v1.02 Open source · PHP + Vue · Self-hosted

Model once.
Serve it themed or headless.

Modular is a security-first CMS for teams who outgrew WordPress but miss its flexibility. Built-in field management, relational models on MySQL, role-based access. No plugin roulette.

Get started View on GitHub
Security by design MySQL, relational EU / GDPR ready
content.js 
1// Fetch a published post through the headless API
2const res = await fetch(
3  'https://cms.acme.eu/api/v1/public/posts/field-notes?type=articles'
4)
5
6const post = await res.json()
7
8post.title        //=> "Field notes, no. 7"
9post.slug         //=> "field-notes"
10post.author.name  //=> "Lena Vos"
11post.status       //=> "published"
200 OK · 38ms · application/json
Why Modular

Everything WordPress needs a plugin for. Built in.

One core that ships with the parts most teams bolt on after the fact, modeling, access control, an API, and nothing you have to vet a marketplace for.

Headless and themed

Render with PHP themes or pull through the JSON API. Same content model, no rebuild, no second system to keep in sync.

Field management, native

ACF-style field builder in the UI. Define types, validation and relations without a single plugin or YAML file.

Security by design

Role-based permissions, hardened defaults and tracked schema migrations are in the core, not a paid add-on.

Self-hosted, EU-first

Your servers, your database, your data. GDPR-friendly by default and fully open source. No vendor lock-in.

One source, two modes

The same content, served the way each project needs it.

Marketing site rendered server-side for speed and SEO. Mobile app and storefront fed by the API. You model it once, Modular handles both.

No duplicate setup

One schema powers themes and the API at the same time.

Switch per project

Go headless for a new channel without migrating anything.

Themes are just PHP

Plain templates and a small helper API. No build step required.

acme.eu/journal/field-notes
Journal
Field notes, no. 7
Lena Vos · 18 May 2026 · 4 min read

We rebuilt our content model around relations instead of duplicated fields. Here is what changed for the editorial team.

The short version: fewer screens, fewer mistakes, and a single source for every channel.

GET /api/v1/public/posts/field-notes
{
  "id": 142,
  "title": "Field notes, no. 7",
  "slug": "field-notes",
  "status": "published",
  "post_type": "articles",
  "published_at": "2026-03-12T09:00:00",
  "author": { "name": "Lena Vos" },
  "content": {
    "cover": { "type": "image", "data": { "url": "/media/fn-7.webp" } }
  }
}
200 OK · 38ms · application/json
Content modeling

Build the model in the UI. Get the API for free.

An ACF-style field builder backed by real relational tables in MySQL. Define a field, and it shows up in the editor, the validation layer and the API response, instantly.

Field builder

articles
Titletitlerequiredtext
Authorauthor → authorsrelationship
Covercoverimage
Bodybodywysiwyg
Published atpublished_atdatetime

Generated response

GET /api/v1/public/posts/:slug 
{
  "id": 142,
  "title": "Field notes, no. 7",
  "slug": "field-notes",
  "post_type": "articles",
  "author": { "id": 7, "name": "Lena Vos" },
  "content": {
    "cover": { "type": "image", "data": { "url": "/media/fn-7.webp" } },
    "body":  { "type": "wysiwyg", "data": "<p>…</p>" }
  },
  "published_at": "2026-03-12T09:00:00"
}

On the public post endpoint, relationship fields resolve to nested objects and the author is included. Each field keeps its type. Change the model in the admin and the editor, the stored data and the API response follow.

Security

No marketplace to audit. No abandoned plugin holding a CVE. Security lives in the core, and it ships hardened.

Role-based permissions

Granular access per collection, field and action. Roles are first-class, not retrofitted onto a flat user table.

Hardened by default

CSRF protection, scoped API tokens, rate limiting and secure headers on from the first request.

Versioned schema migrations

Every model change is a tracked, reversible migration. Promote from staging to production with confidence.

Modules

Extensions, without the plugin roulette.

