Self-hosted Content Management Systems (CMS): what licence are you actually agreeing to

“Self-hosted” and “open source” are not the same promise, and the lists that recommend these projects rarely separate them. This page sorts 48 content management systems (cms) projects by the licence you are actually agreeing to, as read on 2026-08-20.

21 of 48 are permissive: run them, change them, keep your changes to yourself. 6 are AGPL, where serving a modified copy over a network obliges you to publish those changes, which is the clause that catches people who self-host for a team. 3 are not open source at all, carrying a proprietary or restricted-use licence. The remaining 16 are ordinary copyleft.

Project	Licence	What that means	Stars	Maintenance	Language
Strapi	MIT	Permissive, no strings	72,973	Active	TypeScript
Payload CMS	MIT	Permissive, no strings	44,282	Active	TypeScript
Wagtail	BSD-3-Clause	Permissive, no strings	20,443	Active	Python
KeystoneJS	MIT	Permissive, no strings	9,960	Active	TypeScript
Umbraco	MIT	Permissive, no strings	5,228	Active	C#
Apostrophe	MIT	Permissive, no strings	4,602	Active	JavaScript
Squidex	MIT	Permissive, no strings	2,509	Active	C#
Publify	MIT	Permissive, no strings	1,856	Active	Less
WinterCMS	MIT	Permissive, no strings	1,509	Active	PHP
Bludit	MIT	Permissive, no strings	1,464	Active	PHP
Automad	MIT	Permissive, no strings	927	Active	TypeScript
Concrete 5 CMS	MIT	Permissive, no strings	851	Active	PHP
Cockpit	MIT	Permissive, no strings	743	Active	PHP
WonderCMS	MIT	Permissive, no strings	735	Active	PHP
Typemill	MIT	Permissive, no strings	613	Active	JavaScript
Bolt CMS	MIT	Permissive, no strings	591	Active	PHP
Expressa	MIT	Permissive, no strings	452	Active	JavaScript
REDAXO	MIT	Permissive, no strings	353	Active	PHP
Localess	MIT	Permissive, no strings	74	Active	TypeScript
Pushword	MIT	Permissive, no strings	24	Active	PHP
SilverStripe	BSD-3-Clause	Permissive, no strings	-	Not measured	PHP
WordPress	GPL-2.0	Copyleft, publish your changes	21,349	Active	PHP
Joomla!	GPL-2.0	Copyleft, publish your changes	5,124	Active	PHP
Pimcore	GPL-3.0	Copyleft, publish your changes	3,834	Active	PHP
MODX	GPL-2.0	Copyleft, publish your changes	1,404	Active	PHP
HTMLy	GPL-2.0	Copyleft, publish your changes	1,358	Slowing	PHP
TYPO3	GPL-2.0	Copyleft, publish your changes	1,204	Active	PHP
Backdrop CMS	GPL-2.0	Copyleft, publish your changes	1,043	Active	PHP
Textpattern	GPL-2.0	Copyleft, publish your changes	881	Active	PHP
Omeka	GPL-3.0	Copyleft, publish your changes	549	Active	PHP
Contao	LGPL-3.0	Copyleft, publish your changes	436	Active	PHP
Alfresco Community Edition	LGPL-3.0	Copyleft, publish your changes	227	Active	Java
d9	GPL-3.0	Copyleft, publish your changes	144	Active	TypeScript
CMS Made Simple	GPL-2.0	Copyleft, publish your changes	-	Not measured	PHP
Drupal	GPL-2.0	Copyleft, publish your changes	-	Not measured	PHP
Neos	GPL-3.0	Copyleft, publish your changes	-	Not measured	PHP
SPIP	GPL-3.0	Copyleft, publish your changes	-	Not measured	PHP
MediaCMS	AGPL-3.0	AGPL, network copyleft	5,067	Active	JavaScript
Ech0	AGPL-3.0	AGPL, network copyleft	2,044	Active	Go
eLabFTW	AGPL-3.0	AGPL, network copyleft	1,400	Active	PHP
Vvveb CMS	AGPL-3.0	AGPL, network copyleft	1,171	Active	HTML
Superdesk	AGPL-3.0	AGPL, network copyleft	747	Active	Shell
Noosfero	AGPL-3.0	AGPL, network copyleft	-	Not measured	Ruby
october	⊘ Proprietary	Not open source, restricted use	11,144	Active	PHP
CraftCMS	⊘ Proprietary	Not open source, restricted use	3,601	Active	PHP
Kirby	⊘ Proprietary	Not open source, restricted use	1,527	Active	PHP
CouchCMS	CPAL-1.0	Unstated or unclassified	375	Active	PHP
Plone	ZPL-2.0	Unstated or unclassified	-	Not measured	Python

What the licence column means

Permissive (MIT, Apache-2.0, BSD, ISC): do what you like, keep changes private.
Copyleft (GPL, LGPL, MPL, EPL): changes you distribute must ship their source.
AGPL, network copyleft: the same, and running it for others over a network counts as distribution. This is the one that surprises people who self-host for a team or a side business.
Source-available (SSPL, BUSL, Elastic, Commons Clause): not open source. Reading and self-use are usually fine; offering it as a service is not.
Other / unstated: the dataset lists no licence we could classify. Check the repo before you rely on it.

The Maintenance column is a second, independent check: the age of the most recent commit on the default branch, read from the GitHub API on 2026-08-20. Active is within 180 days, Slowing is 180 to 365, Dormant is over a year, Archived means the maintainer marked the repo read-only, and Not measured means the project is hosted outside GitHub so the check does not apply.

Source data from awesome-selfhosted-data, used under CC BY-SA 3.0. Licence family grouping and maintenance status are computed by this site (from the upstream licence fields and the GitHub API) and are not part of the upstream dataset. Licence classification is a summary, not legal advice: check the project’s own LICENSE file before you rely on it. This page is published under the same licence.