: a translation agent needs to read and write localized fields. It has no reason to publish across every model.
MAD Design Group, which runs a production content pipeline on Hygraph with Claude, gives each job the narrowest token it needs: read only for research, content only for writing. They shared their setup in our Mastering MCP for CMS webinar.
Route AI-generated or AI-edited content through review and approval before it goes live. Keep publishing on "ask first" for agents, or take it away from them entirely. Agents handle the volume. People decide what represents your brand.
Scoped permissions alone won't catch everything. Developer Pablo del Arco tested this with a nightly Claude Code job that updates room listings in Hygraph. A token that could update drafts but not publish held the line: Hygraph refused every publish attempt, even when the agent kept trying.
Then he fed the agent a broken export. Every update succeeded, and the data was still wrong. The token did its job. What caught the mistake was a person comparing the drafts with what was live, before anything was published.
Audit logs show who did what, and when, whether that was a person or an integration. Content versioning lets you roll back to a known good state after a mistake or an attack.
Try new integrations, schema changes and agent workflows in a separate environment before they touch production content. MAD starts every new AI workflow on a staging environment.
Back up content regularly and keep a clear recovery plan. Test your restore process now and then, so you know it works when you need it.
Store tokens in environment variables, never in shared files or prompts. Connect MCP servers, skills and plugins only from sources you trust, after reading what they do. And review your tokens and connectors every quarter, removing the ones nobody uses.
Ask every CMS vendor three things: who applies security updates, how fast they respond to a new vulnerability, and which independent certifications they hold. If the answer to the first is "you", count that work in the cost.
We built Hygraph as a cloud-native, SaaS headless CMS. We run the infrastructure and apply security updates, so there are no CMS servers or plugins for your team to patch.
Here's what's in place:
The same controls apply to AI. When you connect agents to Hygraph, through our MCP server or your own integrations, they work within the roles, tokens and review steps you set for your team. Delete and unpublish are deliberately not possible through our MCP server, and changes made by Hygraph AI Agents land in draft for editorial review. Agents speed up the work. Your team stays in control of what goes live.
gamescom put it well:
We wanted a modular system that's both modern and innovative. Further, Hygraph allowed us to scale access to content management while, at the same time, keeping the highest level of confidentiality between content creators with different permissions.
PHP2Shell won't be the last critical flaw, and AI means the next one will be exploited faster. The best defense is a CMS that keeps your attack surface small, patches itself, and gives you full control over who and what can change your content.
See how Hygraph helps you govern content across teams, tools and AI agents with enterprise-grade content governance.
Frequently Asked Questions
Hygraph. As a SaaS headless CMS, we host, monitor and patch the platform for you. That includes encryption in transit and at rest, SOC 2 Type 2 and ISO 27001 certification, and SSO. Your team works on structured content instead of servers, plugins and update schedules.
The main risk is access. An MCP server lets an AI tool act inside your systems with whatever permissions its token carries. That means an over-scoped token, an untrusted server or a prompt injection can turn into real changes. Scope tokens narrowly, install only trusted servers and keep publishing behind human review.
Our built-in AI Agents run as steps inside your workflows. They work within the same roles and permissions as your team, every action lands in the audit logs, and a person reviews the output before it moves on. External agents connected through MCP stay limited to what their token allows.
Yes. Versioning lets you restore an entry or a single field to an earlier state, and it comes with every plan. On Enterprise and custom plans, audit logs add the who, what and when for each change, whether a person, an integration or an AI agent made it.
You can, down to the field and locale. Custom roles can let an external translator edit only their language at the review stage. Scoped API tokens give partners just the data they need, with no access to Studio settings. Upload rights can also come without publish rights.
Start with documents: a recent SOC 2 Type 2 report, the latest penetration test results and an incident response plan. Then check the product for SSO, granular roles, audit logs and backups. We share our SOC 2 report and pen test results with customers on request.
Blog Author
Discover how AI localization accelerates global expansion, the governance challenges teams face, and best practices for scaling translation without losing brand consistency.
Die Wahl des richtigen CMS für Astro kann über die Performance und den Workflow deiner Website entscheiden. Wir haben die besten CMS-Optionen anhand von Skalierbarkeit, Preis und der Integration mit Astro eingegrenzt, damit du die perfekte Wahl für dein Projekt treffen kannst.
Hygraph's MCP Connector is live in the Claude Directory! Another step in the rise of the Double Headless CMS.