[opensourcedex]

wondercms is a free, open source content management systems (cms) project written in PHP and released under MIT. It has 740 GitHub stars, 168 forks and 16 open issues, and was last pushed 23 days ago. On this registry it ranks #39 of 47 tracked projects in Content Management Systems (CMS), with 5 head-to-head comparisons available. It gained 2 stars over the last 3 tracked days.

What is wondercms?

What it is

WonderCMS is a flat file content management system written in PHP and distributed under the MIT license. It is presented as a five-file project, approximately 50KB when zipped, and it stores site data in a JSON database instead of a conventional external database server. The project lives in the content management system ecosystem, specifically the flat file CMS niche, and its topics include blogs, landing pages, lightweight sites, and content management.

The problem it solves is the setup burden of a small website. The README says it needs no configuration: a user unzips the files, uploads them, and can create and edit pages through the browser. It also says migration is reduced, because moving a site to another server is done by copying the files. This makes it useful for simple blog or landing page sites where the owner wants a PHP-based CMS without a separate database service.

Key capabilities

  • The core installation consists of five files: database.js in JSON format, index.php, theme.php, style.css, and htaccess.
  • It provides one-step installation, one-click updates, and one-click backups.
  • It includes a theme and plugin installer, with plugins supported through hooks and listeners.
  • It is privacy oriented: the README states no cookies, no tracking, and no powered by links, and the security section says there is only one session state cookie.
  • It supports Apache, NGINX, IIS, and Caddy servers, although NGINX and IIS require one additional setup step.
  • It uses SubResource Integrity tags for included CSS and JavaScript libraries, and it supports HTTPS out of the box.
  • It hashes the admin password with PHP password_hash and password_verify, returns a 404 header for the login page, and encourages a custom login URL to reduce brute force exposure.

Who uses it and how

  • Blog owners can use it as a lightweight publishing system, since the topics include blog and the project is described as a small flat file CMS.
  • Landing page builders can use it because the topic list includes landing-page-builder and the README describes simple website creation and editing.
  • Site owners can move an existing site by copying all files to a new host, without a separate database migration step.
  • Administrators can update the installation through one-click updates pushed through GitHub, rather than manually replacing files.
  • Users can extend the site through the bundled theme and plugin installer, while the core remains small.

Getting started

The primary install method is to unzip the latest version and upload it to a server. Other options mentioned are cloning the GitHub repository, using a hosting provider with WonderCMS preinstalled, using a Docker image, or installing through cPanel and Softaculous.

When to use it — and when not to

WonderCMS fits small PHP-hosted sites where the owner values a small codebase, simple file-based deployment, and minimal configuration. It is less suitable when a site needs features beyond the described five-file core, such as a broader default library set or a separate database service. A self-hoster must operate a PHP 7.4 or greater server with cURL, mbstring, Zip, and mod_rewrite, maintain the JSON database file, backups, and updates, and handle the additional NGINX or IIS setup step plus security settings such as a custom login URL and strong password.

project readme (upstream, from github) — read inline

WonderCMS logo
WonderCMS - small flat file CMS
5 files • ∼50KB zip - 1 step install


Docs Project Maintained License Donate

WonderCMS is an extremely small flat file CMS. It's fast, responsive and doesn't require any configuration.

It provides a simple way for creating and editing websites.
Includes features such as: 1-step install, 1-click updates, 1-click backups, theme/plugin installer and much more.

Demo • Download • Community • News • Donate • Buy merch

Small and simple flat file CMS

  • No configuration needed - unzip and upload.
  • 5 files: database.js (JSON format), index.php, theme.php, style.css and htaccess.
    • Transferring your website to a new host/server is done by only copy/pasting all files (no additional configuration/migration)
  • Privacy oriented: no cookies, tracking or "powered by" links.
  • Includes plugins (via hooks/listeners), themes/plugins installer, backups, 1 click updates.
  • Supports most server types (Apache, NGINX, IIS, Caddy).
  • Project goal: keep it simple, tiny, hassle free (infrequent-ish 1 click updates).

1 step install


Other install options


Requirements

  • PHP 7.4 or greater
    • cURL extension
    • mbstring extension
    • Zip extension
  • mod_rewrite module
  • any type of server (Apache, NGINX, IIS, Caddy)

For setting up WonderCMS on NGINX or IIS servers, there is one additional step required. Read more: NGINX setup or IIS setup.

