Claude CMS Help Centre

Installing Claude CMS

Upload the files, set up a database, and grab the connection details. The whole process takes just a few minutes.

1. Upload the files

Upload the directory sent to you by email to your web server root, into a folder called /claude.

2. Choose a database

The installer creates one for you — the built-in database, recommended, with nothing to set up. If you would rather use MySQL, create a database in your hosting panel first and have its name, user and password ready for the next step.

3. Grab the output

When the installer finishes it shows you the connection details. Copy these — you'll need them to connect Claude in the next topic.

Connecting to Claude

Once the files are live, link your site to Claude and confirm everything's running.

1. Add the connector to Claude

In Claude, open Settings → Connectors → Add custom connector. Enter the connector URL https://claudecms.com/mcp, then sign in with the details provided in your welcome email.

2. Enable permissions

Click Configure and enable all permissions so Claude can fully manage your site.

3. Check it's working

Open a new chat, enable the connector, and prompt "list sites" to check everything is running smoothly.

Refreshing the connector

When Claude CMS adds new tools, Claude won't see them until you refresh the connector. It takes a few seconds.

1. Open the connector

In Claude, open Settings → Connectors and click Claude CMS.

2. Refresh the tools list

Click the ⋮ menu next to Disconnect and choose Refresh tools list. Any new tools appear in the list.

3. Allow all permissions

New tools start out needing approval. Set the tool permissions dropdown to Always allow so Claude can use them without stopping to ask.

4. Start a new chat

Chats that are already open keep the old tools list, so open a new chat and carry on from there.

Connecting to ChatGPT

Prefer ChatGPT? You can manage your site from there too. ChatGPT Plus or higher is required, and the whole setup takes about a minute.

1. Turn on Developer mode

In ChatGPT, open Settings → Apps → Advanced settings and switch on Developer mode. This is what lets ChatGPT add a custom connector. ChatGPT shows a risk note — that is expected, because you are connecting your own site.

2. Add the connector

On the Apps screen, click Create app. Give it a name, paste the connection URL https://claudecms.com/mcp, set Authentication to OAuth, tick the confirmation box, and click Create.

3. Sign in

Click Sign in, log in with the username and password from your welcome email, and approve access. Your site is now connected.

4. Check it is working

Open a new chat, use the + menu to enable your app, then prompt "list sites" to confirm everything is running.

Setting up your store

Six steps from a new store to one that is ready to sell. Most take a few minutes.

1. Add your business details

Fill in your Business Details: your business name, address and contact details. Your store uses them in its page titles and in the structured data search engines read, so completing them helps your store get found.

2. Add some products

Add your products on the Products tab. Not ready yet? You can add a collection of temporary demo products to see your store working, and remove them when your real ones go in.

3. Add your payment provider

Connect your payment provider on the secure Connections tab of your account.

Never paste keys or passwords into Claude. Added on the Connections tab they are stored encrypted, and no trace of your connection details is left in your chats.

4. Set up shipping

Select Your Store → Shipping. Administer it there, or press the Claude notes link at the top of that page to copy its details, paste them into Claude and configure shipping from the chat instead.

In brief, the phases are:

• Zones — a country or group of countries with its own delivery rates. The quick setups create your home country, your nearest markets and the rest of the world in one press each, with starting prices you can change.
• Rates — each zone needs at least one: a name, a price, an optional weight band and a free-over threshold. A customer in a country with no rate cannot check out.
• Warehouses and drop-shippers — every place your stock sits, whether you hold it yourself or a drop-shipper holds it and ships for you. Sales come off your default location, and deliveries, counts and moves live under Manage stock.
• Shipping classes — optional. Every product starts as Standard; add Bulky, Fragile or similar and a rate can be limited to the classes it serves.
• Other — the same-day cutoff time, processing time in working days, and a fallback weight and tariff code for products that have none of their own.

