Concrete CMS

Page types plus roughly twenty core attribute types (text, number, date, select, address, image/file, topics, page/user selectors, Express entity) and UI-defined Express objects give reasonable custom modelling. There is no schema-as-code, no repeater or union field and no JSON field type, which keeps it at the bottom of the adequate band.

Express associations support one-to-one, one-to-many and many-to-many with an inverse side, and page/user selector attributes link pages to other records. Reverse traversal outside Express needs PHP API calls and there are no polymorphic references, so it sits in the adequate band rather than higher.

Pages are composed of blocks placed in areas, with layouts, containers (since 9.0), stacks and global areas providing nested composition, and the Express block embeds structured entries in pages. Composition is page-centric and rich text is an HTML blob; structured entries themselves are flat with no nested component fields.

Required attributes in composer and Express forms, per-type settings and a unique-value constraint (added in 9.1) cover the basics. There is no regex or cross-field rule builder in the UI and custom rules require PHP, so it lands in the standard built-in band, toward the lower end.

Every page edit creates an attributed version with approve, compare (HTML diff since 9.1) and one-click rollback, files carry their own version history, and deleted pages go to a Trash with restore. Express entries are not versioned and there is no branching or release model, so it stays below 80.

Topics provide hierarchical, permission-controlled taxonomy trees that can be attached as an attribute to pages, files, users and Express objects, and the topic list/page list blocks filter by term; a tags attribute and file sets add flat classification and bulk attribute editing exists in search results. Synonyms are absent and taxonomy terms are thinly exposed through the REST API, which keeps it short of 75.

Editors edit directly on the rendered page in edit mode, preview unapproved versions in place and view per-locale trees, which is genuine in-context editing on the site visitors see. It applies only to Concrete's own rendering, with no shareable draft preview links or headless preview SDKs, so it stays in the adequate band.

The rich text editor is CKEditor 4 (pinned at 4.22.1) with snippets, file/page linking and image insertion. Output is an HTML blob, the editor library is end-of-life upstream and the Concrete 10 replacement is undecided, so it sits at the low end of the standard WYSIWYG band.

The file manager handles upload, folders, file attributes for alt text and metadata, an in-browser image editor and automatic thumbnail types for responsive images. There is no focal point, no core WebP/AVIF conversion (marketplace add-on) and no URL-based transforms, so it is basic upload-and-serve.

Pages are checked out while in edit mode, which warns other editors and prevents simultaneous edits, and version history attributes changes to users. There is no co-editing, presence, inline commenting or mentions, so it sits just above last-write-wins.

Workflows attach to permission keys (approve version, delete, move) per page or page type, with notifications and a Waiting for Me queue that leaves an audit trail. Routing is sequential with no custom states, due dates or conditional paths, so it sits mid-band for multi-step approvals.

Page versions can be scheduled to publish at a date and time, and version scheduling supports an end date for unpublishing. There are no release bundles to publish many items atomically and no publishing calendar, so it lands in the lower part of the 60 to 74 band.

Multilingual sites use separate locale trees with copy-locale, page associations across locales, RTL support and language-detection redirects. Localization is document-level only, with no field-level localization, no fallback chains and no locale model for Express entries.

Advanced permissions give granular page, area, block, file-folder and per-attribute edit rights to groups, group sets and time-based access entities, and OAuth2 social login is core with SAML via the Macareux add-on. There is no SCIM and SSO for editors depends on add-ons, which keeps it below 65.

A REST API with OAuth2/OIDC covers pages, files, users, sites and blocks, introduced in 9.0 and extended since. It is REST-only with no GraphQL and limited filtering, sorting and locale-aware querying, so it scores below a well-designed REST API.

Self-hosted installs serve directly from the PHP application, and CDN use relies on a documented CloudFront setup or the 'Use CDN!' marketplace add-on. Vendor hosting publishes no CDN or cache-purge specs, so it sits in the self-hosted-without-CDN band.

Concrete exposes a broad list of internal PHP application events (page add, version approve, delete, user events) that developers can hook in packages. There is no native outbound HTTP webhook system with signing, retries or delivery logs, so it scores as basic.

Content is primarily rendered through themes and templates (Twig support added in 9.5.0), with the REST API as a secondary channel. Rich text is HTML, there are no official JS or mobile SDKs, and headless use is an afterthought, placing it below the traditional-CMS-with-API band.

User groups, automated group assignment and user attributes give a native but static way to segment logged-in visitors. There is no behavioral segmentation, anonymous visitor profiling or CDP connector, so it sits at the low end.

