POPPY | WORDPRESS PURE

WordPress, retired into Pure.

For Shattique. The public site — pages, contact forms, and agent profiles — no longer needs WordPress + its separate MySQL database. Code's Wave 3 moved all three into Pure on the single Supabase database, behind the same login and the same security model. Here's exactly what replaced what, and how to run it.

WordPress + MySQL Pure · one Supabase DB
The mapping

What replaced what

Every WordPress concept now has a home in Pure — a real Postgres table on the live database, readable by the public where it should be, and editable by staff inside Pure.

WP Pages & PostsAbout, service pages, blog content
Pure CMSPublished marketing/content pages, public‑readablepure_cms_pages
Contact Form 7 / Gravity Forms"Contact us", lead capture
Pure Contact FormsForm definitions + a private submissions inboxpure_contact_forms · pure_contact_submissions
Agent profile pagesTeam bios, headshots, listings
Pure Agent PagesPer‑agent public profiles, tied to the rosterpure_agent_pages
WP form submission emailPHP mailer / SMTP plugin
Public submit RPCAnyone can submit; it lands in the inbox + notifies staffmcp_contact_submit
WordPress login (wp‑admin)Separate user table + roles
One Pure loginSame Supabase Auth + roles as the whole productpure-auth.js
MySQL databaseA second, separate database to back up & secure
One Supabase PostgresNo bridge, no MySQL — confirmed single‑DBRLS on every table
How to run it

Three things to manage

All inside Pure, with the same look and login as the rest of the product — no second admin to learn.

Content pages

  1. Open the CMS surface in Pure admin.
  2. Create or edit a page — title, slug, body, publish toggle.
  3. Published pages are public; drafts stay private.
Table: pure_cms_pages

Contact forms

  1. Define a form (fields + which inbox).
  2. Visitors submit via mcp_contact_submit — no login needed.
  3. Read submissions in the private inbox; staff get notified.
Tables: pure_contact_forms · pure_contact_submissions

Agent pages

  1. Each agent gets a profile row (bio, photo, contact).
  2. Tied to the live roster — one source of truth.
  3. Publish to show the public profile.
Table: pure_agent_pages
Why it's safe

The security model (RLS)

This is the part WordPress plugins get wrong. Pure enforces it at the database, so it can't be bypassed.

Row‑Level Security — verified live

A visitor (not logged in) can submit a contact form — the submission really lands in the inbox.
That same visitor cannot read back any submissions — they get zero rows. Nobody can scrape your leads.
Published CMS pages, active forms, and agent pages are publicly readable (that's the website).
Drafts and the submissions inbox are staff‑only, behind the Pure login.
Every path was isolation‑tested in rolled‑back transactions before going live. Committed as db/2026-06-28_wave3-backend.sql.
Where it stands

Live now · and your next step

Live (Code, Wave 3)

  • The four tables + the public submit RPC are deployed.
  • RLS is on and verified (submit‑yes / read‑no).
  • Single Supabase DB confirmed — no MySQL bridge.
  • One login across content + product.

Your next step, Shattique

  • Point the acquisto.biz public pages at the Pure CMS surfaces (the content is ready to fill).
  • Recreate each WP form as a Pure contact form + pick its inbox.
  • Confirm the agent roster, then publish agent pages.
  • When happy, cancel the WordPress hosting — nothing depends on it.

Tip: the System Map shows WordPress as a retiring node feeding into Supabase — a visual of exactly this migration. And the Connections punch list covers the mailbox/DNS pieces (Zoho) that pair with retiring WP email.

WordPress Pure · one database, one login, real security · for Shattique