VonCMS is a lightweight PHP and React CMS not only for shared hosting, but on many levels that suite your needs. It is built for publishers who want a modern admin dashboard, clean public themes, SEO-friendly output, and extensibility without running a heavy plugin stack.
Current release: v1.27.4 "OverDrive". You can install the Deploy ZIP on hosting, or fork the source repository to build your own themes, plugins, extensions, fixes, and release packages.
Website | Live Demo | Releases | Sponsor
VonCMS is open-source software under active development. Review, test, and back up your site before using any CMS release in production.
Note
Before updating a production site, back up its files and database, review the release notes, and test the Deploy ZIP on a local or staging installation when possible. After updating, verify the homepage, one post, one page, and the admin dashboard.
The OverDrive release line uses a slower update cadence so larger changes receive clearer scope, isolated development, deeper verification, and longer canary testing. Exact changes belong in CHANGELOG.md; version-specific upgrade and repair instructions belong in docs/UPGRADE.md.
Traditional CMS platforms are easy to host but often become slow, plugin-heavy, and hard to maintain. Modern headless stacks are powerful but usually add paid hosting assumptions, build pipelines, and too many moving parts for ordinary publishing sites.
VonCMS keeps the runtime simple:
- PHP and MySQL for shared-hosting deployment.
- React 19 for the admin dashboard, editor, media tools, settings, comments, and extensions.
- Server-rendered public metadata for SEO, social cards, sitemaps, feeds, and crawlers.
- Built-in publishing tools so common site features do not require a pile of third-party plugins.
- Source-level customization for developers, designers, agencies, and AI-assisted coding workflows.
Content: posts, pages, drafts, Writer review submissions, scheduled publishing, rich TipTap editor, media manager, categories, excerpts, metadata, keywords, responsive images, and quick edit.
Admin: dashboard, reviewer queue, settings, users, fixed-role boundaries, comments moderation, contact forms, newsletter tools, database utilities, audit logs, and repair tools.
Public site: bundled themes, navigation menus, profiles, category views, search, comments, feeds, sitemap, robots output, llms.txt, JSON-LD, canonical URLs, Open Graph, and Twitter cards.
Extensions: built-in SEO, analytics, gift widget, related posts, promo bar, and AI summary plugins with activation controls.
Developer surface: theme registry, plugin registration, PHP APIs, smoke tests, release packaging, source documentation, and GPL-3.0-only licensing.
| Layer | Requirement |
|---|---|
| PHP | 8.2 or newer |
| Database | MySQL 5.7 or newer |
| Web server | Apache or LiteSpeed with .htaccess |
| Local PHP checks | Laragon, XAMPP, WAMP, or PHP on PATH |
| Source development | Node.js 22.22 or newer and npm |
Production hosting does not need Node.js, Vite, npm, or a separate frontend server. Source development does.
For source work, install Node.js 22.22 or newer from https://nodejs.org/. The installer includes npm. After installing, open a terminal and confirm:
node --version
npm --versionOn Windows, Laragon is the easiest PHP/MySQL stack for local checks. XAMPP, WAMP, native PHP, Docker, or a remote dev server also work as long as PHP and MySQL meet the requirements.
| Goal | Start here |
|---|---|
| Install VonCMS on shared hosting | Download the current published Deploy ZIP from Releases |
| Study the code or build custom features | Fork or clone the repository |
| Build a custom theme, plugin, or extension | Read Extension Development |
| Work on APIs, installer, routing, or updater | Read API, Security, and Routing |
| Upgrade an existing website | Read Upgrade |
Use this path for normal site owners and shared-hosting installs.
- Download the current published Deploy ZIP from Releases.
- Extract it into your hosting web root.
- Create a MySQL database and database user.
- Open
https://yourdomain.com/install. - Complete the installer wizard.
- Sign in at
/admin. - Publish or import content, choose a theme, and configure settings.
See Installation, Upgrade, and VPS Deployment for hosting notes.
Use this path for developers, designers, agencies, advanced users, and AI-assisted workflows.
Fork the repository on GitHub, clone it, and install dependencies:
git clone https://github.com/YOUR-USERNAME/VonCMS.git
cd VonCMS
npm installYou can also download the Source ZIP from Releases and extract it locally. A Git fork is better when you plan to contribute changes back. Open the project folder directly in any editor you prefer:
- Cursor
- Visual Studio Code
- Antigravity-style AI IDEs
- PhpStorm or another PHP IDE
- Claude CLI, Codex CLI, or another terminal-based coding agent
- Plain terminal plus your editor of choice
The workflow is flexible. VonCMS does not require one official IDE. Keep the terminal at the repository root so commands resolve package.json, vite.config.ts, public/, src/, and docs/ correctly.
Common source checks:
npm run typecheck
npm run buildFor PHP linting with Laragon on Windows, set PHP_BIN to your local php.exe first:
$env:PHP_BIN='C:\laragon\bin\php\php-8.4.22-Win32-vs17-x64\php.exe'
npm run lint:phpThe Vite dev server is useful while editing React themes, admin screens, plugins, and components:
npm run devIf you need PHP APIs, point the dev proxy at your local PHP host with VITE_PROXY_TARGET, or test the production build through Apache/LiteSpeed after:
npm run buildFor contributor expectations, formatting, audits, release gates, and pull request rules, read CONTRIBUTING.md.
VonCMS is built as a compiled React application plus a PHP API/runtime.