Use a shipping platform such as Veeqo or ShipStation? Connect it on the Connections tab and orders can be pushed to it. This area will keep developing.

5. Add your email provider

On the Connections tab, connect the email account you want your store to send from.

6. Make the design yours

Ask Claude to change the design however you like: colours, fonts, layout, the banner on your home page. For example:

Google Shopping

List your products on Google with a feed we build for you, after a check that catches what gets stores rejected. Google reviews a new store once; a rejected store can wait weeks for a second look, so the feed stays locked until nothing red is left.

1. Fill in the product details Google needs

On each product in Your Store → Products: the condition (new, refurbished or used), a Google product category if you know it, and the barcode (GTIN) or manufacturer part number on each variant. A product with neither is submitted as having no identifier, which is right for handmade or custom goods.

2. Make the business visible

Under Business Details give the legal name, address, phone and one contact email, and show the same name and address on your site’s legal and contact pages. Replace the template’s shipping & returns and legal pages with your own terms, with delivery costs that match your shipping rates and a clear returns window. Identity that differs between your site, Merchant Center, Google Ads and the payments profile is what Google calls misrepresentation.

3. Run the check

Open Your Store → Google Shopping and press Run the check. It reads your pages the way Google would and lists everything red (must fix), amber (worth fixing) and green, each with a link to the place to fix it. Run it again until nothing red is left.

4. Switch the feed on and copy its address

When nothing is red the feed address appears. Switch the feed on and copy the address. Keep it private: anyone who has it can read your catalogue.

5. Add it in Merchant Center

In Google Merchant Center go to Products → Add products → Add products from a file → Scheduled fetch, paste the address and set it to fetch daily. Set shipping and tax under Settings in Merchant Center rather than per product.

6. Before you request a review

Complete advertiser verification in Google Ads, make sure the Merchant Center business information and the Ads payments profile carry the same legal name and address as your site, and never request a Merchant Center review while a linked Ads account is suspended. We check your feed again every night; if something turns red the feed pauses and you get an email.

SMTP — best delivery

Send from your own address through the email provider you already use: Microsoft 365, Zoho, Fastmail, iCloud, your web host’s mail server or any other SMTP service. Email sent through your own provider is the most likely to reach the inbox.

1. Open the SMTP connection

Go to the Connections tab of your Claude CMS account, type SMTP in the filter box and open SMTP email.

2. Enter your details

Choose your provider and check the server, port and security settings, then enter your username (usually your email address) and password, and the address and name your emails should come from.

If your email account uses two-step sign-in, create an app password with your provider and use that instead of your normal password.

3. Save

Saving signs in to your mail server to check the details, which are stored encrypted.

Never paste your email password into Claude. Entered on the Connections tab, no trace of it is left in your chats.

Email sent by your site’s own code

If your site sends email itself, for example a contact form that emails you, inboxes check your domain’s DNS before they trust it. Add these records with your DNS provider so the emails don’t land in spam. For the best delivery, connect SMTP or Google email instead.

1. Send from your own domain

Use an address on your domain as the sender, for example noreply@yourdomain.com. The records below vouch for that domain only.

2. SPF: who may send for your domain

Add a TXT record on @ (your bare domain):

80.190.81.218 is the Claude CMS hosting server. If you host the site yourself, put your own server’s address there instead (your host can tell you it). A domain can only have one SPF record: if you already have one (Google Workspace adds include:_spf.google.com, for example), add ip4:80.190.81.218 to it rather than creating a second.

3. DKIM: a signature on every email

DKIM lets inboxes check that an email wasn’t changed on the way. The record is unique to your domain: for sites we host, raise a ticket and we’ll send you the TXT record to add on default._domainkey. If you host the site yourself, your host provides it.

4. DMARC: what to do with failures

Add a TXT record on _dmarc, with your own address for the reports:

Start with p=none, which only reports. Once your emails pass, change it to p=quarantine.

