UnfoldCMS

What the product is

UnfoldCMS is a self-hosted content management system built on Laravel, a PHP framework. Its own blog describes it as "a self-hosted CMS built on Laravel with a REST API at /api/v1/*." The home page sums it up as "One-time pricing. Self-hosted. shadcn/ui admin," with "no vendor lock-in" and "no monthly bill that grows with your traffic," and says it is "built for developers who want a modern stack without compromising on features." It is for developers and agencies who would rather own and run their CMS than rent one. The company's posts present it as the headless model with content exposed over an API, but on your own server with a one-time cost. Its blog posts are written by Hamed Pakdaman, who signs as a full-stack engineer with 10+ years building and scaling web apps and as the creator of UnfoldCMS.

What you build and how

UnfoldCMS is a developer's CMS rather than a visual site builder. You install it, theme it and extend it in code, then editors work in its admin panel. The pitch is that you skip the boilerplate: "Authentication. Permissions. Media uploads. SEO. Localization. These aren't features, they're prerequisites." The site says those come pre-built and production-tested, under the heading "Ship in Hours, Not Weeks." It illustrates the point with a timeline: building from scratch means auth, 2FA and password resets in weeks 1 to 2, a media library in week 3, roles and audit logs in week 4, and SEO, sitemaps and an admin UI in weeks 5 to 6, "6+ weeks before actual development." With UnfoldCMS you clone the repo, run migrations and start on your own features on day 1. The page labels this a "-95%" cut in setup time, which is the company's own claim.

The admin panel. The home page calls it a "Beautiful Admin Panel Built with shadcn/ui," with "every component built with shadcn/ui, React 19, and TypeScript. Accessible, customizable, and beautiful." There is a live demo to try it before downloading. The feature table on the home page lists a modern tech stack, SEO and multi-language support built in, shared hosting readiness, child themes, React components, 2FA security and full TypeScript. On the Learning Curve row, UnfoldCMS is listed as "Laravel Dev," meaning you should be comfortable with Laravel.

Data. Content sits in your own SQLite or MySQL database, according to the company's blog. Because you own the server, the same post points out there is no API metering: build-time fetches and traffic spikes do not cost per call.

Templates and configuration. Presentation works through templates. The docs entry reads "Build themes with Blade, sections, settings." Blade is Laravel's templating language, so PHP developers work in a familiar syntax, and global PHP helper functions are available in templates and code. Site-wide configuration has its own docs section covering site settings, environment variables, mail, storage and cache, and there is a cache management guide.

API and headless front ends. For a decoupled front end, there is a REST API with "public read + admin write endpoints with Sanctum," and a separate Categories API page in the docs. The bundled query builder from spatie.be lets you "build complex API queries with filtering, sorting, and includes, straight from the URL." A Next.js guide covers "ISR + webhook revalidation with UnfoldCMS," and webhooks send "signed events for content changes" (the blog calls them HMAC-signed), so a static site can rebuild when an editor publishes. The footer also links a Tailwind integration page.

Media, roles and languages. The home page lists the Laravel packages that come pre-configured. Spatie Media Library handles uploads, image conversions and responsive images. Laravel Fortify provides authentication with 2FA, email verification and password reset. Laravel Permission gives roles and permissions for fine-grained access control. Laravel Translatable adds multi-language content with automatic locale detection. Laravel SEO, by ralphjsmit, generates meta tags, Open Graph, Twitter Cards and JSON-LD schema, and the docs list "SEO & Sitemaps" with an automatic sitemap, redirects and structured data.

Security. The home page section "Security by Default" names "2FA, XSS protection, CSP headers, audit logs." Behind it sit Activity Log from spatie.be for "comprehensive audit logging and user activity monitoring," Laravel Data for type-safe data transfer objects, HTML Purifier (mews/purifier) for sanitizing user-generated content, and Honeypot spam protection, Secure Headers, CSP, WayFinder routing and Fast Paginate.

Hosting. You run it yourself. A docs card titled Shared Hosting says you can "Deploy on cPanel" with no queue workers needed, so it does not require a dedicated server. A migration guide covers moving from WordPress.

Extension. The page says "Override anything. Extend everything. Your way." and describes "enterprise-grade architecture" with "SOLID principles, clean code, comprehensive tests." There is no plugin marketplace pitch. The line "Get all the features you need, built-in. No plugins, no bloat" makes the opposite argument: features ship in core and you customize them in code.

The facts the pages state

The licensing and pricing message has two strands. The home page says UnfoldCMS is "source-available: read the code, fork it, self-host it. Buy once, own it," and invites you to view the source or contribute on GitHub. The footer of the same page reads "Open-source under MIT License," and the site tagline is "Open-source CMS for the modern web." A promo block on the blog adds that "Unfold CMS is free to download and self-host. Built on Laravel + React, full source code included," with a "Get Free Version" button. So there is a free download and paid licenses beside it.

The home page quotes no prices; a View Pricing link leads to the plans. A newsletter offer gives 40% off a first license "on any plan," so there is more than 1 tier. The blog sums up the model as no subscription: pay once, self-host and you are done.

The company's blog is candid about tradeoffs. It describes UnfoldCMS as a database CMS with a "full admin" and REST only, "no GraphQL." It states that "UnfoldCMS is a database CMS without revision history," and it lists "you run the server" among the honest limits. Support runs through a Discord community and the documentation.

Who it suits and who it does not

UnfoldCMS suits a developer or small agency that knows Laravel, wants a blog or content backend on its own server, and prefers a single purchase to a subscription that grows with traffic. It fits a team that wants a modern React and TypeScript admin without assembling it, and an agency that wants to hand a client a CMS with 2FA, roles and audit logs already in place, deployable even on cPanel shared hosting. Developers who plan a Next.js front end have a documented path in the Next.js guide.

It is a weaker fit for a non-technical founder who wants to sign up and start publishing: the pages describe no hosted version, the learning curve is "Laravel Dev," and you take on updates and backups yourself. The company's own posts also say there is no GraphQL and no content revision history, which matters for teams used to either.