Ghost (my preference, to avoid security concerns around WordPress), or WordPress, if you can deal with the occasional security issue or use managed hosting.

Basically forget the “headless” bit and use a bog-standard CMS.