5. Check it worked

DNS changes usually show within an hour (allow up to 48). Send a test email to a Gmail address, open it, choose ⋮ → Show original, and look for PASS next to SPF, DKIM and DMARC.

Connecting a custom domain

Point any domain you already own at your Claude CMS site by updating two records at your registrar — no code, no file changes.

1. Find your target

If you're on managed hosting, your welcome email includes the IP address (or hostname) to point your domain at. Self-hosting? Use the IP address already shown in your own host's control panel.

2. Update your DNS records

Log in to your domain registrar (GoDaddy, Namecheap, Cloudflare, 123-Reg, IONOS, etc.) and open DNS management. Add an A record for the root domain (host @) pointing at your server's IP, and a CNAME for www pointing at the root domain.

3. Wait for propagation

Changes usually take effect within the hour, though DNS can take up to 48 hours to fully propagate worldwide. Avoid making further DNS changes while you wait.

4. Switch the site over

Once the domain resolves, get in touch and we'll issue the SSL certificate and switch the site's base URL — this touches protected server files Claude can't edit itself. Everything content-side (canonical tags, sitemap, internal links) Claude updates for you by prompt.

Full walkthrough

See the complete guide, including registrar-specific steps and a pre-switch checklist: Connect a custom domain →

Google email — best delivery

Connect a Gmail or Google Workspace address so your site can send email through Google, using a Google app password. Email sent through Google is very likely to reach the inbox.

1. Create an app password

Your Google account needs 2-Step Verification switched on. Then open the Google app password manager, create an app called ClaudeCMS and copy the password it shows you.

2. Add your details on Connections

Go to the Connections tab of your Claude CMS account, open Google email, and enter your Gmail or Workspace address and the app password.

Never paste the app password into Claude. Entered on the Connections tab it is stored encrypted, and no trace of it is left in your chats.

Stripe — card payments

Connect Stripe so your storefront takes card payments — Visa, Mastercard, Amex, Apple Pay and Google Pay — paid into your own Stripe account and on to your bank. We never hold your money, and you never type a Stripe key anywhere: the connection is made by signing in at Stripe.

1. Have a store first

Stripe appears on Connections once your store exists. If you have not created one yet, start with Store setup.

2. Connect it on the Connections tab

Go to the Connections tab of your Claude CMS account and open Stripe. There are two doors: Connect your Stripe account signs you in at Stripe and links the account you already trade with — the usual choice; Set up Stripe for the first time walks you through creating one, so have your business details and bank account to hand.

If you start creating an account and stop part-way, the panel shows Incomplete. Press I already have a Stripe account to switch to an existing one, or Create a Stripe account to carry on where you left off.

3. What the status pill means

Not connected — nothing linked yet. Incomplete — an account was started but not finished. Reviewing — Stripe has your details and is checking them, usually a few minutes; reload the page to re-check. Connected — your storefront is taking card payments.

4. Payments and refunds

Shoppers pay on your storefront’s checkout and the money settles in your Stripe account on Stripe’s payout schedule. Refund an order from Store › Orders and it goes back through Stripe to the shopper’s card. Bank details, payout timing and statements live in your Stripe dashboard.

Never paste Stripe keys into Claude. Stripe is connected by signing in at Stripe, so there is nothing to paste — if anything asks you for a secret key, stop and raise a ticket.

Veeqo

Add your Veeqo API key so your Claude CMS account can connect to your Veeqo inventory and shipping.

The key is encrypted as soon as it is saved and never shown again. You can paste a new one at any time to replace it, and you can revoke the old key from inside Veeqo whenever you like.

EasyPost shipping

Connect EasyPost and your store can show live USPS, UPS and FedEx rates at checkout and buy shipping labels from the order screen — without opening an account with each carrier.

