Why We Built a Laravel CMS Instead of Using WordPress

I spent a weekend patching a hacked WordPress site for a client in 2024. A plugin nobody remembered installing had a known CVE, and the fix broke two other plugins. That weekend is why UnfoldCMS exists — and why it runs on Laravel, not WordPress.

This is the honest story of why I built a CMS on Laravel + React instead of using what 43% of the web already runs. Not a sales pitch — a build log. If you're a developer weighing the same choice, the reasoning might save you a few of your own weekends.

TL;DR: I build in Laravel daily. Every time a project needed content management, WordPress dragged a second framework, a plugin security surface, and a separate deploy into an otherwise clean stack. So I built the CMS I wanted: Laravel 12 + React 19 + Inertia, a shadcn/ui admin, self-hosted, one-time price. This post is why each of those decisions happened.

The Weekend That Started It

The hacked site wasn't unusual. Patchstack's 2024 report counted 7,966 WordPress vulnerabilities in a year, about 96% from plugins and themes. My client's site had a dozen plugins; one was the door. Patching it meant untangling version conflicts I didn't create, on a stack I don't write in daily.

The frustrating part: the site was simple. A blog, a few pages, a contact form. It didn't need a plugin ecosystem — it needed a clean content admin. WordPress was overkill in features and underkill in safety, all at once.

I went back to my Laravel projects that Monday and asked the obvious question: why am I leaving Laravel to manage content, when Laravel can do this?

Why Laravel, Not WordPress

WordPress and Laravel are both PHP, but they come from different eras. WordPress carries 20 years of backward-compatibility — global functions, a hook system, a plugin model built before modern security practices. Laravel gives me Eloquent, the service container, typed code, migrations, and a testing culture.

When I'm already living in Laravel, bolting WordPress onto a project means:

• A second mental model — different conventions, different debugging, every time I touch content.
• A second security surface — every plugin is code I didn't write, patched on someone else's schedule.
• A second deploy — WordPress wants its own setup, often a separate server.

Building the CMS in Laravel removed all three. One framework, one deploy, one codebase I actually understand. That was decision number one, and everything else followed from it.

Why React + Inertia for the Admin

I could have built a Blade admin. I chose React 19 + Inertia 2 instead, for one reason: the admin is where you live when you run a site, and it should feel like a real app, not a form-submit-reload relic.

Inertia let me write a single-page React admin without building a separate API and SPA from scratch — Laravel controllers return Inertia responses, React renders them, no REST glue in between. For the components, I used shadcn/ui: 51 components I own as code, not a vendor widget library I rent. The admin ended up at 210 pages, all React, all themeable.

The payoff: the admin feels modern because it is modern, and I never left the Laravel request lifecycle to get there.

Why Self-Hosted and One-Time Pricing

I was tired of two bills: the SaaS-CMS subscription that grows with usage, and the time-cost of someone else owning my content. So UnfoldCMS is self-hosted and source-available, with one-time pricing — $29, $99, or $299, no monthly fee.

The logic is simple. If I'm a Laravel dev, I already run servers. A $5/month VPS hosts the CMS fine. Paying a metered SaaS bill on top of infrastructure I already manage never made sense to me. One-time pricing means the cost is a line item, not a recurring tax, and self-hosting means the data is mine — no export negotiation if I ever leave.

When WordPress Is Still the Right Call

I'm not going to pretend WordPress is wrong for everyone — that would be dishonest, and you'd see through it.

WordPress still wins when:

• A non-technical person owns the site and the huge plugin/theme ecosystem matters more than a clean stack.
• You need a specific plugin that only exists for WordPress (some niche e-commerce or membership tools).
• There's no developer in the loop at all and you want the largest community and tutorial base.

If that's you, stay on WordPress. UnfoldCMS is for developers — specifically Laravel developers — who want content management inside the stack they already run, without the plugin-security tax. For the broader landscape, our WordPress alternative guide maps every option by who you are.

What I'd Tell You If You're Choosing

If you build in Laravel and a project needs content management, try a Laravel-native CMS before you reach for WordPress. You keep one stack, one deploy, and a security surface you control.

• See how it fits your stack: UnfoldCMS for Laravel.
• Compare it to WordPress directly: UnfoldCMS vs WordPress.
• Already on WordPress and moving? The migration guide keeps your URLs and SEO.
• Just want the price: one-time, $29–$299.

Frequently Asked Questions

Why build a new CMS instead of using headless WordPress?

Headless WordPress keeps every WordPress problem — plugin security, update churn, a separate server — and adds an API layer on top. As a Laravel developer, that's two systems to maintain when I wanted my content inside the one stack I already run. Building on Laravel removed the second system entirely.

Is a Laravel CMS actually more secure than WordPress?

It reduces one specific risk: plugin and theme vulnerabilities, which Patchstack found account for ~96% of WordPress CVEs. A Laravel CMS with fewer third-party extensions has a smaller attack surface. It's not magic — any app can be insecure — but you control the code instead of inheriting a plugin ecosystem you didn't write.

Do I need to know React to use a Laravel CMS with a React admin?

No. The admin is prebuilt — you use it like any app. You'd only touch React if you wanted to customize the admin itself, and because it's shadcn/ui components you own as code, you can. Day-to-day content editing needs no React knowledge.

Is UnfoldCMS open source?

It's source-available — you get the full code with your license and can read, fork, and modify the admin. It's not a free OSS project; it uses one-time pricing ($29–$299). The distinction matters: you own and can change the code, without a subscription, but it isn't released under a permissive open-source license.

Sources & Methodology

This is a first-person account of building UnfoldCMS, published by its maker. WordPress vulnerability figures are from the Patchstack State of WordPress Security 2024 report (7,966 vulnerabilities, ~96% from plugins/themes); WordPress market share from W3Techs (2025). UnfoldCMS technical details — Laravel 12, React 19, Inertia 2, 51 shadcn/ui components, 210 admin pages, self-hosted, one-time pricing — are verified against the live product and cms-features.md on 2026-06-14.

Published by Hamed Pakdaman, builder of UnfoldCMS. This is a vendor's blog and a founder's story — the WordPress criticism is real, and so is the section on when WordPress still beats us.