Block and area view permissions let editors show or hide content for specific user groups, a native form of group-based targeting. There are no content variants per segment, no audience preview and no decision engine integration.

No current A/B or multivariate testing capability exists; the old Experimenter add-on dates from concrete5 5.6 and is no longer sold. Testing would require a fully external tool injected via tracking code.

Only manual and rule-based curation exists (page list, related pages by topic, Boards that aggregate content chronologically). There is no algorithmic recommendation engine.

A core search block backed by a MySQL full-text page index covers page name, description and body content, and page lists can be filtered by topics. It lacks faceting, typo tolerance, autocomplete and search analytics, and there is no official Algolia or Elasticsearch connector, so it scores as basic native search.

Community Store, a free community-maintained add-on, provides a catalog, variations, cart, checkout, shipping and payment gateways and is actively developed. It is not part of the vendor's core product, so it is scored as an integration below its ceiling.

Marketplace add-ons embed Shopify products (Buy Button style) and Snipcart. There are no connectors for commercetools, BigCommerce, SFCC or SAP and no live API federation, placing it in the product-picker band.

Core reports cover form results, logs and file download counts (Total File Downloads since 9.4.0). Page performance and engagement analytics rely on Matomo or Google Analytics, so native analytics are mostly operational.

Site-wide header and footer tracking code fields make GA4, Matomo or GTM installation simple, and marketplace add-ons extend Google Analytics with OAuth2 dashboards. There are no event helpers or Segment/Adobe connectors, so it stays in the mid band.

Core multisite runs several sites from one install with site types, shared users, shared file manager and per-site configuration under one dashboard. Sharing page content across sites is limited and the feature is lightly documented, so it sits below the shared-content band.

Interface strings can be translated through the Translations Manager add-on and the community translation portal, but content translation means copying locale trees and editing by hand. No TMS connector or machine translation hook exists for page content.

Site types with skeleton templates, shared themes and per-site group permissions give some centralized control over several brands. There is no shared component library with brand overrides, cross-brand approval or policy enforcement.

The core file manager offers folders, file sets, custom file attributes and topics, versioning, folder permissions, external storage locations and download tracking, and the free Brand Central add-on adds a brand portal. There are no rights, expiry or asset approval workflows, so it sits at the bottom of the library-with-taxonomy band.

The core video player block plays uploaded MP4/WebM files and the YouTube block embeds external video. There is no transcoding, adaptive streaming or caption management.

Marketers drag blocks into areas, build column layouts and theme containers, reuse stacks and global areas, and start pages from page type defaults with locked areas, all in context on the live page. Brand guardrails are coarse and there is no visual composition for headless frontends, which keeps it just below 75.

Concrete renders full sites through themes and page templates, and the vendor (PortlandLabs) sells managed hosting and SaaS plans at concretecms.com as a separate paid service. Self-hosting is the default open-source path and the hosted offer publishes little on CDN or SLA, so it sits in the separate-hosting band.

The core Form block is an Express-backed builder with stored submissions, email notifications, reCAPTCHA and SecurImage spam protection and Express entry management. Conditional logic and multi-step forms require Formidable or Form Reform add-ons, so it is a solid basic builder.

A third-party Mailchimp add-on offers subscribe blocks, and core mail is transactional only (Symfony Mailer in 9.5.0). There is no content push, triggered sends or connectors for HubSpot, Marketo or SFMC.

No marketing automation exists in core or through an official connector. Lead nurturing would need an external tool wired up through tracking code or custom form handlers.

Core provides per-page meta title and description, a bulk SEO editor in the dashboard, pretty URL slugs with additional page paths that redirect, canonical URL settings and an automated sitemap.xml with multilingual alternates. There is no regex redirect manager, structured data authoring or on-page recommendations.

No llms.txt generation, Markdown endpoints, AI crawler controls or AI citation reporting were found in core or the marketplace. Anything beyond standard SEO and a hand-edited robots.txt would need custom work.

market.concretecms.com lists a few hundred add-ons and themes with Try Before You Buy, and monthly roundups show steady new listings. Integrations with major SaaS vendors are few and mostly third-party (Shopify, Snipcart, Mailchimp, Stripe, SAML, S3, CDN), so it is a small-to-mid marketplace.

Core supports public registration with validation, social login via OAuth2 (Google, Facebook, X), public member profiles, private messaging, a My Account area and permission-gated pages and blocks keyed to user groups. CIAM federation needs the SAML add-on and there is no consent or preference center, keeping it below 75.