Test first, then go live

EasyPost gives you two keys. A test key starts EZTK — it returns real rates and produces labels marked VOID, and nothing is charged, so it is the safe way to check everything works. A production key starts EZAK and buys real postage. Paste the test key first, place a practice order, then swap the key when you are happy.

What you need on your products

Rates are calculated from weight, so each product variant needs its weight filled in — anything without one cannot be quoted accurately. You will also need a valid ship-from address on your store: carriers verify it when a label is bought, and an address that cannot be delivered to will be rejected.

What it costs

EasyPost does not charge for the first 3,000 labels a month, then a few pence per label. That is separate from the postage itself, which you pay at the carrier rate shown when you buy the label.

Google Search Console & Analytics

Verify your site with Google, submit your sitemap, and see the traffic Claude's SEO work is bringing in.

1. Verify ownership

In Google Search Console, add your domain as a property and choose the HTML tag verification method. Copy the meta tag it gives you, then ask Claude to add it:

2. Submit your sitemap

Every Claude CMS site publishes a sitemap automatically at /sitemap.php. In Search Console, open Sitemaps in the left menu and submit sitemap.php so Google can find every page as soon as it's published.

3. Connect Google Analytics

Grab your GA4 Measurement ID (starts with G-) and ask Claude to wire it in:

Claude sets the analytics_id site setting and inserts the tracking snippet — no plugin, no separate tag manager account needed.

Shopify store

Connect Claude to a Shopify store - products, inventory, locations and the full Admin API. If you have a Claude CMS account, just log in and open Connections - enter your store in the Shopify section, approve on Shopify, and it links to your account automatically. The steps below are the do-it-yourself route (around 15 minutes, once per store).

1. Create a custom app

Sign in at dev.shopify.com and use Create app (the "Get API credentials" quick path). Name it, paste in the Admin API scopes you want Claude to have, tick Use legacy install flow, add a redirect URL (any URL works - it just has to match the one used later to mint the token), and release the version.

2. Lock it to your store and install

Under Distribution, choose Custom distribution, enter your xxxx.myshopify.com domain and generate the install link. Open it while logged in to the store admin and click Install.

3. Mint the token and connect

Visit the OAuth authorize URL for your store, copy the code from the redirect, and exchange it for a permanent shpca_ token. Add a new connection in your MCP admin with the Shopify adapter URL for your store and the token as the API key, refresh the connector, and the store appears as tools in Claude.

Full walkthrough

Every step in detail, with copy-paste scope lists, the exact authorize URL and token command, plus FAQ: Connect your Shopify store →

Zoho CRM, Books & Inventory

Connect Claude CMS to Zoho and your assistant can work with your CRM contacts, leads and deals alongside your Books customers and invoices, and your Inventory items and sales orders. There is nothing to install and no API key to copy — just log in and open Connections, find the Zoho section, and click Connect Zoho.

1. Open the Connections tab

Sign in to your Claude CMS account and choose Connections in the sidebar. Each service has its own panel showing whether it is connected. Open the Zoho panel and click Connect Zoho.

2. Approve it on Zoho's screen

You are handed over to Zoho to sign in and approve. Zoho lists exactly what is being asked for across CRM, Books and Inventory, and you can withdraw it at any time from your Zoho account under Connected Apps. Your Zoho password is never seen by Claude CMS — approval happens entirely on Zoho's own site and only an access token comes back.

Zoho sends you to your own region automatically, so it makes no difference whether your account is hosted in Europe, the US, India, Australia, Japan or elsewhere.

3. Check what was granted

Back on the Connections tab, the Zoho panel shows a permissions checklist — a tick for everything Zoho granted and a cross for anything it refused, grouped by CRM, Books and Inventory. When everything is granted the panel reads Connected and shows the Zoho organisation it is linked to.

If Zoho refuses part of it

Zoho only grants permissions for products your account actually has. If your Zoho user has no CRM licence, the CRM permissions are refused and the panel reads Limited access instead — the connection still works for Books and Inventory, but anything needing CRM will not. The checklist tells you exactly which parts are missing rather than leaving you to guess.

