7 Self-Hosted CMS Platforms Compared: Setup, Cost, and Stack (2026)

SaaS CMS bills arrive monthly. Your data lives on someone else's server. Your pricing can double when the platform decides to "reposition." Developers and agencies running client work have learned this the hard way — and in 2026, the shift to self-hosted CMS is accelerating.

TL;DR: This guide covers 7 serious self-hosted CMS platforms — WordPress, Ghost, Strapi, Payload, Directus, Keystone, and UnfoldCMS — compared on setup complexity, hosting requirements, tech stack, license type, and total cost. If you're choosing a platform for a client project or your own product, the comparison table and per-platform breakdowns below will save you 10 hours of research.

Why Self-Hosting a CMS Makes Sense in 2026

Three things shifted the math in favor of self-hosting over the past two years:

1. SaaS pricing pressure. Contentful raised prices. Sanity changed its free tier. Webflow's hosting costs ballooned as sites scaled. Developers managing 10+ client sites started doing the math.
2. VPS costs dropped. A Hetzner CX22 (2 vCPU, 4 GB RAM) runs €4.35/month. That's enough for a medium-traffic CMS site with room to spare. The hosting equation no longer favors managed platforms.
3. GDPR and data sovereignty. EU clients increasingly ask: "Where is our data stored?" Self-hosting gives a concrete answer. SaaS vendors often can't.

You lose the convenience layer — no managed updates, no built-in CDN, no support chat. But for developers comfortable running a LAMP/LEMP stack, the tradeoffs favor ownership. Read our deep dive on self-hosted CMS benefits and self-hosted vs SaaS CMS comparison if you want the full argument first.

The 7 Platforms: At a Glance

Before the detailed breakdowns, here's how these platforms stack up on the dimensions that matter most to developers and agencies:

Setup complexity rated: Low = working in under 30 min on a standard VPS; Medium = 1–2 hours with some config; High = requires reading docs carefully, schema or environment setup before first use.

WordPress

WordPress powers 43% of all websites as of 2026 (W3Techs, January 2026). That market share makes it the default choice for non-technical clients — and a complicated choice for developers who have to maintain those client sites.

Setup

Upload files, create a MySQL database, run the 5-minute install. Works on shared hosting from $3/month. Most managed WordPress hosts (WP Engine, Kinsta, Pressable) do the setup for you and add $25–$50/month to the bill.

Pros

• Largest plugin ecosystem (60,000+ plugins in the official repo)
• Non-technical editors know it — training cost is near zero for most clients
• Runs everywhere: shared hosting, VPS, managed
• Gutenberg editor is genuinely good for non-developers now
• WooCommerce for ecommerce, if needed

Cons

• Plugin vulnerabilities are a constant problem: Patchstack recorded 7,966 WordPress vulnerabilities in 2024, up 68% from the prior year
• Performance requires caching plugins, CDN setup, and image optimization — none of it ships out of the box
• REST API is functional but not modern — building headless WordPress means living with WP Query complexity
• Gutenberg is a mixed experience in code — the block editor is powerful but the PHP/JS split makes custom blocks tedious

True Cost (5-year)

Self-hosted on a $10/month VPS: ~$600. Add premium themes ($60), a few paid plugins ($200/year avg for a real production site), and developer time spent on security patches. Realistic 5-year TCO for a maintained site: $2,000–$4,000. See our CMS pricing comparison for full numbers.

Verdict

Best when the client already knows WordPress and you're managing it for them. Hard to justify as a fresh choice for new developer-led projects when better DX options exist.

Ghost

Ghost launched in 2013 as a blogging-only alternative to WordPress. In 2026 it's a focused platform: publishing, newsletters, memberships, and paid subscriptions. It does not try to be everything.

Setup

Ghost CLI makes VPS setup straightforward. You need Node.js, MySQL, and Nginx. The ghost install command handles most of it. Realistic setup time on a new VPS: 45–90 minutes if you're comfortable with the command line. Ghost also offers managed hosting (Ghost Pro) starting at $9/month for self-starters.