Concrete CMS ships a built-in REST API since 9.2+ with OAuth2 and OpenID Connect authentication and endpoints for pages, files, and Express objects, documented via Swagger UI. No GraphQL API exists — the 2022 proposal explicitly stated GraphQL work 'has not yet been started' and as of the 9.5.2 release (June 2026) no GraphQL delivery is documented; only a community graphql-websocket package exists. Filtering and sorting depth remains limited compared to headless-first platforms.

Concrete CMS is a self-hosted PHP platform with no built-in CDN or documented API rate limits. CDN integration requires external configuration via CloudFront or Azure CDN tutorials. No published throughput benchmarks or pagination ceiling documentation for the REST API. The official enterprise hosting does not publish CDN-backed API delivery specs.

No official SDKs are published for JavaScript, TypeScript, Python, Ruby, Java, .NET, or mobile. The platform is PHP-native and the PHP application framework is the primary developer surface. Community packages exist on Packagist and the Concrete Marketplace for PHP, but no multi-language official SDK ecosystem has been established and no SDK announcements appeared through the 9.5.x releases.

The Concrete CMS Marketplace (market.concretecms.com) lists thousands of add-ons and themes spanning SEO, forms, e-commerce, analytics, translation, and authentication, with continued 2025–2026 additions (Macareux SAML Authentication, Two-Step Authentication Advanced in March 2026). Breadth is solid for a traditional CMS, though the marketplace skews PHP-commercial and many integrations are narrow single-purpose add-ons rather than platform-grade integrations.

Concrete CMS provides a mature PHP extensibility model: custom block types (UI and rendering), custom packages, custom attribute types, custom single pages, custom themes, and a PHP event/hook system throughout the core. Version 9.5.0 (April 2026) added Twig templating support in block views, page templates, and single pages, modernizing the templating layer. No headless App Framework for cloud-hosted JavaScript extensions exists, but for a self-hosted PHP CMS the extensibility depth is strong.

OAuth2 and OpenID Connect are built into the Concrete CMS REST API core for API token management. SAML 2.0 SSO remains a marketplace add-on (Macareux SAML Authentication) rather than core, and MFA likewise depends on marketplace add-ons (Two-Step Authentication Advanced, March 2026; Two-Factor Login Security). SSO and MFA requiring third-party add-ons rather than core functionality keeps this below the 78+ threshold for mid-tier SSO inclusion.

Concrete CMS has a sophisticated RBAC system: group-based user management, granular page/page-type-level permissions, time-based access control, permission exclusions for rule exceptions, and custom single-page permissions. The 9.5 releases also shipped permission fixes, indicating active maintenance. This exceeds predefined-roles-only, but no field-level permissions are documented and content-instance access control is not a core GUI feature.

PortlandLabs now publishes a dedicated hosting compliance page detailing SOC 2 Type 2 and ISO 27001 certification plus HIPAA compliance and FedRAMP Moderate / DoD IL2 controls with continuous monitoring for the managed hosting tier, backed by specifics (AWS CIS benchmarks, FIPS 140-2 MFA, encryption at rest/in transit, annual independent penetration and DR testing) — a substantial, well-documented improvement over the prior thin posture. It stays below the 80+ band because the certifications cover only the managed hosting offering (Concrete is predominantly self-hosted, where compliance is operator-owned), there is no explicit GDPR/EU data residency claim, and no public trust portal or audit reports are accessible.

Concrete CMS operates a HackerOne responsible disclosure program and is a CVE Numbering Authority with high-quality advisories and prompt patching, and has no known major data breach. However, 2026 was a heavy vulnerability year: CVE-2026-7888 (unauthenticated PHP object injection RCE via unsafe unserialize() in Workflow/Form/File components, CVSS v4.0 8.4 High, fixed 9.5.2), CVE-2026-3452 (authenticated RCE via Express Entry List, fixed 9.4.8), CVE-2026-8350 (privilege escalation to admin group), CVE-2026-8203 (stored XSS), plus earlier CSRF-to-RCE issues. The shift into unauthenticated-RCE-class findings, despite transparent disclosure and fast fixes, holds this in the mid-50s.

Concrete CMS is available as self-hosted open source (PHP/MySQL on any LAMP/LEMP stack) and via official enterprise hosting from PortlandLabs with GitLab deployment, managed PHP/MySQL, and direct core-team support — now backed by SOC 2 Type 2 / ISO 27001 / HIPAA certification plus FedRAMP Moderate / DoD IL2 controls on AWS for the hosted tier, strengthening its fit for regulated industries. The dual model provides flexibility for self-hosted control and managed convenience. No VPC or dedicated private-cloud tier is documented for the managed offering, keeping it below the top band.