If you are a user inside someone else's Zoho organisation, ask their administrator to grant your user access to the products you need, then disconnect and reconnect. Permissions are fixed at the moment you approve, so an existing connection will not pick up newly granted access on its own.

PhonePe payments

For stores in India: add your PhonePe keys so your store can take UPI, card and wallet payments through PhonePe. Keys are encrypted as soon as they are saved and never shown again.

If you only see a salt key and salt index, those are older PhonePe credentials — ask the PhonePe integration team for your client ID and secret. PhonePe checkout is being built now; saving your keys means they are ready the moment it lands.

Delhivery shipping

For stores in India: add your Delhivery account so labels and tracking can run through Delhivery. Keys are encrypted as soon as they are saved and never shown again.

Delhivery labels and tracking are being built now; saving your details means they are ready the moment it lands.

DTDC shipping

For stores in India: add your DTDC account so labels and tracking can run through DTDC. Keys are encrypted as soon as they are saved and never shown again.

DTDC labels and tracking are being built now; saving your details means they are ready the moment it lands.

Australia Post & StarTrack

For stores in Australia: add your Australia Post or StarTrack account so labels and tracking can run through it. Keys are encrypted as soon as they are saved and never shown again.

No contract? Shippit or Starshipit reach Australia Post without one. Labels and tracking are being built now; saving your details means they are ready the moment it lands.

Afterpay

For stores in Australia: add your Afterpay merchant keys so shoppers can pay in four instalments. Keys are encrypted as soon as they are saved and never shown again.

Afterpay at checkout is being built now; saving your keys means they are ready the moment it lands.

Zip

For stores in Australia: add your Zip keys so shoppers can buy now and pay later with Zip Pay and Zip Money. Keys are encrypted as soon as they are saved and never shown again.

Zip at checkout is being built now; saving your keys means they are ready the moment it lands.

Shippit

For stores in Australia: one Shippit key reaches Australia Post, Aramex, CouriersPlease and more, with no carrier contracts of your own. Keys are encrypted as soon as they are saved and never shown again.

Shippit labels and tracking are being built now; saving your key means it is ready the moment it lands.

Starshipit

For stores in Australia: labels and tracking across Australian carriers through your Starshipit account. Keys are encrypted as soon as they are saved and never shown again.

Starshipit labels and tracking are being built now; saving your keys means they are ready the moment it lands.

Aramex shipping

For stores in Australia: add your Aramex Australia account so labels and tracking can run through Aramex. Keys are encrypted as soon as they are saved and never shown again.

Aramex labels and tracking are being built now; saving your details means they are ready the moment it lands.

Adding an API key

Some of the things your site does — taking payments, sending email, using AI — need a key from another company. Add it once and your site can use it, without the key ever being stored on your website.

1. Open the Keys tab

In your admin panel, open the Claude panel and choose Keys. If you cannot see it, get in touch and we will switch it on for your site.

2. Add the key

Click Add a key and fill in four things:

• Service — pick it from the list. Choosing the service sets all the technical settings for you, and tells you where to find the key in that company’s dashboard.
• Name it — something short, such as stripe. This is what you type when you want it used.
• What is it for — a note to your future self, such as “payments on the booking form”.
• The key — paste it in, and save.

If your service is not in the list, choose Something else and the technical fields appear. The only one you really need is the web address the key is allowed to be sent to.

3. Use it

Refer to the key by name, in curly braces, in any request:

That tells us which key to use. It does not reveal the key itself — not in the chat, and not to the assistant doing the work. Nobody has to handle it.

Never paste an API key into a chat. Add it in the Keys tab and refer to it by name instead. Anything typed into a chat is kept in that conversation, so a key pasted there should be replaced with a fresh one.

