Geekflare

Best Open Source CMS for Business in 2026

I looked at 31 open source CMS platforms and ranked the best ones I'd trust for a business website. For each one I read the licence, the self-hosting docs and the pricing page to see what the free edition holds back, then installed WordPress, Strapi and Ghost on a cloud server to see how they work.

Data refreshedMethodologyHow we evaluate
Founder of Geekflare

Chandan Kumar is a founder of Geekflare. He is a technology enthusiast and entrepreneur who loves to help businesses and people around the world. Chandan has worked at BNP Paribas, Citibank, Deutsche Bank, Motorola, and HP. He’s got an in-depth understanding of business software and IT infrastructure.

What I found

  • Directus isn't open source any more. Version 12 moved it to a source-available licence in June 2026.
  • Two of my installs failed on the first try, and I couldn't find the reason in the docs. Both took one line to fix once I found them.
  • The docs overstate memory. Strapi asks for at least 2 GB of RAM but idled at about 180 MB on my server.
  • WordPress upkeep is mostly plugins, not core. We run Geekflare Guides on WordPress, and the plugin updates are where the maintenance time goes.

Tested on DigitalOcean Droplet with Ubuntu 24.04 server with 2 vCPU and 4 GB of RAM, using Docker. “Ready in” runs from an empty server to the first working screen, image downloads included. “Memory at idle” is what the CMS and its database use together with no traffic.

SoftwareVersionReady inMemory at idleWhat happened
WordPress7.1.333 s495 MB of 4 GBNo issues. Docker's community image and MySQL 8.4 came up on the first try.
Strapi5.58.04 min 41 s178 MB of 4 GBThe first start failed: the setup CLI wrote an empty DATABASE_FILENAME to .env. Setting it to .tmp/data.db fixed it.
Ghost6.71.01 min 10 s636 MB of 4 GBGhost started before MySQL was ready and shut down. A MySQL health check and restart: always in the compose file fixed it.

12 CMS compared

Licence, hosting, SSO and managed-cloud pricing at a glance. Sort by GitHub stars to see what's popular, or by latest release to see what's actively maintained.

LicenceTypeDockerSSOManaged cloud
1
WordPress
PHP 8.3+ / MySQL or MariaDB
GPL-2.0-or-later
Copyleft
Traditional21kOct 2026(Actively maintained)YesVia plugin$4/month
2
Strapi
Node.js 20–26 / TypeScript
MIT
Open core
Headless73kOct 2026(Actively maintained)YesPaid only$35/month
3
Payload
Node.js 20.18+ / TypeScript / Next.js
MIT
Open core
Headless45kOct 2026(Actively maintained)YesPaid onlyNone
4
Drupal
PHP 8.3+ / MySQL, MariaDB, PostgreSQL or SQLite
GPL-2.0
Copyleft
Hybrid4.3kOct 2026(Actively maintained)YesVia pluginNone
5
Ghost
Node.js 22 or 24 / MySQL 8
MIT
Permissive
Publishing56kOct 2026(Actively maintained)YesNo$18/month
6
EmDash
TypeScript / Astro, Node.js 22.16+
MIT
Permissive
Traditional14kOct 2026(Actively maintained)YesFree editionNone
7
Wagtail
Python 3.10–3.14 / Django
BSD-3-Clause
Permissive
Hybrid21kAug 2026(Actively maintained)YesVia pluginNone
8
Umbraco
.NET 10 / C#
MIT
Permissive
Hybrid5.3kOct 2026(Actively maintained)YesFree edition€45/month
9
TinaCMS
TypeScript / React, Node.js 22 or 24
Apache-2.0
Open core
Git-based14kOct 2026(Actively maintained)NoPaid only$24/month (free tier available)
10
Grav
PHP 8.3+ / Symfony
MIT
Permissive
Flat-file16kOct 2026(Actively maintained)YesVia pluginNone
11
KeystoneJS
TypeScript / Node.js, Prisma
MIT
Permissive
Headless10kAug 2026(Actively maintained)NoNoNone
12
Joomla
PHP 8.3+ / MySQL, MariaDB or PostgreSQL
GPL-2.0
Copyleft
Traditional5.1kOct 2026(Actively maintained)YesVia plugin$5/month (introductory)
  • Actively maintained
  • Slowing: last release 1 to 2 years ago
  • Stale: no release in over 2 years
Ask Sparkian

Not sure which CMS fits?