Pros

• Clean, fast admin UI — editors love it
• Built-in membership/subscription system (Stripe integration)
• Newsletter sending via Mailgun or SendGrid, configured from admin
• Native headless API — `/ghost/api/content/` is well-documented
• MIT licensed: no surprises

Cons

• Node.js hosting is slightly more complex than PHP — not all shared hosts support it well
• Very focused: not a general-purpose CMS. No custom post types in the traditional sense
• Theme ecosystem is smaller than WordPress — most themes require purchase ($49–$199)
• Membership feature uses Stripe — no alternative payment gateway

True Cost (5-year)

Self-hosted on a $6/month VPS: ~$360. Ghost itself is free. A premium theme at $99 once. No plugin costs. Realistic 5-year TCO for a blog/newsletter: $500–$800. Hard to beat for this use case.

Verdict

Best choice for newsletters, paid content, and blogs where the editor experience matters and the scope won't expand beyond content publishing. Not the right tool for multi-content-type sites or complex custom post schemas.

Strapi

Strapi is the most widely adopted self-hosted headless CMS in 2026. It lets you define content types through a GUI, generates REST and GraphQL APIs automatically, and gives editors a simple interface to manage that content.

Setup

Create a new project with npx create-strapi-app, configure your database (SQLite for local, PostgreSQL/MySQL for production), and start the admin. Production deployment requires more thought — Strapi doesn't run well on shared hosting and needs a VPS with at least 2 GB RAM for comfort. Expect 1–2 hours for a clean production setup.

Pros

• Content type builder in the admin UI — no code needed to define schemas
• Dual API: REST and GraphQL, both auto-generated
• Role-based access control (RBAC) is mature
• Large plugin/provider ecosystem
• TypeScript support

Cons

• Strapi's licensing changed in 2023 — Community Edition is source-available (not fully open-source). Some enterprise features (SSO, audit logs) require paid plans
• Memory footprint is heavier than PHP alternatives at idle
• Upgrades between major versions (v4 to v5) have been bumpy — migration guides exist but expect a full day of work
• Not a good fit for traditional server-rendered sites — it's API-only

True Cost (5-year)

Self-hosted Community Edition: free. VPS at $10–$15/month: $600–$900. If you need enterprise features: $499+/month. For most dev and agency use, TCO is $700–$1,500 over 5 years.

Verdict

Solid choice for headless projects with custom content types. Best when your front-end team is consuming the API with Next.js, Astro, or Nuxt. Worth reading our headless CMS for Next.js guide before committing to the architecture.

Payload CMS

Payload launched in 2022 and quickly built a following among TypeScript developers. Unlike Strapi, where you define schemas through the UI, Payload's schemas live entirely in code. No GUI for content modeling — your schema is TypeScript config files, version-controlled alongside your app.

Setup

Run npx create-payload-app, define your collections in TypeScript, connect to MongoDB or PostgreSQL. The local setup is clean if you know TypeScript. Production requires Node.js hosting — Payload runs as part of your Node app, so it deploys alongside your front-end if you're using Next.js. VPS or Railway/Render work well.

Pros

• Schema-as-code: everything in version control, reviewable, diffable
• MIT licensed — genuinely open source
• Tight Next.js integration in v3 (can run in the same process)
• Strong TypeScript types throughout — fewer runtime surprises
• Growing community, active GitHub

Cons

• High setup complexity — you need to understand the Payload config model before anything works
• No GUI content modeling: every schema change requires a code edit and redeploy
• MongoDB Atlas is the default path, which adds a SaaS dependency if you're not careful about setup
• v3 (Next.js-native) is great but requires Next.js — limits hosting flexibility
• Admin UI is functional but not as polished as Ghost or UnfoldCMS for non-technical editors

True Cost (5-year)

Free software. VPS or Railway hosting: $6–$20/month. Developer time for initial setup and config: expect 8–16 hours for a production-ready project. 5-year TCO: $800–$2,000 depending on hosting and client expectations.

Verdict

Best for TypeScript-native teams building products (not client sites) who want schema-as-code and Next.js integration. Not a fit for agencies handing sites to non-technical clients — the admin UI requires a developer to maintain schemas.

Directus

Directus takes a different approach from everything else on this list: it wraps your existing database and gives it an admin UI and REST/GraphQL API. You don't define "content types" — you point Directus at a MySQL or PostgreSQL database and it exposes those tables through an admin interface automatically.

