Umbraco is already headless — you probably don't need Heartcore

If you have been quoted for "headless Umbraco", check which product the quote is for. Four things wear that name, and the gap between the cheapest and the most expensive is roughly €48,000 a year.

The one most projects need is free.

The free CMS is already headless

Umbraco CMS is MIT-licensed, free for commercial use, with no per-server and no per-seat fee. Its published feature list for the free open-source CMS includes headless APIs and webhooks, alongside the things you would expect — content authoring, media management, user management, multilingual setup and full markup control.

That matters because the usual reason teams reach for a paid headless product is the belief that the free CMS cannot serve JSON. It can. A decoupled front end can read content from it, and webhooks can tell that front end when something changed.

Turning it on takes three steps, and the default will surprise you

The Delivery API has been part of core Umbraco since version 12, shipped in the MIT-licensed Umbraco.Cms.Api.Delivery package. It is not on by default, though, and switching it on is a three-step job rather than a checkbox.

1. Set Umbraco:CMS:DeliveryApi:Enabled to true in appsettings.json.
2. Add .AddDeliveryApi() to the Umbraco builder in Program.cs.
3. Rebuild the DeliveryApiContentIndex Examine index. Skip this and the multi-item query endpoint returns nothing while the single-item endpoints keep working — which makes for a confusing hour.

Now the part worth reading twice: `PublicAccess` defaults to `true`. Enabling the Delivery API without further configuration exposes every allowed content type to the anonymous internet. Locking it down means setting an API key, and from Umbraco 17.1 you can work from an allow-list of content types rather than only a deny-list — on 12 through 17.0 a newly created document type is exposed the moment it exists unless someone remembers to add it to the deny-list.

Media is a separate switch again: the Media Delivery API is its own opt-in, added in 12.2, and stays off even when the content API is on.

The Accept-Language trap for bilingual sites

This one costs an afternoon if you have not met it. The Delivery API picks a culture from the Accept-Language header, but the header value is validated against ^[\w-]*$. A normal browser-style weighted list — ar,en;q=0.9 — does not match that pattern, so it is silently ignored and you get default-culture content back with no error to tell you why. A decoupled English/Arabic front end has to send exactly Accept-Language: ar.

What the API deliberately does not do

• No GraphQL and no query language in core. The whole vocabulary is fetch, filter, sort, skip, take, expand and fields. Filtering on a property value, or sorting by a custom date, means writing C# handlers and rebuilding the index.
• No built-in rate limiting. You wire up ASP.NET Core's own rate limiter, which matters the moment the API is reachable publicly.
• Output caching is opt-in, available from Umbraco 13, and only evicts on publish from 17.4 onwards. On the 13 LTS line that means editors wait for a cache timer rather than seeing changes propagate.

None of that is a criticism. It is a deliberately narrower API than a purpose-built headless CMS offers, and knowing where its edges are before you design the content model is the difference between a clean build and a pile of custom handlers. On the tooling side Umbraco serves an OpenAPI document, and version 18 adds per-content-type schemas — which is what makes a genuinely typed TypeScript client practical rather than aspirational.

The four products, and what separates them

1. Umbraco CMS, self-hosted. Free licence. You supply hosting, a SQL Server, a CDN, TLS and backups. Unlimited editors at no cost.
2. Umbraco Cloud. The same CMS, managed, billed per project from €45 a month on Starter. Standard and above carry a website and delivery-API availability target. Unlimited team members on every plan.
3. Umbraco Heartcore. A separate managed SaaS headless product, priced separately from the CMS.
4. Umbraco Compose. Content orchestration — federating several source systems into one API. €12,000 a year for Professional, €48,000 for Enterprise, metered by ingestion, with a quote-only Custom tier above that.

Compose in particular gets mistaken for "headless Umbraco, the SaaS version". It is not. It solves a different problem — unifying content that lives in several business systems — and it is priced for that buyer. A marketing site does not need it.

What decoupling actually takes away

This is the part that gets skipped in sales conversations, so here it is plainly.

Preview stops being free

Umbraco's backoffice preview renders Umbraco's own Razor templates. That is excellent when Umbraco also renders your site and worthless the moment a separate front end does. On a headless build the preview path is something you build. And to be unambiguous, because the industry is loose about this word: Umbraco does not offer click-to-edit visual editing against an external front end. If someone tells you it does, ask them to show you.

Block structure cannot diverge between languages

Block-level culture variance only arrived in Umbraco 15. Even with it, block structure stays invariant across languages, so reordering blocks in English reorders them in Arabic. For a bilingual site that is a content-modelling decision you make once, at the start, or regret repeatedly.

And one that surprised us when we checked: Umbraco's backoffice ships no Arabic culture file and has no right-to-left layout — 28 backoffice languages in 17.7.0, Hebrew among them, no Arabic. Front-end Arabic is completely fine. Arabic-first editors will be working in a left-to-right English admin. We wrote about the front-end side of this in our guide to Arabic and RTL engineering.

So when is a paid product the right answer?

• You do not want to run servers. Umbraco Cloud is the obvious answer, and it bundles the CDN, WAF, TLS and a managed database. Just budget the real floor: Starter ships only a Live environment, and Umbraco's own documentation requires a second environment for upgrade testing, which is a €45 add-on.
• You need an availability target with teeth. Standard carries a 99.9% website and delivery-API target; service credits begin at Professional.
• Your content genuinely lives in several systems. That is Compose's actual job, and if that is your problem the price may well be justified.

None of those is "we want a JSON API". You already have one.

The version question, because it has a deadline

Whatever route you pick, land on Umbraco 17, the current long-term-support release, secure to 27 November 2028. Non-LTS majors live roughly twelve months — 14, 15 and 16 each died within a year of release.

And do not start anything new on Umbraco 13. Its security patches end on 14 December 2026, and the .NET 8 runtime underneath it loses Microsoft support on 10 November 2026 — five weeks earlier, which is the deadline most upgrade plans forget.

The short version

• The free CMS ships headless APIs and webhooks. Start there.
• Pay for Umbraco Cloud if you want the infrastructure managed, not because you need the API.
• Compose is orchestration, not a cheaper headless CMS.
• Budget the preview path, and model bilingual blocks properly on day one.
• Target 17 LTS, and treat any Umbraco 13 quote as a hidden second project.

If you want this applied to your situation, that is what our headless Umbraco service is for — and if you are still choosing a platform at all, the three-year cost comparison prices Umbraco against a headless SaaS CMS with every source shown.