Describe your requirements and AI will shortlist the best fits from these picks.

Or try:

Our CMS picks, reviewed

Ranked for business and technical teams considering licence, maintenance, self-hosting effort and what the paid editions lock.

  1. #1Best overall for websitesTested by Geekflare
    Full reviewWebsite GitHub

    WordPress

    PHP CMS for blogs, marketing sites and online stores

    We run Geekflare Guides on it, and it's the CMS your editors and agencies are most likely to know already. No other pick here is as easy to hire for.

    A fresh WordPress 7.1.3 site with the default theme

    A fresh WordPress 7.1.3 site with the default theme

    Tested Oct 16, 2026, version 7.1.3
    Ready in
    33 s
    Memory in use at idle
    495 MB of 4 GB

    No issues. Docker's community image and MySQL 8.4 came up on the first try.

    Commands, notes and screenshots

    Best for

    Marketing sites, blogs and content sites run by non-technical editors

    Not for

    Headless or multi-channel content for apps, where a typed content model matters

    • Themes and plugins for almost any feature
    • Editors pick up the block editor quickly
    • Runs on almost any PHP host
    • REST API in core for headless use
    • Security depends on keeping plugins updated
    • SSO, audit logs and workflows need third-party plugins
    • Built around pages and posts, not structured content
    Licence
    GPL-2.0-or-later (copyleft)
    Stack
    PHP 8.3+ / MySQL or MariaDB
    Databases
    MySQL, MariaDB
    GitHub
    21k stars · 133 contributors (read-only mirror)
    Latest release
    7.1.3 · Oct 6, 2026
    Managed cloud
    WordPress.com (Automattic), $4/month
    SSO
    Via plugin
    Audit logs
    Via plugin
    Community
    r/Wordpress
    What people say
  2. #2Best headless CMSTested by Geekflare
    Full reviewWebsite GitHub

    Strapi

    Open source headless CMS built on Node.js

    The headless CMS I'd hand to a JavaScript team that wants a ready-made admin instead of defining everything in code, which is the main difference from Payload.

    Strapi 5.58.0 admin setup screen

    Strapi 5.58.0 admin setup screen

    Tested Oct 16, 2026, version 5.58.0
    Ready in
    4 min 41 s
    Memory in use at idle
    178 MB of 4 GB

    The first start failed: the setup CLI wrote an empty DATABASE_FILENAME to .env. Setting it to .tmp/data.db fixed it.

    Commands, notes and screenshots

    Best for

    JavaScript and TypeScript teams building content APIs for websites and apps, with editors working in the admin

    Not for

    Teams that need SSO, audit logs or approval workflows without paying

    • Content types built in the admin, no code needed
    • REST API in core, GraphQL through an official free plugin
    • Roles and permissions in the free edition
    • Supports PostgreSQL, MySQL, MariaDB and SQLite
    • SSO, audit logs and review workflows are paid
    • No official Docker image; you build your own
    • Strapi asks for 2 GB of RAM at minimum
    Licence
    MIT (open core)
    Stack
    Node.js 20–26 / TypeScript
    Databases
    PostgreSQL, MySQL, MariaDB, SQLite
    GitHub
    73k stars · 1.4k contributors
    Latest release
    v5.58.0 · Oct 14, 2026
    Managed cloud
    Strapi Cloud, $35/month
    SSO
    Paid only
    Audit logs
    Paid only
    Community
    r/Strapi
    What people say
  3. #3Best for Next.js teams
    Website GitHub

    Payload

    Code-first headless CMS that runs inside your Next.js app

    Pick it when developers own the content model and the site already runs on Next.js. Figma bought Payload in 2025, and it has kept shipping MIT releases since.

