Hygraph: The Headless CMS from Berlin for Secure, Maintenance-Free Websites

Once a website needs more content than you can comfortably maintain by hand, a CMS comes into play sooner or later. For many SMEs, that is still WordPress, TYPO3, Drupal or Craft CMS, installed on their own server or with a hosting provider. That works as long as someone reliably takes care of updates, the server and security. In practice, that is often not the case.

For projects where I use a separate CMS, I therefore work with cloud-based headless CMSs. One of them is Hygraph, a headless CMS from Berlin. In this post, I explain what Hygraph is, why I value it above all for security reasons, and when it is the right choice for your website.

In short: Hygraph is a fully managed headless CMS. There is no server of your own and no PHP stack you have to patch. Content reaches your website through a GraphQL API.

What is Hygraph?

Hygraph was founded in Berlin in 2017 and was called GraphCMS until 2022. The old name already reveals its core: Hygraph is built from the ground up for GraphQL, a query language for APIs that lets a website request exactly the data it needs, no more and no less.

Hygraph is a so-called headless CMS. This means it takes care of content only: text, images, page structures, blog posts, case studies or product data. How that content is displayed is decided by a separate front end. Depending on the requirements, I use Webstudio or another front end, such as a custom-built application.

Hygraph runs entirely as software as a service in the cloud. You don't install anything, you don't run a server, and you don't install updates. For me, that is the most important point, so it is worth taking a closer look.

The real argument: security without maintenance

Classic CMSs such as WordPress, TYPO3, Drupal or Craft CMS are written in PHP and run on a server that someone has to operate. The system includes the CMS itself, extensions, the PHP version, the web server and the database. Each of these layers needs regular updates. And each of them can become a vulnerability.

A recent example: PHP2Shell

Update October 2026: October 2026 showed how quickly this can happen. On October 21, 2026, the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2) that allowed attackers to run their own code on a server without authentication. In principle, every PHP installation that handles web requests was affected. According to Kaspersky, the first exploitation attempts were observed before the patches were even available.

What makes this particularly critical: the flaws were in PHP itself, not in a specific application. According to Recorded Future, researchers at Wiz demonstrated working attacks against WordPress, Drupal and Joomla. And for PHP 8.1 and older, the PHP project no longer provides any updates at all. If you run an older website on an outdated server, that is a real problem.

I describe what this means for SMEs in detail in my post “Who Actually Takes Care of Your Website's Security?”.

What is different with Hygraph

With Hygraph, there is no server of your own, no PHP installation and no plugins you have to keep up to date. The vendor operates the infrastructure, scales it as needed, creates backups and applies security patches in the background. Your website fetches the content through an API. If the front end is static, or rendered on the server and cached, there is hardly any attack surface left on your side.

On top of that, Hygraph is SOC 2 Type 2 and ISO 27001 certified and offers GDPR-compliant data processing. According to Hygraph, you choose the region where your content is hosted when you create a project, including the EU (Ireland). The region can't be changed afterwards.

The risk doesn't disappear. But it is carried by a team that does nothing else. You can focus on your content instead of security updates.

What makes Hygraph stand out

GraphQL at the core

All content in Hygraph is available through a GraphQL API. For development, that is a big advantage: a page requests exactly the fields it needs in a single query, such as the title, teaser, image and author of a blog post. That keeps load times short and the code clear. Webstudio can connect GraphQL APIs directly, which makes the combination particularly pleasant to work with.

Content federation: content from several sources

A special feature of Hygraph is content federation. It lets you connect external data sources, such as a store system, a product database or another API, and serve them together with your editorial content through a single GraphQL API. The data doesn't have to be maintained twice. For SMEs whose product or master data already lives in another system, that is a strong argument.

Localization and roles

Localization is built into Hygraph from the start. Every field can be maintained per language, and roles and permissions let you define who can edit and publish what. The interface is tidy and easy to understand, even for editorial teams without a technical background.

Structured content for SEO, AEO and GEO

Because content in Hygraph is cleanly structured, it can be prepared specifically for search engines and AI search, for example as structured data or FAQ sections. That supports SEO, AEO and GEO: visibility in Google and in AI chatbots like ChatGPT, Claude and Gemini.

Pricing: what does Hygraph cost?

Hygraph offers a free Hobby plan that is often enough for smaller websites. Among other things, it includes three seats and two locales. According to Hygraph, the Growth plan for small businesses starts at USD 199 per month, and enterprise solutions are quoted individually. You can find the current terms directly on Hygraph's website.

Whether the free plan is enough depends mainly on the number of languages, users and content entries. I clarify this with you before the project starts, so there are no surprises later.

Hygraph and Contentful: compared with the pioneer

Anyone looking into headless CMSs quickly comes across Contentful. Contentful is considered the pioneer among SaaS headless CMSs: completely maintenance-free, with enterprise-grade security, and connected purely through APIs. Contentful is particularly widespread among large companies.

Hygraph follows the same basic principle but focuses consistently on GraphQL and content federation. For many SME projects, Hygraph is also more accessible, both in getting started and in cost.

On request, I also work with Contentful, for example if you already use it. You can read more in my post Contentful: the pioneer among headless CMSs.

Hygraph or Sanity?

Alongside Hygraph, I also use Sanity. Both are fully managed headless CMSs with no server of your own. The differences are in the details:

• Hygraph is a good fit when content comes together from several sources, when you want a clear interface that is ready to use right away, and when GraphQL should be at the center.
• Sanity is a good fit when the editing interface should be tailored closely to your team, when several people work on content at the same time, or when content is reused across many channels.

Hygraph with Webstudio: my setup

Depending on the requirements, I combine Hygraph with Webstudio. Webstudio fetches the content through the GraphQL API, renders the pages on the server and delivers them through a global network. Hosting for Webstudio websites is available from me from CHF 120 per year. For projects with special requirements, Hygraph can just as well be connected to another front end.

An honest assessment matters to me here: not every website needs a headless CMS. For a company website with a handful of pages, a system with a built-in CMS such as Webflow is often enough. You'll find a detailed comparison of the classic systems in my post Craft CMS vs. Drupal, TYPO3 and WordPress, and if you want to move away from WordPress, my post WordPress or Webflow? has the answers.

When Hygraph is right for you

• You no longer want to run, patch and secure a CMS yourself.
• Your website has a lot of structured content, such as a blog, case studies, products or events.
• Your content appears in several languages.
• Some of your data already lives in other systems and should be integrated.
• Data protection and hosting in Europe matter to you.

Conclusion

For me, Hygraph is the answer to a question many SMEs only ask when it is too late: who takes care of the CMS's security? With Hygraph, the answer is clear. The vendor operates, scales, backs up and patches the platform, and you only maintain your content. Combined with Webstudio or another front end, the result is a fast, secure and flexible website without the maintenance burden.

Are you thinking about replacing your current CMS, or planning a new website with lots of content? Get in touch. Websites for SMEs start at CHF 3,000, and I quote larger projects with a headless CMS individually, with an itemized quote that lists every item separately.