WonderCMS works on most Apache servers/hosts (even free ones) by default.


Libraries used (3)

  • 3 libraries located in index.php, included only when admin is logged in:
    • wcms-admin.min.js, autosize.min.js (4.0.2), taboverride.min.js (4.0.3).

Note: Some plugins also include other libraries such as jQuery, default WonderCMS out-of-the box includes only the above libraries through CDNs.


Security features

  • Track free and transparent - WonderCMS doesn't track users or store any personal cookies, there is only one session state cookie.
  • Your WonderCMS installation is completely detached from WonderCMS servers. One click updates are pushed through GitHub.
  • Supports HTTPS out of the box.
  • All CSS and JS libraries include SubResource Integrity (SRI) tags. This prevents any changes to the libraries being loaded. If any changes are made, the libraries won't load for your and your visitors protection.
  • WonderCMS encourages you to change your default login URL. Consider your custom login URL as your private username.
    • Choosing a good login URL can prevent brute force attacks.
    • Your login page will always return a 404 header response. Search engines do not (and should not) cache your login URL.
  • The admin password is hashed using PHP's password_hash and password_verify.
    • Choosing a strong password will prevent malicious actors from gaining any further admin access (if they would have guessed your login URL).
  • WonderCMS includes CSRF verification tokens for each user action and additionally uses the hash_equals function to prevent CSRF token timing attacks.
  • No known vulnerabilities.
    • Special thanks to yassineaddi, hypnito and other security researchers.

Other features

  • no configuration required, unzip and upload
  • extremely fast
  • subpages
  • simple inline click and edit functionality
  • theme and plugin installer/updater
  • 1 click updates
  • 1 click backups
  • easy to theme
  • custom editable blocks
  • custom theme and plugin repositories
  • log of last 5 logged in IPs
  • file uploader
  • lightweight
  • responsive
  • clean URLs
  • custom homepage
  • menu reordering and visibility
    • note: hiding a page from the menu only hides it from the actual menu (and not from search engines)
  • highlighted current page in menu
  • custom 404 page
  • basic SEO support
    • custom title, keywords and description for each page
  • [optional] functions.php file for loading your custom code
    • note 1: functions.php file includes itself when you create it
    • note 2: the location of functions.php file should be inside the current active theme folder (same location as theme.php)

List of donors

Also listed on the official WonderCMS website. Thank you for supporting WonderCMS!

  • Håkon Wium Lie (also the creator of CSS)
  • Tjaša Jelačič (BigSheep)
  • Otis Schmakel
  • Mohamad Hegazy
  • Ulf Bro
  • Kim Fajdiga
  • John Greene
  • Sara Stojanovski
  • Peter Černuta
  • Jasmina Fabiani
  • Primož Cankar
  • Andraž Zvonar
  • Martin Jablonka
  • Martin King
  • Ben Gilbey
  • Darley Wilson
  • Josef Kmínek
  • Mikula Beutl
  • David Bojanovič
  • Kenneth Rasmussen
  • Victor Onofrei
  • Matthev
  • Veselin Kamenarov
  • James Campbell
  • Kirsten Hogan
  • Denis Volin
  • Jonathan Jacks
  • Bizibul
  • Bikespain
  • Aleksandr
  • Impavid Pty Ltd
  • Mohamad Hegazy
  • Happy Monsters Studios
  • Derek (Random Fandom Media Group)
  • Paweł Krużel
  • Netroid
  • Fabian Winder
  • Václav Piták

What to (or not to) expect from WonderCMS

  • WonderCMS is meant to be a small gift to the internet and a simple alternative to website creating. It's 100% free and doesn't not include any "powered by" links.
  • WonderCMS doesn't track users and is not interested in any user data.
  • WonderCMS is not a fast-pace development project. Unless there is a critical vulnerability, updates

readme truncated — read the full docs on github

Frequently asked questions

Is wondercms free to use?

wondercms is open source under the MIT licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does wondercms do?

Fast and small flat file CMS (5 files). Built with PHP, JSON database.

What is wondercms written in?

wondercms is primarily written in PHP. Its source is publicly available at https://github.com/WonderCMS/wondercms, and it has 740 GitHub stars.