    Best for

    Product and app teams already building on Next.js

    Not for

    Teams that want to set everything up in an admin UI without developers

    • TypeScript types generated from your content config
    • REST, GraphQL and a local API
    • MongoDB, PostgreSQL or SQLite
    • Every content model change needs a developer
    • SSO and workflows are paid
    • Version 4 is in beta with breaking changes
    Licence
    MIT (open core)
    Stack
    Node.js 20.18+ / TypeScript / Next.js
    Databases
    MongoDB, PostgreSQL, SQLite
    GitHub
    45k stars · 589 contributors
    Latest release
    v3.91.0 · Oct 15, 2026
    SSO
    Paid only
    Audit logs
    Not documented
    Community
    r/PayloadCMS
  4. #4Best for complex, multilingual sites
    Website GitHub

    Drupal

    Enterprise PHP CMS backed by the non-profit Drupal Association

    What governments and universities reach for when one site has dozens of content types, several languages and strict editor roles.

    Best for

    Large organisations with an in-house or agency Drupal team

    Not for

    Small teams without PHP and Drupal expertise

    • Granular roles and permissions in core
    • JSON:API and REST in core for headless use
    • Multilingual support built in
    • Steeper learning curve and higher development cost
    • Major upgrades need planning; Drupal 12 requires PHP 8.5
    Licence
    GPL-2.0 (copyleft)
    Stack
    PHP 8.3+ / MySQL, MariaDB, PostgreSQL or SQLite
    Databases
    MySQL, MariaDB, PostgreSQL, SQLite
    GitHub
    4.3k stars · 174 contributors (read-only mirror)
    Latest release
    11.4.10 · Oct 14, 2026
    SSO
    Via plugin
    Audit logs
    Via plugin
    Community
    r/drupal
    What people say
    • “A very capable, enterprise level CMS”
      G2, Apr 2026
    • “The learning curve is steep for new developers or end users”
      G2, Apr 2026
  5. #5Best for newsletters and membershipsTested by Geekflare
    Full reviewWebsite GitHub

    Ghost

    Publishing platform for blogs, newsletters and paid memberships

    The one to pick when the newsletter is the business, not an add-on: posts, emails and paid subscriptions share one member list.

    Ghost 6.71.0 admin setup screen

    Ghost 6.71.0 admin setup screen

    Tested Oct 16, 2026, version 6.71.0
    Ready in
    1 min 10 s
    Memory in use at idle
    636 MB of 4 GB

    Ghost started before MySQL was ready and shut down. A MySQL health check and restart: always in the compose file fixed it.

    Commands, notes and screenshots

    Best for

    Media companies, creators and B2B teams running a blog with a newsletter and paid memberships

    Not for

    General-purpose websites or apps that need custom content types

    • Stripe payments built in, with no extra plugin
    • Fast, clean editor
    • All MIT, with nothing locked to a paid edition
    • Official Docker image
    • MySQL only in production
    • No custom content types beyond posts and pages
    • No SSO for staff accounts
    Licence
    MIT (permissive)
    Stack
    Node.js 22 or 24 / MySQL 8
    Databases
    MySQL
    GitHub
    56k stars · 932 contributors
    Latest release
    v6.71.0 · Oct 15, 2026
    Managed cloud
    Ghost(Pro), $18/month
    SSO
    No
    Audit logs
    Not documented
    Community
    r/Ghost
  6. #6Best for teams on Cloudflare
    Website GitHub

    EmDash

    TypeScript CMS from Cloudflare, built on Astro

    The most credible new CMS in years: Cloudflare built it and moved its own blog onto it. It has only been at 1.0 since September 2026, so pick it if you're comfortable being early.

    Best for

    Teams on Cloudflare or Astro that want a WordPress-style CMS with modern, sandboxed plugins

    Not for

    Sites that depend on a large plugin and theme ecosystem today, or need GraphQL

    • Runs on Cloudflare Workers or any Node.js server
    • Plugins run sandboxed, so one bad plugin can't take down the site
    • Imports WordPress content
    • REST API and a built-in MCP server for AI tools
    • Few third-party plugins and themes so far
    • No GraphQL API
    • No managed hosting
    Licence
    MIT (permissive)
    Stack
    TypeScript / Astro, Node.js 22.16+
    Databases
    SQLite, Cloudflare D1, PostgreSQL, libSQL
    GitHub
    14k stars · 213 contributors
    Latest release
    1.3.0 · Oct 15, 2026
    SSO
    Free edition
    Audit logs
    Via plugin
  7. #7Best for Python teams
    Website GitHub

    Wagtail

    Python CMS built on Django

    If your developers already write Django, Wagtail feels like home: content models are ordinary Django code, and editors build pages from reusable blocks.