The Standard Hosting SLA page still states that PortlandLabs 'makes no guarantees on uptime availability under this agreement,' caps damages at fees collected, and places backup responsibility on the subscriber. No published uptime percentage or public status page was found for the official hosted offering as of mid-2026. Self-hosted installations carry no vendor SLA by definition. This remains firmly in the no-formal-SLA tier.

Concrete CMS uses a standard PHP/MySQL architecture with no built-in horizontal scaling, auto-scaling, or CDN delivery. Scalability is entirely dependent on the operator's infrastructure choices (load balancers, Redis caching, CDN). PHP 8.5 readiness in 9.5 keeps the runtime current, but no documented enterprise-scale references or published API throughput benchmarks were found. Adequate for mid-market self-hosted deployments but not enterprise-proven at scale.

The managed hosting compliance page references annual disaster recovery testing, but the Standard Hosting SLA explicitly states backups are provided 'for the courtesy of the subscriber' and that maintaining backups is 'the sole responsibility of the subscriber,' with no published RTO/RPO commitments, retention policies, or multi-region failover specs. For self-hosted deployments, backup and DR responsibility falls entirely to the operator. Content export via database dump is possible but no built-in export tooling comparable to headless platforms is documented.

Concrete CMS is a PHP application that runs fully on a local LAMP/LEMP/MAMP stack, DDEV, Docker Compose, or any PHP 8.x environment, with 9.5 adding PHP 8.5 readiness. The GitHub repository is Composer-managed, enabling standard PHP local setup, and the `concrete/bin/concrete5` CLI handles cache clearing, migrations, and other tasks. No official DDEV quickstart comparable to Craft's, but local development is well-supported.

The official enterprise hosting uses GitLab deployment pipelines. Concrete CMS does not have a schema-as-code system comparable to Craft's Project Config — content model configuration is stored in the database, not version-controlled YAML. Environment management (dev/staging/prod) exists in the hosted offering but no branch-per-PR content environment support was documented. Standard PHP deployment patterns (Deployer, Capistrano) apply for self-hosted.

Official developer documentation at documentation.concretecms.org covers the 9.x REST API, block/package/attribute development, permissions, versioning guides, and per-release notes (9.5.2 release notes published June 2026). User guides cover the full editorial experience. Documentation is functional and actively maintained but reflects a PHP-era development style with fewer framework-specific integration guides or interactive playgrounds compared to modern headless CMS documentation.

Concrete CMS is a PHP-native platform with no official TypeScript SDK, no type generation from the content model, and no published npm packages. The REST API returns JSON that consumers can type manually, but there is no official @concretecms npm package, no codegen tooling, and no IDE type integration documented. The 9.5 modernization focused on Twig and PHP 8.5, not JavaScript/TypeScript tooling.

Concrete CMS shipped 12 releases over the past 12 months on a near-monthly cadence, including the 9.5.0 feature release (2026-04-28) adding Twig templating and PHP 8.5 support, followed by 9.5.1 (2026-05-19) and 9.5.2 (2026-06-03). Cadence is consistent with meaningful feature minors rather than patches only, but the platform is not shipping major features monthly and v10 remains unreleased, keeping it below the 75+ band.

GitHub release notes are well-structured with New Features / Behavioral Improvements / Bug Fixes sections and per-change contributor attribution (verified on 9.5.0). However, breaking changes are not called out in a dedicated section and migration guides are not linked per-release, keeping it below the 75+ band for enterprise-grade changelogs.

The public roadmap at concretecms.org/roadmap lists Current Focus (bug fixing, marketplace rebuild, CMS-marketplace integration) and Future Focus (Concrete v10 with a CKEditor 4 replacement and AI site-building integration), and monthly town halls continue. There is still no community voting or prioritization portal (no Canny/GitHub Discussions upvotes), which caps the score at the moderate band.

The 9.x line uses semver-compatible versioning and v8 completed a structured LTS wind-down, ceasing security patches in March 2026 after a final 8.5.21 release; v10 is signposted on the public roadmap ahead of release. No automated codemods or formal published deprecation-window policy was found, so transition handling remains present but not enterprise-grade.

The main GitHub repository has 847 stars and 479 forks (verified 2026-07-09), still below the 1K-star threshold that maps to sub-45 scoring for an open-source platform. The forum is active but small-scale and Stack Overflow volume is sparse. The community is real but well below mainstream open-source CMS peers like Drupal or Strapi.

Engagement is genuine and verifiable: 122 PRs opened since 2026-01-01 (78 merged), daily forum activity, monthly town halls, named community contributors credited in every release note (mlocati, hissy, ounziw, ccmEnlil), and a 'Squash Week' core-team bug/security sprint held in May 2026 with open community participation. Constrained by small absolute community size, so it stays below the 65+ band.