Replacing, pausing and deleting

Each key has three buttons. Replace key is for when you change it at the provider — paste the new one and everything carries on working. Turn off pauses it without losing the settings. Delete removes it, and anything using it stops working straight away.

You cannot read a key back after saving it — nobody can, which is rather the point. To check a replacement landed, open Technical detail on the row: the fingerprint changes when the key changes.

If something is not working

• No key named ... — the name in your request does not match a key. Check the spelling against the Keys tab.
• Method not allowed, or path must start with ... — the key is allowed to do less than the request needs. Use Replace key, expand Advanced, and widen it.
• Key is turned off — switch it back on with Turn on.

Uploading images

Claude can't read images off your computer directly, so it gives you a secure upload link instead.

Ask Claude for an upload link

When you want to add images to your site, copy this prompt into Claude:

Claude returns a link. Open it, upload your images, and they'll be available for Claude to place on your pages.

Or upload from your account

You can also upload images and other assets — logos, PDFs, documents — straight from the Assets tab of your Claude CMS account. Anything you add there lands in your site’s uploads, where Claude can find it by filename, so there is no link to ask for.

Uploading PDFs

Brochures, menus, price lists, guides: Claude can put a PDF on your site and link to it from any page, or you can host it from your account and hand Claude the link.

Ask Claude

Claude can’t read files off your computer, so it gives you a secure upload link, the same way it does for images. Copy this prompt into Claude:

Open the link, upload the PDF, then tell Claude where it belongs — for example “link the menu PDF from the Menu page” or “add a Download brochure button to the home page”. Claude adds the link or button and the file opens in the visitor’s browser.

Or upload from your account

Open the PDFs tab in Assets, choose your files and press Upload. Each PDF gets its own link that never changes. Copy the link and paste it into a chat with Claude, or use it anywhere on your site.

Tick Protect these PDFs if a file should only download from a link on your own site — a price list you don’t want shared around, say. You can switch protection on or off later from the card and the link stays the same.

Uploading videos

Video is heavy, so it isn’t uploaded to your pages like an image. It goes through the Videos tab in Assets, which streams it from a dedicated video service and gives you a link Claude can place.

1. Open the Videos tab

Go to Assets → Videos in your Claude CMS account. The first time, video hosting is switched on for you on request: press the request button and we confirm by email, usually within one working day. After that the tab is an uploader.

2. Upload

Choose the file and press Upload, then leave the page open until it finishes — a large file can take a few minutes to send. The video then goes through processing: short clips are usually ready in a few minutes, longer ones in fifteen to twenty. Its card shows the stage (Queued, Processing, Ready) and updates on its own.

3. Put it on a page

Once the card says Ready, press Copy URL and paste the link into a chat with Claude:

Claude embeds the player where you asked. The same link works on any page, as many times as you like.

Already have the video on YouTube or Vimeo? Give Claude that link instead and it will embed it directly — no upload needed.

Add a blog

Spin up a full news/blog section from two ready-made blocks — a category hub with shareable, deep-linkable category URLs, plus a matching article template. You build it by prompting Claude for the right block.

Step 1 — scaffold the blog

Do this once. It creates the blog landing page at /news/ from the blog-listing block, branded to your site.

Step 2 — add an article

Repeat for each post. The category you give must match one you set in step 1.

Full walkthrough

See the complete guide, including prompting tips and how to add a new category: Add a blog to your site →

Add an admin panel

Add a proper login to your site from the ready-made admin-login block — two access levels (admin and customer), a forgot-password flow, and Google Authenticator two-factor built in. You build it by prompting Claude for the block.

Step 1 — deploy the login system

Do this once. Claude installs the login at /login, creates the user storage (or reuses your existing customer table), and makes you the admin.

Step 2 — protect your pages

Tell Claude which areas need a login. Admin-only pages are for you; customer pages are for anyone with an account.

