Headless Lock for Magento 2
Perpetual licence — one payment. The version you buy is yours to keep and use for as long as you like, with 12 months of updates and priority support included. When the year ends your store carries on running exactly as it is — only updates and support stop. Renewing is optional, any time: 40% off the list price (not the promotional price). We email you before your licence year ends.
Headless Lock is a Magento 2 module that disables the native Luma storefront with a single store-view toggle, while leaving GraphQL, REST and the Admin fully operational - so a headless Magento behind an Astro front end stops serving a second, duplicate shop.
The Luma storefront is still live under your headless build
Decoupling Magento does not switch the old frontend off. Every product, category, search page, CMS page, customer account and checkout still responds on the Magento domain. That is duplicate content competing with your real storefront in search results, a second checkout a shopper can stumble into, and an attack surface you gain nothing from exposing.
What it does
- One toggle, per store view — lock one store and leave another open
- Blocks at the front controller — before routing, so there is no controller path left to slip through
- Choose the response — a 302 redirect to your headless storefront (reversible), or 410 Gone so search engines de-index the Luma pages permanently
- GraphQL, REST and Admin untouched — they run in their own areas and are never affected
- Payment and OAuth callbacks are hard-coded as allowed — Stripe, PayPal, Braintree, Adobe Payment Services, the vault,
/oauth, social login and Xero, with no configuration needed - Allow-list anything else — a non-standard payment route,
/llmstxtor a custom webhook can be added
Will this break my checkout or social login?
No. Payment gateway returns and OAuth callbacks are hard-coded as always-allowed, so enabling the lock cannot break a payment return or a sign-in callback. You do not have to tick them.
Should I use redirect or 410 Gone?
Use the 302 redirect while you are still migrating - it sends shoppers to your storefront and is reversible. Use 410 Gone once you are settled, because it tells search engines the Luma URLs are permanently gone and gets them de-indexed.
Can it lock the store by accident on deploy?
No. The module ships disabled and domain-neutral, so installing it changes nothing until you deliberately turn it on for a store view.
Requirements
Magento Open Source 2.4.9 GA and later 2.4.x, on PHP 8.3, 8.4 or 8.5. Intended for stores served by a separate headless storefront.
Included in the AgenticEcom Suite
Part of the complete platform — one of 40+ modules in the AgenticEcom Suite.
Frequently asked questions
Will enabling this break my GraphQL or REST API?
No. The block is frontend-area only. GraphQL (/graphql) and REST (/rest) run in separate areas and the blocking plugin isn't even loaded there, so they're never affected. The Admin is likewise untouched.
What about Stripe / PayPal checkout return URLs?
They're automatically allowed. The payment-gateway routes (Stripe, PayPal, Braintree, Adobe Payment Services, the vault) and OAuth/social-login are hard-coded as always-allowed and can't be blocked, even if you don't tick them in config.
My custom payment module's callback is blocked — why?
The lock only auto-allows the standard gateways. If your module registers a frontend route it appears in Allowed Frontend Routes — tick it. If its callback isn't a registered route, add its path to Additional Path Prefixes (advanced).
302 redirect or 410 Gone — which should I pick?
Use 302 redirect while you're transitioning, so you can point shoppers at the new storefront and still reverse it. Use 410 Gone once you're certain the Luma frontend is retired for good — it tells search engines to drop those URLs.
Can I lock one website but not another?
Yes. Every setting is store-view scoped. Select a store view at the top of the Configuration page, enable the lock there, then leave the other store views disabled. Verified clean on Magento 2.4.9, PHP 8.3, 8.4 and 8.5.