Concrete CMS maintains a formal certified services partner program with a certification test, a partner directory, and a Regional Partner Forum linked from the project site. However, the certified partner list remains small regional agencies with no Tier-1 SIs (Accenture, Deloitte, Valtech), limiting enterprise delivery capacity.

Third-party content exists — agency blog posts, forum tutorials, some YouTube content, and an April 2026 TechRadar editorial review — but there are no notable Udemy or Pluralsight courses and minimal conference talk presence. The content ecosystem supports getting started but does not validate broad market adoption.

Talent supply remains a thin niche pool: only a handful of LinkedIn job postings mention Concrete CMS, there is no certification program tied to major learning platforms, and the platform is absent from Stack Overflow Developer Survey recognition. Freelancers exist on Upwork and the project's own jobs forum, but enterprise hiring at scale would be difficult.

Concrete CMS won a third consecutive SourceForge Leader Award (Spring 2026, following Fall 2025 and Winter 2026), indicating a sustained, actively reviewing user base, and earned a TechRadar top-CMS editorial pick in April 2026. However, no major enterprise logo announcements or fresh case studies were found, so the trajectory reads as stable-with-positive-press rather than growing.

PortlandLabs remains a small, privately held company with no disclosed funding rounds, operating the platform continuously since 2008. Ongoing monthly releases, an active 2026 marketplace-rebuild initiative, and no layoff or distress signals support credible bootstrapped stability, but the absence of growth capital caps long-term velocity.

Concrete CMS holds a clear niche — SMB and government/military sites emphasizing inline editing and granular permissions — and gained an April 2026 TechRadar editorial endorsement as an 'impressive, open-source solution.' It remains absent from Gartner MQ and Forrester Wave and is not strongly differentiated against Drupal or WordPress in broad market perception, so positioning stays defensible but narrow.

Sentiment is positive but low-volume: G2 stands at 4.5/5 across ~66 reviews and Capterra at 4.5/5 across ~54 reviews (both re-verified this cycle), keeping combined volume well below the 100+ threshold and mapping to the 45-60 band, trending toward the top given rating quality. The Spring 2026 SourceForge Leader Award (top 5% of favorably reviewed software) corroborates the positive rating.

Concrete CMS publishes its managed hosting tiers openly: Starter at $4.99/mo and Business at $19/mo (both billed annually), with limits clearly listed, while Enterprise/Custom SLA pricing remains sales-gated. The core software is free and open source (MIT), so the most common deployment path carries zero licensing cost. Deducted for annual-billing-only managed plans and the sales-gated Enterprise tier — the industry-norm pattern rather than full public pricing.

Self-hosted (the primary deployment path) has zero license cost — completely flat and predictable. Managed hosting uses simple flat-fee tiers with clear page-view, storage, and editor-seat limits, with no API metering or bandwidth overage charges. The only friction is the lack of a monthly billing option on managed plans.

All core CMS features are fully available in the free MIT-licensed self-hosted version — no functional capability is paywalled. However, both Starter and Business managed plans explicitly state 'NO ACCESS to source code,' reserving custom code deployment for the sales-gated Custom SLA tier, and marketplace add-ons are sometimes reported as limited in selection and arbitrarily priced. Self-hosting remains a full-featured escape hatch, which limits the impact.

Managed hosting is annual-only with no published monthly option. However, the self-hosted path has no contract or lock-in whatsoever. No evidence of startup discounts, nonprofit pricing, or education programs was found on the pricing page. The annual-only managed billing is a mild friction point offset by the zero-commitment open-source route.

The full CMS software is free forever under the MIT license and can be self-hosted on any PHP host — a genuine, permanent, commercially permissive free path rather than a trial. Users still need to provision their own PHP hosting (from ~$3/mo via partners), so it is not a zero-cost managed free tier. No managed free plan exists.

Concrete CMS runs on standard PHP and installs on shared hosting in minutes with standard tooling; 2026 reviews describe it as working 'out of the box' and 'easy to setup' with rich built-in features reducing plugin hunting. The inline page-editing model lets editors become productive quickly — reviews cite training 'in minutes instead of hours or days.' Slightly more setup than pure SaaS, comparable to Craft CMS or Joomla.

Community reviews consistently describe fast deployments for typical marketing sites — basic setups of 10–20 developer hours and a recurring claim that 'development time and cost is nearly cut in half.' Info-Tech notes 'low cost of deployment.' Complex enterprise builds with custom themes/add-ons can run 100+ hours, but there is no community signal of consistently overrunning timelines.

