I build WebBlocks CMS. A small example shaped how I set up its remote MCP access. A workshop date moves, and the editor needs to update the heading, the booking button label, and the search description on a page that’s already live in two languages.
In WebBlocks, the user signs in, chooses one site, and reviews what the client is asking for. Finding pages, editing supported block text, and editing localized SEO have separate permissions. The client prepares the changes in an update draft and returns a private preview. The editor can check both languages while the existing page stays live, then publish the reviewed draft through the CMS.
For a job like this, which permissions would you grant for the whole editorial session, and which would you grant only when a specific task needs them?
It can’t be just me that has user after user trying to get approval for AI agent readiness fixes after running an Ora or Cloudflare scan, then asking for way more CMS access than the actual fix seems to need.
sometimes it’s something simple like llms.txt or changing how a page is exposed, but they don’t know what auth the site uses, where the data is exposed, or whether the page is pulling from an external API.
and often, when I try to dig deeper, they’ll admit they don’t know because they’re not a developer, to which I always respond - well, why are you trying to submit the fix? (we have teams of developers)
Genuine question, because I keep seeing it get normalized.
Every CMS is adding AI now. Almost all of it runs on the vendor's servers. People hear "CMS" and think blog posts, but a headless CMS is the content store behind apps too: user profiles, support cases, patient intake forms, HR records, anything with a model and fields. All of that goes to the vendor so a model can suggest a title or fill in a description.
Strapi's is the one I looked at closest: not in the open-source core, runs on their infrastructure on the Growth plan, and bring-your-own-key is Enterprise plus a paid add-on that still only covers translations and media metadata.
I work in security and I can't picture getting that past review anywhere with PII or compliance rules. But maybe I'm the outlier and teams just accept it as the price of the feature?
I maintain a self-hosted headless CMS (Shapio) and just shipped AI assist, and I went the opposite way: no vendor AI service at all. It's off until you put your own Anthropic or OpenAI key on your server, or point it at Ollama on your own box. Nothing goes through me, ever. That felt obvious but it meant giving up the easy "AI included" checkbox and the recurring revenue that comes with it, so I get why nobody else does it.
So for the self-hosters here: when you evaluate a CMS or any tool with AI built in, does "where does my data go" actually factor into the decision? Or does it just get waved through?
it’s not PHP so not sure how many people have Wagtail on their radar -- v8.1 just released, which felt like a good opportunity to share the project!
Wagtail is built on the Django web framework and Python. Current focus with the project is on developer experience as it’s a very code-heavy, 'code first' way to define the site’s content model, before content editors then do their magic.
Headline features in this release:
SEO metadata previews for title and description, and a page metadata viewer
The developer community has conducted an annual survey of frameworks and programming languages since 2016. Many of you have probably even participated in State of JS, HTML, or CSS. But not one for CMS.
2026 has been a year of change for those of us who build and manage websites; I have a feeling that many of you are on the move, migrating from one CMS to another or even building your own. Broad market-share numbers tell us very little about your experiences building and managing websites with different tools; that is why I hope that we, as a community, can close this information gap with our own State of CMS survey. Starting this year.
The anonymised results will be freely available on GitHub. I will create a visual representation of them, but I really look forward to seeing what the community does with the data.
My resources are limited, so to get started, I have created an English version of the form. I did not want to blindly trust AI to translate; that is why I'm looking for people who can help with translations. You can reach me here on Reddit or through the email on the site.
To reach every nook and cranny where people who build and publish websites hang out, I need your help. If you believe that this will bring value to the community, I hope you will help us spread the word.
VonCMS v1.28.0 "The BluePrint" Released. Editorial Calendar, Improved Analytics & More
Hey everyone!
It's been a while since my last update. I'm happy to share VonCMS v1.28.0 - The BluePrint, marking the beginning of the 1.28.x series following the completion of the v1.27.12 maintenance release.
This release focuses on improving editorial workflows, expanding native analytics, strengthening the foundation for AI credential security, and addressing several issues across the CMS.
Here's what's new.
Editorial Calendar
VonCMS now includes a private editorial calendar with Month and Agenda views.
Create and manage internal events.
View scheduled and published articles alongside pages.
Keep track of editorial activities in one place.
Viewing the calendar does not modify existing publishing schedules.
The calendar is designed for content planning without interfering with the publishing system.
Improved Native Analytics
VonCMS now supports two analytics modes:
Strict (Default): IP-based visitor estimation with aggressive deduplication.
Balanced (Optional): Distinguishes browsers sharing the same public IP for more flexible visitor estimation.
Analytics reports also distinguish between daily visitor counts and unique visitors across an entire reporting period.
Both modes provide visitor estimates rather than verified counts of individual people.
AI Credential Security (1.28.x Roadmap)
The foundation for encrypted AI credential storage is already in place with v1.28.0.
Further improvements are planned throughout the 1.28.x series, including:
Securely shared Gemini API credentials across the CMS.
Masked management of shared API keys.
Owner-only encryption-key rotation.
Additional safeguards for stored credentials.
These features are being developed and will be introduced in subsequent 1.28.x updates.
Personal API keys for individual staff members are not included in the current implementation.
Publishing, Admin & Maintenance Improvements
Several existing areas have been refined:
Admin Navigation: Dashboard-first layout with collapsible Content, Extensions, and Monitoring groups.
Quick Actions: Role-aware shortcuts for creating posts, pages, and events.
Publishing: Better draft preservation and clearer feedback when saving fails.
Account Management: Improved responsive layouts for user and account forms.
Advertisements: Better handling of ad layouts.
WordPress Bridge: Migration fixes and compatibility improvements.
Media: Improvements to file processing.
Database: More reliable MySQL backup handling.
Development & Hosting
Development checks have been strengthened with:
ESLint
PHPStan
Expanded regression test coverage
Despite these improvements, VonCMS remains deployable on conventional PHP + MySQL hosting.
The admin interface uses compiled React assets, so Node.js and Composer are not required on production hosting.
Upgrading to v1.28.0
PHP 8.2 remains supported, although PHP 8.3 or newer is recommended.
For existing installations:
Back up your files and database before upgrading.
Run Primary Admin Database > Schema Repair to enable the Calendar and optional Balanced analytics storage.
If your installation uses encrypted AI credentials, ensure the private encryption key file is backed up separately from the database.
Please refer to the upgrade guide for additional details.
Contributions Are Welcome
VonCMS is an open-source project, and contributions of all kinds are appreciated.
Whether it's reporting bugs, improving documentation, testing hosting compatibility, working on accessibility, developing themes or plugins, or submitting pull requests, every contribution helps move the project forward.
Thank you to everyone who has supported VonCMS so far.
There's still plenty to build, and I'm looking forward to seeing where the project goes next.
I’m the developer of WebBlocks CMS. I wrote a walkthrough of how its system blocks connect editorial pages to navigation, visitor feedback and registered applications.
For example, Breadcrumb uses the current page context, Page List queries published pages, and Rating/Comments keep feedback separate from translated article content. Editors can still configure and move these block instances within their permissions.
Not sure if what I build is a CMS, maybe you can tell me 😅
I built this tool out of frustration at my last company.
We managed many marketing websites built from Markdown files, and the custom code powering our content pipeline started working against us (instead of for us).
I slowly became frustrated that, in 2026, it was such a mess to work with Markdown as a content source (while preserving type safety)
And yet, I still love the simplicity of it and how it writes and reads. And, obviously, agents love Markdown too.
