01
Choose the public-storefront behaviour
Enable a store-view-specific lock and configure a redirect or Gone response for native storefront requests. It ships disabled by default.
Magento 2.4.9
Headless Ready
Astro Storefront Required
INCLUDED IN AGENTICSUITE
Headless Lock for Magento 2
Keep the native Luma storefront from competing with your headless site. Choose controlled redirects or Gone responses while preserving the backend services you need.
Part of the complete platform.
This capability is included in AgenticSuite. Get the Astro storefront and all headless and Luma-compatible modules listed on this website.
Explore AgenticSuite Discuss your Magento projectYour platform. Your control.Full source code and your business data.
Built to work togetherAstro storefront and comprehensive Magento modules.
Check your requirements with us - Store-view-scoped storefront lockdown
- 302 redirect or 410 Gone response
- Payment and OAuth callback allowlists
Test payment, login and custom callbacks in your own deployment before enabling the lock.
BUILT AROUND THE WAY YOU WORK
One public storefront. A working Magento backend.
Included in AgenticSuite. This is part of a headless Magento implementation; the storefront and deployment must be configured to use it.
02
Preserve the routes your operation needs
GraphQL, REST and Admin remain available. Review the built-in payment, vault, OAuth and social-login exceptions and configure custom allowlisted routes for your integrations.
A CLEAR WORKFLOW
From setup to everyday use.
- 01
Explore AgenticSuite and the live storefronts to see how the parts fit together.
- 02
Discuss your current Magento setup, integrations and requirements with our team.
- 03
Configure and test this capability as part of the agreed storefront project.
Do I need to buy this capability separately?+
AgenticSuite includes the Astro storefront and all headless and Luma-compatible modules listed on this website. Discuss the complete platform and your implementation scope with us.
Can you migrate my current store while it remains live?+
We can prepare and test a new storefront while the existing store keeps trading. Product, CMS and compatible module-data migration, final data synchronisation and cutover are planned for your specific project.
Does the licence include hosting and a bespoke build?+
Hosting, migration, training and custom development are agreed separately. We can discuss Cloudways for Magento and Cloudflare for the frontend; you can pay the providers directly or request a managed quotation.
Latest release: Version 1.0.3
Headless Lock is a Magento 2 module that disables the native Luma storefront with a single store-view toggle, while leaving GraphQL, REST and the Admin fully operational - so a headless Magento behind an Astro front end stops serving a second, duplicate shop.
The Luma storefront is still live under your headless build
Decoupling Magento does not switch the old frontend off. Every product, category, search page, CMS page, customer account and checkout still responds on the Magento domain. That is duplicate content competing with your real storefront in search results, a second checkout a shopper can stumble into, and an attack surface you gain nothing from exposing.
What it does
- One toggle, per store view — lock one store and leave another open
- Blocks at the front controller — before routing, so there is no controller path left to slip through
- Choose the response — a 302 redirect to your headless storefront (reversible), or 410 Gone so search engines de-index the Luma pages permanently
- GraphQL, REST and Admin untouched — they run in their own areas and are never affected
- Payment and OAuth callbacks are hard-coded as allowed — Stripe, PayPal, Braintree, Adobe Payment Services, the vault,
/oauth, social login and Xero, with no configuration needed - Allow-list anything else — a non-standard payment route,
/llmstxtor a custom webhook can be added
Will this break my checkout or social login?
No. Payment gateway returns and OAuth callbacks are hard-coded as always-allowed, so enabling the lock cannot break a payment return or a sign-in callback. You do not have to tick them.
Should I use redirect or 410 Gone?
Use the 302 redirect while you are still migrating - it sends shoppers to your storefront and is reversible. Use 410 Gone once you are settled, because it tells search engines the Luma URLs are permanently gone and gets them de-indexed.
Can it lock the store by accident on deploy?
No. The module ships disabled and domain-neutral, so installing it changes nothing until you deliberately turn it on for a store view.
Requirements
Check release-specific Magento and PHP compatibility before installation. Intended for stores served by a separate headless storefront.
Included in the AgenticEcom Suite
Part of the complete platform — one of 40+ modules in the AgenticEcom Suite.
Frequently asked questions
Will enabling this break my GraphQL or REST API?
No. The block is frontend-area only. GraphQL (/graphql) and REST (/rest) run in separate areas and the blocking plugin isn't even loaded there, so they're never affected. The Admin is likewise untouched.
What about Stripe / PayPal checkout return URLs?
They're automatically allowed. The payment-gateway routes (Stripe, PayPal, Braintree, Adobe Payment Services, the vault) and OAuth/social-login are hard-coded as always-allowed and can't be blocked, even if you don't tick them in config.
My custom payment module's callback is blocked — why?
The lock only auto-allows the standard gateways. If your module registers a frontend route it appears in Allowed Frontend Routes — tick it. If its callback isn't a registered route, add its path to Additional Path Prefixes (advanced).
302 redirect or 410 Gone — which should I pick?
Use 302 redirect while you're transitioning, so you can point shoppers at the new storefront and still reverse it. Use 410 Gone once you're certain the Luma frontend is retired for good — it tells search engines to drop those URLs.
Can I lock one website but not another?
Yes. Every setting is store-view scoped. Select a store view at the top of the Configuration page, enable the lock there, then leave the other store views disabled. Check the release-specific Magento and PHP verification record.
SEE THE WHOLE PLATFORM
The capability is one part. AgenticSuite brings it together.
Keep Magento as your commerce engine. Shape the customer experience in Astro Admin, with an integrated module collection behind it.
A complete B2B catalogue.
Explore SyncComms: approximately 1,000 products, guided finders, category filters and a quotation journey.
Explore SyncCommsMobile scores achieved.
See the dated mobile lab reports linked from our homepage, or test the live sites yourself. Results depend on the page and test conditions.
View the performance evidenceMake the move while you trade.
We can scope migrations, frontend rebuilds and new stores. Hosting, migration, training and custom development are agreed separately.
Discuss your projectYOUR NEXT STOREFRONT STARTS HERE
See what AgenticSuite could do for your business.
Explore the working sites, watch the overview, then talk to us about your catalogue and the store you want to build.