Publish once, appear twice: Bürgerhaus Bornheide and Osdorfer Born

What they needed

The Bürgerhaus Bornheide in Hamburg-Osdorf is the city’s largest community center: twenty social organizations in six buildings, run by the Diakonisches Werk Hamburg-West/Südholstein. It publishes events, offers and news on its own site. The neighborhood site osdorfer-born.de shows much of the same for the whole Osdorfer Born area. Entering everything twice was not an option.

What I built

Whenever a post is published or updated on buergerhaus-bornheide.de, it is copied to osdorfer-born.de through the WordPress REST API, with every relation it depends on, so it arrives complete and linked.

WordPress’s own REST authentication didn’t hold up for a site talking to a site, so the two use their own, with no plugin in between. Both hold a shared key. The sender encodes the body and signs it with a salted HMAC; the receiver decodes it and accepts the data only if the key matches and the body matches its signature. That sits on top of HTTPS, not instead of it. I wrote the approach up in Secure WordPress REST API POST requests without authentication plugins.

Why it matters

Staff publish once. The neighborhood site stays current without anyone copying, and the two can never drift apart.