Setup

Docker is the recommended deployment. A docker-compose.yml file sets up Directus, the database, and Redis for caching. If you're not comfortable with Docker, the setup is harder. npm install path works but requires more manual configuration. Plan for 1–2 hours.

Pros

• Database-first: works with your existing schema
• No lock-in — your data stays in standard SQL tables
• Auto-generated REST and GraphQL APIs
• Strong for data platform use cases (dashboards, internal tools, analytics views)
• Flows automation feature handles basic event-driven workflows

Cons

• Business Source License (BSL 1.1) — cannot compete with Directus commercially. Read the license if you're building a product
• Not a publishing CMS — the editor experience is a generic data form, not a content writing interface
• Heavy resource requirement when running with Docker compose + Redis
• Theming and front-end rendering are out of scope — this is API/data only

True Cost (5-year)

Self-hosted: free (BSL license). VPS with 2+ GB RAM for Docker: $12–$20/month. 5-year TCO: $720–$1,200.

Verdict

Best for data-heavy back-ends where you already have a database and want an admin UI + API layer over it. Not the right CMS for a content publishing site — editors will find the interface confusing.

Keystone

Keystone is a code-first CMS and application framework built by Thinkmill. Like Payload, schemas live in code. Unlike Payload, Keystone generates a GraphQL API and focuses on PostgreSQL. It's designed as much for building custom apps as for managing content.

Setup

Create a new project with npx create-keystone-app, define your schema in keystone.ts, run migrations. Keystone uses Prisma under the hood, so migration workflow is familiar to Prisma users. Requires PostgreSQL — no SQLite in production. Expect 2–4 hours for a production-ready setup.

Pros

• Extremely flexible — can be a CMS, a backend API, or both
• Strong GraphQL API out of the box
• Prisma migrations — schema changes are version-controlled and reversible
• Document field with embedded component support
• MIT licensed

Cons

• Highest setup complexity on this list — intended for developers who want to build custom
• Community is smaller than Strapi or Payload
• Admin UI is basic — clearly a developer tool, not an editor tool
• GraphQL-first means REST consumers need an extra layer
• Less active development cadence compared to 2021–2022 peak

True Cost (5-year)

Free software. PostgreSQL hosting: $10–$20/month (Neon, Supabase, or self-managed). 5-year TCO: $600–$1,500 plus significant setup and maintenance time.

Verdict

Best for teams building bespoke applications where the content model is genuinely unique and GraphQL is the preferred API shape. Not recommended for client work or non-technical editors.

UnfoldCMS

UnfoldCMS is a PHP/Laravel CMS with a React (shadcn/ui) admin. It's the only platform on this list with a one-time commercial license model — no monthly fees. Built for agencies and solo developers who want a complete, production-ready CMS they can deploy to a standard PHP host and hand to a client.

Full disclosure: this is our product, and we're recommending it where it fits — and not where it doesn't.

Setup

Upload to any PHP 8.3 host, run php artisan migrate, configure .env. Works on shared hosting from $4/month or a VPS. No Docker required, no Node.js runtime needed for the server. Most installs are live in under 30 minutes. A free demo is available at demo.unfoldcms.com so you can test the admin before buying.

Pros

• One-time license: buy once, run indefinitely. No monthly SaaS fees for the CMS itself
• Full REST API at /api/v1/* — 42 endpoints covering posts, pages, categories, menus, and settings, plus Sanctum token auth and HMAC-signed webhooks. Documented in the v1 API launch post
• PHP/Laravel stack: runs on any shared host or VPS, familiar to a large pool of developers
• 210 admin pages built with shadcn/ui components — the admin UI is production-quality, not a rough developer tool
• Content scheduling, media library, categories, comments, SEO fields, redirects — all ships in Core tier
• Headless or traditional: use the built-in templating engine (Aurora theme) or consume via API with Next.js, Astro, or SvelteKit. See headless CMS for Next.js

Cons

• Newer platform: smaller ecosystem and community than WordPress or Strapi
• PHP/Laravel only — not a fit for Node.js-only shops or teams uncomfortable with PHP
• No plugin marketplace yet — customization requires code, not a plugin install
• Commercial license: one-time cost, but not free like MIT-licensed alternatives

True Cost (5-year)

One-time Core license (see pricing page). VPS hosting: $4–$10/month. 5-year total: roughly $300–$600 depending on hosting. The lowest 5-year TCO on this list for a full-featured CMS with a modern admin.

