WonderCMS

What the product is

WonderCMS is a flat-file content management system for small websites, aimed at people who want a site online without running a database. A review on Deploi explains that it "is a flat-file CMS, meaning it doesn't rely on a database and stores all content in text files." The Flat File CMS guide adds that content is stored as JSON, that the system has been developed since 2008, and that it is MIT-licensed and free. MyHostingPartner, a hosting company, also dates the project to 2008 and describes it as a small but quite popular CMS that aims to be as lightweight and simple as possible.

The reader it fits is a founder, freelancer or small business that needs a handful of pages: a business card site, a contact page or a personal page. The sources behind this entry are third-party reviews, comparisons and the project's GitHub repository. None of them names a company headquarters, so this entry gives no location.

What you build and how

CMS Critic reviewed it as a lean flat-file CMS rather than a hosted website builder. The reviewer notes that WonderCMS "touts itself as a free website builder" but would call it more of a flat-file CMS, because builders such as Weebly or Wix bundle hosting, and WonderCMS does not. You download it, put it on your own web host and run the site from there.

The editor. Editing happens inline. Once you log in as an administrator, CMS Critic says, the pages show editing controls and you work on the content directly where it appears. Clicking an editable area opens a menu for uploading images and documents and linking to YouTube videos, and the reviewer was "pretty impressed with the features they managed to cram into their editor." MyHostingPartner points out that there is a WYSIWYG editor, so you type your text normally and don't need a language like Markdown, which that review counts as an advantage over other flat-file CMS options. Pages are added from a drop-down admin menu with a plus sign, and an eye icon publishes or unpublishes a page. Deploi's comparison says WonderCMS also offers a simple drag-and-drop interface for managing pages, which makes arranging content convenient.

The data layer. There isn't one in the usual sense. CMS Critic says it "does not need a database, runs on 5 files". The Flat File CMS guide describes a handful of files with the core in a single index.php. MyHostingPartner explains the practical effect: with no database connection and no queries, a site is fast, and getting from one site to another is easy because everything lives in the folder structure. The same review warns that this puts data in files on disk, so it recommends copying the web.config file as described on GitHub, which keeps the data from being downloaded from the web.

Themes and plugins. CMS Critic says plugins and themes are found on GitHub or linked from the main website, and that every theme can be previewed in the demo. MyHostingPartner says WonderCMS "has a number of themes that you can install with a few clicks" and calls them plain: "These themes aren't fancy, but they get the job done for a large number of simpler websites." It also mentions that the interface can be switched to Dutch in addition to the default English. The GitHub repository states a deliberate cap to keep the project compact: a maximum of 20 plugins and 50 themes will be supported, and once the limit is reached in a category, a voting system will decide which stay in the top 20 and top 50.

Installation and hosting. MyHostingPartner describes the install as downloading the package, uploading it to the web root of your hosting package and adjusting web.config with write permissions on. The GitHub readme says WonderCMS works on most Apache servers and hosts, even free ones, by default, and links setup guides for NGINX and IIS. CMS Critic notes that the project doesn't ask for a link back to its website. Because it is software you host yourself, the finished site is served from your own server.

Security design. The GitHub readme lists several measures. The admin password is hashed with PHP's password_hash and checked with password_verify. Each user action carries a CSRF verification token, compared with hash_equals to block timing attacks. The login page always returns a 404 header response, and search engines do not cache the login URL. The readme also says WonderCMS doesn't track users or store personal cookies; there is only one session state cookie.

Blogs and content sites. None of the sources describes a dedicated blogging module. What they do describe is a page-based site where you add pages, edit them inline and publish them, with extras such as SEO tooling coming from plugins, according to the Flat File CMS guide. For a small blog or journal you would be using that page model.

The evidence from the pages

Price and license. The Flat File CMS guide gives "Licence and price: open source (MIT), free." An iTechGuides comparison table lists WonderCMS with a free plan, no paid tier and a platform type of "Self_hosted". iTechGuides is a ranking site that sells sponsored placements, so treat its table as a third-party summary, not a vendor statement. None of the sources lists hosting costs, which depend on the web host you choose.

Requirements. Per the Flat File CMS guide, it needs PHP 7.4 or newer. The GitHub readme says the admin-only interface loads 3 libraries from index.php: wcms-admin.min.js, autosize.min.js (4.0.2) and taboverride.min.js (4.0.3).

Releases. The Flat File CMS guide, last verified on 30 September 2026, gives the current release as 3.6.0. It says "Search was added in 3.5.0, and 3.6.0 added safer theme and plugin installs." It also lists one-click updates and a simple theme and plugin system as strengths.

Governance. The GitHub readme says "Specific features are added only if the majority of the WonderCMS community signals a wanted change" and that pull requests are welcome. It states that WonderCMS doesn't include an auto-update feature: if the GitHub account were ever compromised, malicious actors could push updates to every site, and the built-in one-click updater is what prevents that kind of attack.

Security record. Rapid7's vulnerability database documents CVE-2023-41425, an authenticated file upload vulnerability affecting WonderCMS between 3.2.0 and 3.4.2, for which a Metasploit module exists. The Flat File CMS guide says the issue was fixed in 3.4.3 and adds "so keep it updated." The GitHub readme states "No known vulnerabilities" and gives special thanks to named security researchers. Deploi's comparison is more cautious: it says the simple architecture reduces potential attack vectors, but WonderCMS lacks the community support of larger projects and may not receive updates as frequently.

Support. Deploi says WonderCMS relies on its community for support, and that migrating content from other platforms may take more manual effort than with a CMS that offers imports. None of the sources lists a vendor support channel, a paid support plan or a service-level promise.

Users and accounts. Deploi states that WonderCMS "is designed for simplicity and doesn't have advanced user management features. It doesn't support user roles or multiple user accounts out of the box."

Who it suits and who it does not

The Flat File CMS guide names the audience directly: "One-page sites, personal pages and tiny brochure sites where minimal size matters most." A solo founder who needs a landing page, a freelancer with a small portfolio, or a local business that wants a few pages fits that description. CMS Critic reached a similar conclusion: for the average user it works well, it's quick and responsive, and it suits people who need a website up with little bother. Its advice is to try the demo before downloading.

It fits less well once the site grows or the team does. The Flat File CMS guide lists the trade-offs itself: the system is designed for very small sites and larger structures become awkward, and extras such as SEO tooling come through plugins, so you should check that what you need is available. With no user roles and no multiple accounts out of the box, an agency managing many client sites, or an operations team where several people edit with different permissions, will run into that limit quickly. A regulated enterprise will find no compliance claims in the sources, and an ecosystem capped at 20 plugins and 50 themes is small next to the large CMS platforms.

You also own the upkeep. Because there's no auto-update, you apply releases yourself through the one-click updater, and the CVE history means keeping up with versions matters. CMS Critic reported a toolbar bug in its own test, so expect a modest tool rather than a polished suite. For the right small site, the trade is attractive: no database, a few files, a free license and an editor that works on the live page.