Concrete CMS is PHP/MySQL-based using mainstream web skills, keeping the specialist premium lower than proprietary Java or .NET DXPs — freelance rates of $50–150/hr align with standard PHP work. However, its talent pool is significantly smaller than WordPress or Drupal, so hiring developers with specific Concrete CMS experience carries a moderate premium. PHP generalists ramp up reasonably quickly.

Self-hosted deployments run on commodity PHP/MySQL hosting from ~$3–15/month, among the cheapest operational options in this dataset. Official managed hosting starts at $4.99/month (Starter) or $19/month (Business) including SSL, backups, and managed upgrades. Enterprise managed deployments add cost for staging, CI/CD, and high availability but the base infrastructure overhead remains low.

Self-hosted deployments require routine PHP server maintenance, CMS core updates, and add-on patching — typical of any traditional CMS. Official managed hosting includes managed upgrades, nightly backups, and security monitoring, substantially reducing ops burden on that path. Since most production deployments are self-hosted, moderate sysadmin overhead is the realistic norm; no platform-engineering team is needed.

As MIT-licensed open source with a standard MySQL database and filesystem assets, Concrete CMS has low exit cost — content and data are exportable with standard tooling, and moving between managed hosting, self-hosting, or other providers is straightforward. Proprietary marketplace add-ons and the lack of source-code access on cheap managed tiers add only minor migration friction since the underlying platform is fully portable.

Concrete CMS retains a substantial proprietary vocabulary: Pages, Areas, Blocks, Stacks, Themes, Express (a bespoke no-code relational data system), Attributes, Single Pages, and Packages. The Page/Area/Block hierarchy and Express data model have no equivalents in mainstream PHP or JS frameworks; the 9.5.0 Twig option cleans up template syntax but adds nothing to (and removes nothing from) the domain-model concept count. User reviews describe the learning curve as manageable for PHP developers, but the concept count is well above the <5 threshold for higher scores.

Official docs at documentation.concretecms.org include a developer guide, user guide, and API reference, plus a certification program at training.concretecms.com. There is still no interactive sandbox, no structured framework-specific learning path, no headless quick-start, and the REST API docs remain thin. The standalone 'How to Learn Concrete CMS' page signals the onboarding journey is not self-evident.

Concrete CMS 9.5.0 (June 2026) added optional Twig templating in core for block views, page templates, and single pages — a mainstream, transferable syntax familiar from Symfony, Drupal, and Craft — which meaningfully improves the templating layer over raw PHP views. The underlying stack is still a custom PHP MVC framework (not Symfony/Laravel), with no GraphQL API, no official JS/TS SDKs, and a REST API (OAuth2/OpenID Connect since 9.2) that is functional but not headless-first; 2026 Next.js/React headless roundups do not mention Concrete. Higher scores require standard REST/GraphQL with first-class React support, which is absent.

No official Next.js, Nuxt, Astro, or React starter template exists, and no CLI scaffolding tool. The only package boilerplate remains a community-maintained third-party repo (MacareuxDigital/v9_package_boilerplate). Marketplace themes are paid commercial products, not development starting points — a meaningful gap relative to modern headless platforms and even Joomla.

Installation via Composer + interactive CLI or zip upload is straightforward for PHP developers with standard PHP/MySQL requirements, and 9.4.x improved CLI task feedback and added JSON config support in import XML, modestly improving automation. There is still no official Docker dev environment, no environment variable management pattern, and the REST API must be explicitly enabled via the Dashboard UI; production hardening requires a separate best-practices doc.

Content modeling uses Attributes (typed metadata) and Express (a proprietary relational object builder). There is no migration tooling for schema evolution, no TypeScript type generation, and no schema-as-code workflow; Express relationships do not map naturally to REST API output without additional wiring. User reviews also note there is no syncing process between local and remote environments, compounding schema-change risk on live content.

In-context WYSIWYG editing remains a core Concrete CMS strength — editors click directly on page elements in Edit Mode with full draft/version management and built-in workflow approvals, so coupled-architecture preview fidelity is excellent. The penalty: for headless/decoupled setups there is no draft preview API, no native webhook delivery layer, and no Next.js draft mode integration — preview is entirely server-side.

Theme and template work is now partly a transferable skill: 9.5.0 lets developers author page templates, single pages, and block views in Twig, which generalist PHP/Symfony/Drupal developers already know. But building custom Blocks still requires Concrete's proprietary controller/view/form structure, extending the REST API requires platform-specific service-provider and routing patterns, the certification is Concrete-specific and non-portable, and the talent pool is small (GitHub ~2.6k stars). Standard React or Laravel knowledge still does not transfer.