Verdict

Best for PHP developers and agencies who want a complete CMS with a quality admin UI, deploy it to cheap PHP hosting, and avoid monthly CMS subscription fees. If you're building 5+ client sites a year, the per-site TCO math works strongly in your favor.

How to Choose: A Decision Framework

Run through these five questions. Your answers will point to one or two of the platforms above.

1. What's your tech stack? PHP/Laravel → WordPress or UnfoldCMS. Node.js → Ghost, Strapi, Payload, Directus, or Keystone.
2. Who are your editors? Non-technical clients → WordPress or UnfoldCMS (cleaner admin). Technical team only → Payload or Keystone (code-first is fine).
3. Is it headless or server-rendered? Headless API consumption → Strapi, Payload, Directus, or UnfoldCMS's API mode. Server-rendered with built-in templates → WordPress, Ghost, or UnfoldCMS's Aurora theme.
4. Do you need custom content types? Yes, heavily custom → Strapi, Payload, Keystone, or Directus. Standard blog/page model → Ghost or UnfoldCMS.
5. What's the budget model? Absolute zero recurring cost → WordPress (GPL) or Ghost (MIT). One-time cost acceptable, lowest long-term TCO → UnfoldCMS. Open-source Node.js → Strapi Community, Payload, Keystone.

FAQ: Self-Hosted CMS in 2026

What is the easiest self-hosted CMS to set up?

WordPress is the easiest to get running — the 5-minute install on shared hosting is genuinely 5 minutes. UnfoldCMS is close behind for PHP developers. Ghost has a good CLI but requires comfort with the command line. Node.js headless CMSes (Strapi, Payload, Keystone) have the steepest setup curve.

Can I run a self-hosted CMS on shared hosting?

WordPress and UnfoldCMS both run on standard shared PHP hosting from $3–$5/month. Ghost, Strapi, Payload, Directus, and Keystone all require Node.js, which most shared hosts don't support — you need a VPS or a platform like Railway, Render, or Fly.io. See our guide to self-hosted CMS on shared hosting for specifics.

Is self-hosting a CMS cheaper than SaaS?

For small sites, managed SaaS (Ghost Pro at $9/month, Contentful Lite at $30/month) is cheaper than the developer time to self-host. For medium sites and agencies managing multiple clients, self-hosting pays off within 12–18 months. Our 5-year TCO breakdown runs the numbers in detail.

Which self-hosted CMS has the best headless API?

Strapi and Payload have the most mature headless APIs for custom content types. Directus wraps any SQL database with a REST/GraphQL layer. UnfoldCMS ships a versioned REST API at /api/v1/* with 42 endpoints. Ghost has a clean read-only Content API. WordPress's REST API works but carries legacy complexity.

Do I need a developer to run a self-hosted CMS?

For initial setup and updates: yes, for most options on this list. WordPress is the exception — many non-technical users self-host it via managed hosts with one-click installs. UnfoldCMS runs on the same PHP stack as WordPress, so any developer familiar with shared hosting can maintain it. Ghost requires command-line comfort. The rest assume developer oversight.

What is the most secure self-hosted CMS?

Security depends as much on your server config as the CMS itself. That said, Ghost, Payload, and UnfoldCMS have smaller attack surfaces than WordPress simply because they have fewer plugins — plugins are the main vector for WordPress vulnerabilities. Read our self-hosted CMS security guide for hardening steps regardless of platform.

Sources and Methodology

Platform data and feature descriptions were verified against official documentation, GitHub repositories, and licensing pages (as of June 2026). VPS pricing based on Hetzner, DigitalOcean, and Railway published pricing. WordPress vulnerability count from Patchstack 2024 Annual WordPress Security Report. W3Techs market share data from January 2026 snapshot. TCO estimates assume a single production site, 5-year horizon, no managed hosting markup.

Related: Self-Hosted CMS vs SaaS: Which Is Right for Your Team? • Self-Hosted CMS Security: A Practical Guide for 2026 • CMS Pricing Comparison 2026