Your first sign-in

Claude never sets a password for you. You'll receive a reset link by email — choose your own password, then scan the QR code with Google Authenticator (or Authy, 1Password and similar apps). From then on, signing in takes your password plus the 6-digit code from your phone. Keep the one-time backup codes it shows you somewhere safe. New to two-factor? See What is 2FA?

Adding more users

Ask Claude any time — for example: “Add jane@example.com as a customer account.” Each new user sets their own password and enrols in two-factor on first login, the same way you did.

Save your own blocks

The block library gives you ready-made pieces like the blog and admin login — but you can also save your own. When Claude builds something you'll want again — a section design, your brand rules, how you like articles written — save it as a block and it's there in every future conversation on your site.

Start here — see what you already have

Before saving anything, see what's already there. Claude will list the ready-made library blocks available to your site alongside any you've saved, with what each one is for.

Save something Claude just built

Finished a section you like? Save it before you move on.

Save your standing instructions

Blocks don't have to be designs. Save the rules you'd otherwise repeat at the start of every conversation — brand colours, tone of voice, article structure — and Claude follows them automatically from then on.

Use them again

Your saved blocks work just like the library ones.

Good to know

Blocks belong to the site, not the person — everyone who works on your site shares the same set, so a colleague can use (or update) a block you saved. Saving to an existing name updates it, and you can ask Claude to delete one at any time. Each site holds up to 50 blocks. One caveat worth knowing: saved blocks act as standing instructions in every future conversation — so if Claude starts doing something odd every time, check your blocks first: “List my blocks and show me what brand-rules says.”

Headless eCommerce

Sell from your own site — product pages, stock, a hosted checkout and an order admin, all deployed by Claude. Payments land in your own payment account, not ours. No Shopify, no WooCommerce, no platform between you and your customers.

What you get

A product catalogue you edit by talking to Claude, a secure card checkout, automatic stock tracking, and an orders dashboard on your own domain where you can see and fulfil what's been bought. Shipping integrations (Royal Mail, DPD and similar) can be wired in on request.

Getting it enabled

Once it's on

From there it's conversation, like everything else:

Read more

How the whole thing works, including where the money goes and what the order admin looks like: Claude CMS now has headless ecommerce →

SSL & HTTPS

An SSL certificate encrypts traffic between your visitors and your site, and turns on the padlock in the address bar. It's also a Google ranking signal.

Do you already have one?

Most hosts, including our managed plans, issue a free certificate automatically via Let's Encrypt — check your host's control panel under "SSL" or "Security" first. If you're self-hosting and don't see one, ask your host to enable it; almost every modern host supports one-click Let's Encrypt certificates.

Force every visitor onto HTTPS

Once a certificate is active, ask Claude to make sure nothing is served over an insecure connection:

Claude audits page content, sitemap entries and settings for stray http:// links. The redirect rule itself lives in .htaccess, a protected file — if it isn't already forcing HTTPS, get in touch and we'll add it.

Just switched domains?

A certificate is issued per-domain, so if you've just connected a custom domain, the new domain needs its own certificate before HTTPS will work on it.

What is two-factor authentication?

Also called two-tier or two-step login. The quick version — what it is, why it matters, and how to add it to your Claude CMS site.

A second key, not just a password

2FA adds a second check on top of the password — usually a one-time code from the user's phone or email. Even with the right password, no code means no entry.

Passwords leak — second factors don't

Passwords get phished, reused, and exposed in data breaches. A second factor means a stolen password alone is useless to an attacker. It's the highest-impact step you can take to protect an admin area or member login.

Just ask Claude to build it in

Because your site is built through conversation, you don't code it yourself — you ask Claude to add 2FA to your login. Pick one of the two approaches in the topics on the left.

Option A — Email code Simplest

After the password is accepted, the site emails a 6-digit code that must be entered to finish signing in. Nothing for the user to install.

Copy this prompt into Claude

Option B — Authenticator app Strongest

The user scans a QR code once into an app like Google Authenticator or Authy, then enters the rotating 6-digit code (TOTP) each time they log in. No reliance on email delivery.