Browser
-> public/index.php
-> built React assets
-> public/api/*.php
-> MySQL
The public entry point handles routing, crawler metadata, installation checks, maintenance mode, canonical URLs, redirects, and hydration data. The React app owns the interactive dashboard and public theme rendering after boot. PHP APIs handle authentication, settings, posts, pages, media, comments, newsletters, analytics, imports, backups, and repair tools.
src/
App.tsx Public/admin routing shell
hooks/ Shared React data hooks
components/ Editor, layout, renderer, UI components
plugins/von-core/features/ Core admin features and built-in plugins
themes/ Bundled public themes
public/
index.php PHP public entry and hydration bridge
api/ PHP API endpoints
install.sql Fresh install schema/settings seed
.htaccess Public routing and hardening rules
fonts/ Local web fonts used by bundled themes
docs/ Developer and operator documentation
server/test-integration.cjs Integration smoke gate
create_release.cjs Deploy and Source ZIP packaging
remove-bom.cjs UTF-8 BOM cleanup utility
VonCMS ships with Default, TechPress, Digest, Portfolio, Prism, and Corporate Pro themes. Theme registration lives in src/plugins/von-core/features/themes/themeRegistry.ts, while theme implementations live in src/themes/.
Fresh installs use Inter, sans-serif by default. VonCMS does not load Google Fonts at runtime; Inter is shipped locally as variable WOFF2 files under public/fonts/inter/ and wired through the bundled CSS. The bundled Inter files include a font license notice at public/fonts/inter/LICENSE.txt. If a custom theme needs another branded font, add the licensed font files to that theme and reference them from the theme CSS. For a practical font workflow, read Custom Fonts.
Start with Extension Development. Themes are for presentation and public UX. A compiling layout is not automatically VonCMS-compatible: it must satisfy the documented route/state, shared data, settings, base-path link, SEO/SSR, media, accessibility, performance, and verification contracts. Themes should use shared props and hooks, render post and page content through the shared renderer, and avoid duplicating runtime ownership that the core already provides.
Common files:
src/themes/<theme>/Layout.tsxsrc/themes/types.tssrc/plugins/von-core/features/themes/themeRegistry.tssrc/plugins/von-core/features/extensions/components/DefaultThemeSettings.tsx
Start with Extension Development. Plugins and extensions are for optional behavior: SEO helpers, analytics, widgets, article blocks, campaign bars, integrations, and admin tools. Built-in plugin code lives under src/plugins/von-core/features/plugins/built-in/. Follow the documented system, Custom HTML/CSS, or backend-integrated plugin boundary; keep settings ownership explicit, sanitize public HTML, use the shared activation decision, clean up runtime work, and verify inactive, active, route-change, and subfolder behavior.
Useful docs:
The installer uses public/install.sql and the PHP installer endpoints under public/api/. The public runtime uses public/index.php and .htaccess for install checks, maintenance mode, crawler metadata, canonical URL handling, and SPA hydration.
If you work on install, routing, updater, or .htaccess behavior, read:
Use npm outdated as a review list, not as an automatic upgrade command. Upgrade packages in small batches and rerun the relevant verification after each batch. For the full command set and pull request standard, read CONTRIBUTING.md.
Before creating release ZIPs:
npm run typecheck
npx prettier --check .
node remove-bom.cjs
npm run build
npm run test:integration
npm run lint:php
node create_release.cjscreate_release.cjs creates:
VonCMS_v<version>_Deploy.zipVonCMS_v<version>_Source.zip
No checksum sidecar files are generated by the release script.
Run this full sequence for release preparation, not for ordinary first-time source reading.
- Installation
- Features
- Upgrade
- VPS Deployment
- API
- Routing
- Security
- Extension Development
- Custom Fonts
- Release Notes
- Contributing
Before changing code, inspect the existing implementation and read the focused docs for the area you are touching. Keep changes scoped, preserve backwards compatibility unless the issue requires otherwise, and run the relevant checks before opening a pull request.
For public contribution rules, issue guidance, pull request expectations, and security reporting notes, read CONTRIBUTING.md.
If you find a serious security issue, do not open a public issue with exploit details. Contact the maintainer privately first so the issue can be verified and patched responsibly.
Read Upgrade before changing a production installation. It contains the supported version-specific database, configuration, routing, OTA, manual-update, and rollback instructions.
The safe manual-update baseline is:
- Back up files and database.
- Delete the old
assets/anddocs/folders. Both contain release-managed files; neither stores uploads, posts, settings, or database content. - Upload and extract the complete new Deploy ZIP, allowing its application files to replace the old release.
- Keep
von_config.php,data/,uploads/,backups/, and the live.htaccessfile protected from manual replacement or deletion. - Visit the site and admin dashboard, then confirm the Dashboard shows the expected release version.
- Follow any Database Repair,
.htaccessrepair, or configuration migration instruction shown for the installed starting version in Upgrade. - Verify one homepage, one post, one page, and
/adminbefore ending maintenance.
After a site is already on the fixed updater baseline, the dashboard updater can be used for later patches when the host allows outbound release downloads. OTA activation replaces the release-managed assets/ and docs/ directories as complete rollback-protected units, so retired fingerprinted bundles and guides cannot remain beside the current release.
Current shipped release truth lives in CHANGELOG.md. Public developer guidance lives in CONTRIBUTING.md and the focused files under docs/.
VonCMS is released under the GPL-3.0-only license. See LICENSE.md.