Plugins made WordPress endless, and impossible to trust. Modules are our answer: one curated, API-first extension per job, reviewed by us and supported in the core. Anyone can build one. Only the ones we approve ever show up in your install.

Browse all modules

One module per job

No twelve competing SEO plugins. We develop a single official module for each capability, held to one standard, so there is never a question of which one to trust.

API-first, fully wired

Every module is built API-first and connected through the core, permissions, migrations and the headless API included. Not bolted on the side, part of the system.

Reviewed, or it won't ship

Build your own freely. But until it meets our every demand and we sign off, it is unsupported and invisible to the platform. No marketplace, no surprise CVEs.

Available now

Built and maintained by Atypisch
Available

SEO

Meta tags, sitemaps, canonical URLs, structured data and redirects. Managed in the admin, served by your themes and the API alike.

Explore SEO
Available

Translation

Per-field localisation, language fallbacks and a translation workflow. One content model, every locale, resolved through the same API.

Explore Translation
Available

Community

Accounts, comments, profiles and moderation. Add a members layer to any project without standing up a second system to keep in sync.

Explore Community
In development

More on the way

Commerce, forms, search and analytics are on the roadmap. Each one built to the same bar before it ever ships.

See the roadmap

Some modules are commercial. Built and maintained by Atypisch, paid modules fund Modular's open-source core, so the platform itself stays free and open, for good.

Developer experience

An API you can read on the first try.

Predictable queries, typed responses and a stack you already know, PHP on the server, Vue in the admin. Pick the client that fits the job.

Plain JSON over REST

Read a post or a list of a type. No query language and no client library to learn.

Relations resolved for you

The public post endpoint resolves relationship fields and includes the author.

Themes are plain PHP

Helpers like get_posts() and get_post(). No build step, no SDK.

// List published articles over the headless API
const res = await fetch(
  'https://cms.acme.eu/api/v1/public/posts?type=articles'
)
const { posts } = await res.json()

posts[0].title   //=> "Field notes, no. 7"
posts[0].slug    //=> "field-notes"
posts.length     //=> up to 100 published posts
<?php
// Same content, rendered by a Modular theme
$posts = get_posts([
    'post_type'      => 'articles',
    'posts_per_page' => 10,
    'orderby'        => 'published_at',
]);

foreach ($posts as $post): ?>
  <h2><?= e($post['title']) ?></h2>
<?php endforeach; ?>
# a list of one post type
curl "https://cms.acme.eu/api/v1/public/posts?type=articles"

# a single post, relations and author resolved
curl "https://cms.acme.eu/api/v1/public/posts/field-notes?type=articles"
typed · documented · versioned
Open source & European

Built in Europe. Owned by everyone who runs it.

Modular is MIT-licensed and developed in the open. The roadmap is public, the code is auditable, and your data never leaves infrastructure you control.

No seats to count, no SaaS tier gating your API, no clause that turns the lights off if you stop paying. Self-host it, fork it, ship it.

MIT licensed PHP 8.1+ & Vue 3 MySQL 8 / MariaDB Docker-ready
40+
Field types
6
Core modules
4
Add-on modules
MIT
Licensed
How it compares

One core, where others need a stack of choices.

A like-for-like look at what ships in the box. Headless-only tools skip themed rendering; classic CMSs bolt the API on later.

Modular WordPress Directus Storyblok Payload Drupal Strapi
Headless API, native
Themed (server-rendered)
Field management, no plugins
Role-based permissions
Self-hosted
EU data control
Open source
Field-level permissions
Headless and themed, one install
Versioned schema migrations
Security hardening in core, no plugins
Public RFC roadmap
Visual block editor
Advanced custom fields, built in
Built-in multilingual content
REST API in the core
Stack PHP · Vue PHP Node · Vue SaaS Node · React PHP Node · React

Comparison reflects out-of-the-box capabilities. indicates partial support or requires extra modules. Last reviewed May 2026.

Get started

Stop fighting your CMS.

Spin up Modular with Docker in minutes. Model your content, ship a theme, or point your app at the API. Self-hosted, open source, yours.

Get started Read the docs
Tweaks