    Best for

    Editorial sites with structured, block-based pages

    Not for

    Teams without Python developers

    • No paid edition; everything is BSD-licensed
    • Clean editor experience
    • Read-only REST API in core, read/write v3 in preview
    • Needs Django developers
    • No plugin marketplace on the scale of WordPress
    Licence
    BSD-3-Clause (permissive)
    Stack
    Python 3.10–3.14 / Django
    Databases
    PostgreSQL, MySQL, SQLite
    GitHub
    21k stars · 1.1k contributors
    Latest release
    v8.0 · Aug 25, 2026
    SSO
    Via plugin
    Audit logs
    Free edition
  8. #8Best for .NET teams
    Website GitHub

    Umbraco

    .NET CMS with an editor-friendly back office

    The easy choice for organisations that already run .NET, and the only pick with single sign-on in its free core.

    Best for

    Microsoft-centric organisations

    Not for

    PHP or JavaScript teams, or Linux shops avoiding SQL Server

    • Content Delivery API for headless use
    • Long-term support releases
    • Managed Azure hosting available
    • Needs .NET skills and SQL Server in production
    • Approval workflows are a paid add-on
    Licence
    MIT (permissive)
    Stack
    .NET 10 / C#
    Databases
    SQL Server, SQLite
    GitHub
    5.3k stars · 1.2k contributors
    Latest release
    18.2.1 · Oct 6, 2026
    Managed cloud
    Umbraco Cloud, €45/month
    SSO
    Free edition
    Audit logs
    Paid only
  9. #9Best for visual editing on Git-based sites
    Website GitHub

    TinaCMS

    Git-backed CMS for Markdown and MDX sites

    Marketers click on the live page and edit it, and each change lands in Git as Markdown or MDX.

    Best for

    Marketing sites on Next.js or Astro

    Not for

    Relational or structured-data apps, or teams that need SSO and workflows without paying

    • Free TinaCloud tier for small teams
    • GraphQL content API
    • Self-hosting drops media, branch switching and search
    • SSO and editorial workflow need paid TinaCloud plans
    • Owned by consultancy SSW since 2024
    Licence
    Apache-2.0 (open core)
    Stack
    TypeScript / React, Node.js 22 or 24
    Databases
    Git (content), MongoDB or Upstash Redis (index)
    GitHub
    14k stars · 179 contributors
    Latest release
    3.14.4 · Oct 12, 2026
    Managed cloud
    TinaCloud, $24/month (free tier available)
    SSO
    Paid only
    Audit logs
    Not documented
  10. #10Best flat-file CMS
    Website GitHub

    Grav

    Flat-file PHP CMS

    Back up the whole site by copying a folder: there's no database, and pages are Markdown files you can keep in Git.

    Best for

    Small to mid-size marketing and docs sites that want no database and Git-friendly content

    Not for

    Large editorial teams that need workflows, audit trails or relational content

    • Runs on any PHP 8.3 host
    • Users, groups and access rules in the free core
    • REST API and MCP server in Grav 2
    • No editorial workflow or audit log
    • Official Docker image still tagged 1.7
    Licence
    MIT (permissive)
    Stack
    PHP 8.3+ / Symfony
    GitHub
    16k stars · 256 contributors
    Latest release
    2.2.10 · Oct 17, 2026
    SSO
    Via plugin
    Audit logs
    Not documented
  11. #11Best for custom GraphQL backends
    Website GitHub

    KeystoneJS

    Node.js toolkit for building a content backend

    Less a CMS than a kit for building one. It fits when your content is really application data with complex permissions, and your team would rather write TypeScript than click through an admin.

    Best for

    Developer teams building a custom content backend with a GraphQL API and code-defined access rules

    Not for

    Marketing teams that want page building, visual editing or SSO out of the box

    • GraphQL API and admin UI generated from your schema
    • Fine-grained access control per field and item
    • PostgreSQL, MySQL or SQLite through Prisma
    • SSO and audit logs need custom code
    • Slower release cadence than other headless options
    Licence
    MIT (permissive)
    Stack
    TypeScript / Node.js, Prisma
    Databases
    PostgreSQL, MySQL, SQLite
    GitHub
    10k stars · 288 contributors
    Latest release
    8.1.0 · Aug 31, 2026
    SSO
    No
    Audit logs
    No
  12. #12Best traditional alternative to WordPress
    Website GitHub

    Joomla

    Traditional PHP CMS, first released in 2005

    The closest alternative if you like how WordPress works but want more in the box, and it's run by a non-profit, Open Source Matters, rather than a company.