A solo PHP developer can build and deploy a traditional Concrete CMS site; a 2-person team is viable for moderate complexity. Self-hosted deployments require ops capability unless using managed hosting, and reviewers report friction with 3+ developers on one project due to the lack of environment syncing. For headless usage the team expands to include a separate frontend developer since the REST API is not headless-first.

The in-context editing model lets content editors work directly on pages without developer involvement for routine updates; reviews consistently praise editor self-service ('editors catch on quickly with very little need for support'). 30+ built-in block types and built-in approval workflow reduce governance overhead. Penalties: new content types (custom blocks, Express objects) require PHP development, and permissions/ACL configuration needs developer involvement.

Concrete CMS upgrades remain self-hosted with database migrations applied on first page visit after file replacement, and no downgrade path exists — only backup restore. The 9.4→9.5 jump (April 2026) added Twig templating and PHP 8.5 support without major breaking changes per the minor-version policy, but themes, custom code, and third-party packages must all be verified compatible before upgrading. Frequent releases mean regular upgrade events for self-hosters.

Active HackerOne program and monthly patch releases continue, with fast turnaround demonstrated in 2026: 9.5.1 (May 2026) fixed five CVEs — including RCE via insecure deserialization (CVE-2026-8135) and path traversal RCE (CVE-2026-8134) — about three weeks after 9.5.0 shipped. However, patching always means upgrading the full self-hosted installation, and the steady stream of serious CVEs (RCE, CSRF-to-RCE in CVE-2026-8426) puts real urgency on self-hosted admins.

As an open-source platform, Concrete CMS imposes no vendor-controlled forced migrations; teams upgrade on their own schedule. The ESM model provides at least 3 years of critical security updates on the last minor of each major version. The 9.5 Twig templating addition is additive — legacy PHP templates were not deprecated on a forced timeline.

Concrete CMS runs on a standard LAMP stack (PHP 8.x, MySQL/MariaDB, Apache or Nginx) with no mandatory external services — a relatively contained dependency graph, and PHP 8.5 support landed in 9.5. However, transitive dependency risk is real: 9.5.2 (June 2026) specifically patched vulnerabilities in third-party dependencies and PHP object injection issues, so self-hosters must track core releases for dependency fixes.

Concrete CMS provides no native APM, usage dashboards, or built-in status observability. Self-hosted teams must set up all web server, PHP-FPM, database, and application-layer monitoring independently. Documentation covers cron jobs and CLI operations but no monitoring tooling.

Concrete CMS offers a traditional page/block editing model with no documented automated content hygiene tooling — no orphan detection, broken link alerts, or content expiry workflows built into core. Content governance relies on manual editorial discipline, with some marketplace add-ons but no native automation.

Performance is entirely customer-managed for self-hosted deployments: cache configuration, database query tuning, CDN selection, and PHP settings all require explicit setup. The 9.5 release notes cite performance improvements, but there is still no native CDN or managed caching layer. The hosted offering reduces some burden but is not the default mode.

Formal paid support is available primarily through the managed hosting offering; the open-source community edition relies on forums and community channels. 2025–2026 reviews continue to flag that 'development support is limited, making receiving assistance for rare or undocumented difficulties difficult' and that developer documentation lags. Reasonable for an open-source CMS but not SLA-backed for self-hosters.

Concrete CMS maintains an active, passionate community — 2025 reviews note 'there is always someone on the forums to help' and the team publishes regular community round-ups. It remains much smaller than WordPress/Joomla communities, and documentation gaps mean edge-case questions can go without good answers.

2026 demonstrated strong security response velocity: 9.5.1 shipped roughly three weeks after 9.5.0 to fix five CVEs including RCE-class issues, followed by 9.5.2 a few weeks later for dependency vulnerabilities, with transparent advisories via HackerOne and the security page. General non-security bug resolution still follows community contribution cadence, which is slower than a fully staffed vendor — keeping this below the 60+ band.

Concrete CMS has a native drag-and-drop block editor where marketers can add layout columns and drop content blocks without writing code. Page types for ad landing pages can be excluded from navigation. Scores 66 rather than higher because the block-area model is less WYSIWYG than modern page builders like Elementor and requires some setup for custom layouts.

Concrete CMS has scheduled publishing and integrations with Mailchimp, Constant Contact, and Mautic via add-ons, but no native campaign management, content calendar, or multi-channel campaign coordination. Marketers must rely entirely on external tools for campaign lifecycle. Score reflects the typical range for traditional CMS platforms without dedicated campaign tooling.