Copy this prompt into Claude

Automatic remote backups

Every site hosted by us is backed up automatically to secure off-site storage — no setup, and nothing for you to manage.

Your whole site

Every backup captures the full site — all pages, files, database content, settings, and navigation.

Every night, automatically

Backups run overnight, every day. Multiple recent restore points are kept so your site can be rolled back if anything goes wrong.

Secure off-site storage

Each backup is written to a separate remote location, so your data stays safe even if the main server has a problem.

Need to restore?

Just get in touch and we can roll your site back to an earlier restore point. If we host your site, backups are automatic and there is nothing for you to switch on. Not hosted with us? Speak to us to discuss setting this up.

Good security habits

Pair these with 2FA to keep your site — and your visitors' data — safe.

• Always serve logins over HTTPS so codes and passwords can't be intercepted.
• Offer the user backup recovery codes in case they lose their phone or email access.
• Add rate limiting on the login form to slow down guessing — ask Claude to "limit login attempts to 5 per 15 minutes per IP".
• Store passwords hashed (Claude does this by default with PHP's password_hash) — never in plain text.

Use Claude CMS as a headless backend

Build the front end in whatever you like — Next.js, Astro, Nuxt, SvelteKit, a mobile app — and let Claude manage the content. Every published page, custom field, menu, setting and image on your site is available as JSON from its read API at https://your-site/api/v1.

Step 1 — switch the read API on

Ask Claude. Tell it where the front end will live so browsers on that origin are allowed to call the API:

Claude replies with the base URL, a read key (it can only read published content — keep it in your front end's server-side environment) and a preview secret (append ?preview=<secret> to any request to see drafts and scheduled pages). The connector key Claude uses never leaves the server.

Step 2 — fetch content

Send the read key as a bearer token (or an X-Read-Key header):

• /content/pages — list; filter with type, parent, q, field.<key>=value; sort, order, limit, offset; add include=content for the HTML
• /content/pages/{slug} — one page with content, typed fields and its children
• /content/types — the content types in use and their field definitions
• /content/navigation — the navigation and any menus, with ready-made absolute URLs
• /content/settings — site name, colours, footer text and any setting whose key starts with public_
• /content/media and /media/{file}?w=640&f=webp — uploads with dimensions and alt text, and resized copies (widths 160–1920, WebP/AVIF)
• /content/search?q=, /content/sitemap, /sitemap.xml, /openapi.json

Responses carry an ETag and a one-minute public cache, so send If-None-Match for cheap re-checks. All dates are UTC, ISO 8601. The full reference is your site's own /api/v1/openapi.json.

Step 3 — model your content

Content types are free-form — products, events, team members, recipes — and each can carry typed fields (text, textarea, number, date, bool, select, image, url, json). The API returns them under fields, already typed.

Keep the front end fresh — webhooks

Static or cached front ends need a nudge when content changes. Ask for a webhook and point it at your revalidation route:

Each delivery is a JSON POST with X-CMS-Event (for example page.published), X-CMS-Delivery and X-CMS-Signature: sha256=<HMAC of the raw body>. Reply 2xx within eight seconds; failures retry at 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours. Events: page.created/updated/published/unpublished/deleted, navigation.updated, settings.updated, media.uploaded.

Drafts, previews and scheduling

Drafts stay out of the API until published. Add ?preview=<preview secret> to see them (and status=all on the list). To publish later, ask Claude to schedule it:

Good to know

• The API is read-only. Writes happen through Claude, so your editors never need a second login.
• 300 requests a minute per address by default; Claude can raise it, allow more origins, switch on key-free public reading, or rotate the read key and preview secret.
• Claude manages all of this with the site_headless tool — ask it for the status of the read API at any time.
• Works on hosted spaces and on self-installed sites running the current package.