    Best for

    Multilingual and membership sites built by PHP agencies

    Not for

    Headless projects, or teams that want the largest plugin ecosystem

    • Multilingual sites without plugins
    • Access levels and a user actions log in core
    • Web Services API in core
    • Smaller ecosystem than WordPress
    • Fewer developers to hire
    Licence
    GPL-2.0 (copyleft)
    Stack
    PHP 8.3+ / MySQL, MariaDB or PostgreSQL
    Databases
    MySQL, MariaDB, PostgreSQL
    GitHub
    5.1k stars · 1.2k contributors
    Latest release
    6.2.0 · Oct 13, 2026
    Managed cloud
    Joomla Launch (CloudAccess.net), $5/month (introductory)
    SSO
    Via plugin
    Audit logs
    Free edition
    Community
    r/joomla
    What people say
    • “Stable, flexible, and gives me full control”
      G2, Dec 2025
    • “Majority of Joomla plugins are paid and quite expensive”
      G2, Jul 2026

More open source CMS

These also are worth a look for specific needs.

SoftwareLicenceTypeGitHub starsLatest release
Directus
Instant APIs and an admin app on top of any SQL database
MSCL-1.0-GPL
Source-available
Headless39k(Actively maintained)Oct 2026
Decap CMS
Git-based CMS that gives editors a UI over Markdown files
MIT
Permissive
Git-based19k(Actively maintained)Oct 2026
django CMS
Django-based CMS with front-end editing, run by the django CMS Association
BSD-3-Clause
Permissive
Hybrid11k(Actively maintained)Sep 2026
Orchard Core
Modular, multi-tenant CMS and application framework on ASP.NET Core
BSD-3-Clause
Permissive
Hybrid8.2k(Actively maintained)Jul 2026
ApostropheCMS
Node.js CMS with in-context editing; advanced permissions and multisite are paid
MIT
Open core
Hybrid4.6k(Actively maintained)Oct 2026
TYPO3
Enterprise PHP CMS for multisite and multilingual sites, with long-term support
GPL-2.0-or-later
Copyleft
Traditional1.2k(Actively maintained)Oct 2026
Plone
Security-focused Python CMS with a React front end, long used by governments
GPL-2.0
Copyleft
Hybrid311(Actively maintained)Sep 2026
Squidex
.NET headless CMS with REST and GraphQL, also offered as a hosted cloud
MIT
Permissive
Headless2.5k(Actively maintained)Sep 2026
Winter CMS
Open source Laravel CMS, the community fork of October CMS
MIT
Permissive
Traditional1.5k(Actively maintained)Aug 2026
Concrete CMS
PHP CMS with in-page, drag-and-drop editing
MIT
Permissive
Traditional852(Actively maintained)Oct 2026
Silverstripe CMS
PHP CMS and framework, popular with government in New Zealand and Australia
BSD-3-Clause
Permissive
Traditional516(Actively maintained)Sep 2026
ProcessWire
API-driven PHP CMS built around custom fields
MPL-2.0
Copyleft
Hybrid1.2k(Actively maintained)Aug 2026
Contao
Symfony-based PHP CMS focused on accessibility and GDPR
LGPL-3.0
Copyleft
Traditional447(Actively maintained)Oct 2026
Neos
PHP CMS with inline editing and content dimensions for multilingual sites
GPL-3.0
Copyleft
Traditional265(Actively maintained)Oct 2026
Backdrop CMS
Affordable fork of Drupal 7 for small organisations and nonprofits
GPL-2.0
Copyleft
Traditional1.1k(Actively maintained)Oct 2026
Sveltia CMS
Modern Git-based CMS and drop-in successor to Decap CMS, still pre-1.0
MIT
Permissive
Git-based3k(Actively maintained)Oct 2026
Keystatic
File-based CMS for Astro and Next.js with no database, still pre-1.0
MIT
Permissive
Git-based2.5k(Actively maintained)Aug 2026
Pages CMS
Simple GitHub-backed CMS for editing static site content and media
MIT
Permissive
Git-based4.1k(Actively maintained)Jun 2026
Webiny
Serverless headless CMS you deploy into your own AWS account; RBAC and SSO are paid
MIT
Open core
Headless8k(Actively maintained)Sep 2026
  • Actively maintained
  • Slowing: last release 1 to 2 years ago
  • Stale: no release in over 2 years

