A content management system (CMS) lets people create and maintain a website through a browser-based admin panel instead of editing files. Pages and posts live in a database; a theme turns them into mobile-friendly HTML, and plugins add features such as forms, shops, SEO metadata and user accounts.
| CMS | Model | % of all websites | % of CMS market |
|---|---|---|---|
| WordPress 48 | Open source (PHP) | 40.3% | 58.8% |
| Shopify 175 | SaaS store builder | 5.4% | 7.8% |
| Wix 630 | SaaS site builder | 4.2% | 6.2% |
| Squarespace 548 | SaaS site builder | 2.4% | 3.5% |
| Joomla 3,017 | Open source (PHP) | 1.1% | 1.6% |
| Webflow 2,768 | SaaS visual builder | 0.8% | 1.2% |
| Drupal 2,652 | Open source (PHP) | 0.6% | 0.9% |
| Ghost 4,223 | Open source (Node.js 2,131 ) | 0.1% | 0.1% |
Since May 2021 WordPress has held roughly steady (41.2% then), while Joomla (2.1%) and Drupal (1.5%) have lost about half their share.
The open-source systems
WordPress began as blogging software in 2003 and is licensed under the GPL. Download it from wordpress.org and host it on any PHP and MySQL 524 server; wordpress.com is a separate commercial service that hosts it for you. WordPress 7.0 (May 2026) added a central hub for AI features, and 7.1 followed on August 19, 2026.
Joomla sits between WordPress and Drupal in complexity, with multilingual sites and access control built in. Joomla 6.1 was released on April 14, 2026.
Drupal suits large sites with complex, structured content and permissions. Drupal 11.4 is current; Drupal 12 is scheduled for the week of December 7, 2026, when Drupal 10 reaches end of life.
Ghost is an MIT-licensed Node.js platform for publications with paid memberships and newsletters. Ghost 6.0 (August 2025) lets people follow a site from Mastodon 6,501 , Threads and other ActivityPub apps. Try it locally with npm 2,036 install ghost-cli -g and ghost install local.
Headless CMSs
A headless CMS keeps the admin panel and database but drops the theme layer. It serves content as JSON through a REST or GraphQL API, and you build the front end with any framework (JavaScript) or even a mobile app. WordPress itself can run headless, because every installation exposes a REST API at /wp-json/.
const api = 'https://wordpress.org/news/wp-json/wp/v2/posts';
const res = await fetch(`${api}?per_page=3&_fields=date,title,link`);
const posts = await res.json();
console.log('Total posts:', res.headers.get('X-WP-Total'));
for (const p of posts) {
console.log(p.date.slice(0, 10), p.title.rendered);
}Total posts: 1106 2026-09-07 Students Built 108 Websites in Two Weeks in Bangladesh 2026-08-27 WordPress Signs the Open Weights and American AI Leadership Letter 2026-08-20 AI Creates Opportunity While Artists Ship at WordCamp US 2026
Save it as posts.mjs (so top-level await works) and run node posts.mjs. _fields trims the JSON; X-WP-Total gives the collection size, since per_page is capped at 100.
| Product | License and hosting | Strengths | Weaknesses |
|---|---|---|---|
| Strapi 27,803 | MIT core; self-hosted | Visual schema builder | Enterprise-only extras |
| Payload 147,596 | MIT; inside Next.js 10,514 | TypeScript config | Tied to Next.js |
| Sanity 4,319 | MIT editor; hosted data | Live collaboration | Growth $15/seat/month |
| Contentful | Commercial SaaS | Enterprise workflows | Cost grows with usage |
Choose a traditional CMS when non-developers must publish on a budget, a SaaS builder when nobody wants to maintain servers, and a headless CMS when developers own the front end. Keep core, themes and plugins updated, and delete unused plugins: each is code an attacker can probe.