Not included, and why

Well-known names you may expect here, left out because they aren't open source or belong to a different category.

  • Craft CMS: Proprietary, source-available licence. The free Solo edition is limited to one user.
  • Statamic: Proprietary licence. The free Core edition allows one admin; users, roles and the APIs need Pro.
  • October CMS: Source-available, with a paid licence key required per project in production. Its open source fork, Winter CMS, is listed above.
  • Pimcore: The Pimcore Open Core License allows free production use only for organisations under €5M in annual revenue.
  • Sanity: Only the Studio editor is open source. Your content has to be stored on Sanity's hosted service.
  • Hugo, Jekyll and Zola: Static site generators, not content management systems.

How to choose

Decide who creates new page types

If marketers add new kinds of pages themselves, choose WordPress, Joomla or Strapi, where content types are built in an admin. In Payload and KeystoneJS every new content type is a code change, which suits product teams but slows a marketing team down.

Price single sign-on before you commit

Strapi charges $150 a month for SSO on top of its Growth plan ($45 a month for 3 users). Payload and TinaCMS keep it in paid plans, and self-hosted Ghost has no SSO for staff at all. Umbraco and EmDash include it free.

Budget memory for the database first

On my 2 vCPU, 4 GB test server, the database used more memory than the CMS. MySQL took about 425 MB next to WordPress and 475 MB next to Ghost, while WordPress itself used about 70 MB.

Check who owns the project

A company can change a licence; a non-profit rarely does. Payload has belonged to Figma since 2025 and TinaCMS to SSW since 2024, while Drupal, Joomla and Ghost are run by non-profit organisations.

How we evaluate

No vendor influences these pages. A vendor can pay for a Featured placement, labelled Sponsored, which never changes a rank or a review.

What qualifies
Self-hostable CMS products with an OSI open source licence or a clearly labelled source-available one, a release or commit in the last 12 months, and either 1,000+ GitHub stars or a long-established user base outside GitHub, such as TYPO3, Plone and Neos. Static site generators, application frameworks and hosted-only services are not considered.
Where we look
GitHub, the pages that rank for each category, so both established and newer projects are considered.
How we rank
Fit for business and technical teams: maintenance activity, self-hosting effort, licence terms, and which features the paid editions lock. Payment never changes a ranking.
Where the data comes from
Stars, releases, contributors and licences come from the GitHub. Editions, pricing and requirements come from each software's own docs.
Hands-on testing
We install two or three projects per category on a cloud Ubuntu 24.04 server (2 vCPU, 4 GB RAM) with Docker, and record install time and idle memory.
Questions

Frequently asked questions

For most business websites, WordPress, for its ecosystem and the number of people who can work with it. For headless content delivered to apps, Strapi, or Payload for Next.js teams. Drupal is the choice for complex, multilingual sites.

Yes. WordPress is licensed under the GPL and free to self-host. WordPress.com is a separate commercial hosting service run by Automattic.

A traditional CMS stores content and renders the website. A headless CMS only stores content and serves it through an API, so a separate frontend (a website, an app, or both) displays it.

Not since version 12 (June 2026), when it moved to the source-available MSCL licence. Without a licence key it's limited to 3 seats, 25 collections and 5 Flows. Each release becomes GPL-3.0 four years after it ships.

EmDash is an open source CMS from Cloudflare, built on Astro and TypeScript, with sandboxed plugins and WordPress import. It launched in April 2026, reached 1.0 in September 2026, and runs on Cloudflare Workers or any Node.js server.

No. Craft uses a proprietary licence; its source code is public, but each project needs a licence and the free Solo edition is limited to one user. The same goes for Statamic and October CMS.