Concrete CMS includes built-in SEO controls: meta title/description/keywords per page, a Bulk SEO Updater for site-wide meta management, custom URL slugs, automatic XML sitemap generation, and redirect management. The official SEO feature page details these capabilities. Missing Schema.org structured data automation keeps it below 75.

A native form builder (drag-and-drop, no code) is included for lead capture. Integration with external marketing automation (Mailchimp, Mautic) is available but no built-in conversion tracking, UTM parameter management, or CTA analytics. Score reflects solid form handling with minimal native conversion tooling.

Concrete CMS supports user-group-based content visibility — pages and blocks can be shown or hidden based on authenticated user groups — providing basic rule-based targeting. However, there is no native behavioral targeting, geo-targeting, or AI-driven personalization engine. The marketplace does not list a dedicated personalization add-on. This places it in the 15–35 range for limited native personalization with third-party dependency.

No native A/B testing or experimentation capability is present in Concrete CMS core or the current marketplace. A legacy 'Experimenter' add-on (block-level A/B/multivariate testing) exists only on the archived concrete5-era marketplace and is not maintained for v9. Teams would need to integrate VWO or Optimizely via external script injection, with no tight CMS-level integration. Scores at the floor of the scale for this item.

Inline editing directly on the front-end is a core differentiator for Concrete CMS — editors click any block to edit in place without navigating to a dashboard. Page types serve as templates for fast new-page creation. Block library enables drag-and-drop reuse without developer involvement. The 9.4.0 release (May 2025) added dashboard bulk page editing — page type, template, theme, and caching settings can now be changed across many pages at once — strengthening bulk operations alongside the existing Bulk SEO Updater. Scores 64 rather than 70+ because complex multi-region layouts still benefit from developer setup, and there is no AI-assisted content drafting.

Concrete CMS is primarily a web-delivery CMS, but the built-in REST API (shipped in 9.2+, with OAuth2 and OpenID Connect authentication and documented endpoints) now enables genuine API-based content delivery to other channels. However, the API is not headless-first — limited filtering/sorting depth, no GraphQL (the 2022 proposal's GraphQL work never started), and no official SDKs for any language. Content models remain page-tree-based rather than structured for channel renditions, and no email, push, social, or in-app delivery is built in. Score reflects functional API delivery without multi-channel tooling.

Concrete CMS supports Google Analytics and similar tag-based integrations through the dashboard's tracking code injection and via add-ons in the marketplace. There are no native content performance dashboards or engagement metrics within the CMS itself. The official features page mentions 'consolidated reporting' but this refers to form/data reporting rather than marketing analytics. Score reflects standard tag integration with external analytics tools.

Concrete CMS has a Style Editor that allows administrators to define brand-level typography, colors, and layout tokens applied across the site. Page types and block templates enforce structural consistency. However, there is no hard lock-down mechanism preventing editors from overriding brand tokens on individual blocks, and there is no design token system comparable to modern component libraries. Score reflects component-based consistency without enforcement.

Concrete CMS 9.4.0 added native Open Graph support for social media sharing control, complementing the SEO block's Twitter Card meta management. Social sharing widgets are available as marketplace add-ons. There is no native push-to-social scheduling or UGC embed tooling. Scores in the 30–50 range for OG/card meta tag management plus marketplace-available sharing widgets.

Concrete CMS has a built-in File Manager that handles image uploads, auto-generates thumbnails at configurable sizes, supports file tagging and folder organization, and provides a usage tracker to see where assets are used. This is functional for moderate marketing volumes but lacks rights management, video hosting, advanced image transforms (beyond thumbnail presets), and DAM-grade search. Scores in the 35–55 range for basic media library with some transforms.

Concrete CMS has built-in multilingual support with separate page trees per language, synchronized content relationships, and a dashboard translation interface. This supports generic localization of marketing content including locale-specific page variants. However, there are no marketing-specific transcreation workflows, locale-level campaign scheduling, or regional compliance tools (cookie consent, legal disclaimers) beyond what can be manually built. Score reflects generic localization applied to marketing content.

Concrete CMS has documented integrations with Mailchimp, Constant Contact, and Mautic (email/MAP category) via marketplace add-ons. The marketplace also lists HubSpot and Salesforce integrations. However, these represent shallow embed or form-sync integrations rather than deep API-level event triggers or CDP connectivity. No pre-built ad platform or bidirectional CRM connectors were found. Score reflects some integrations plus generic webhook/API capability.

The Community Store add-on enables basic product content: images, variants (size/color) with distinct pricing, stock tracking, and product grids. However, it is a community-maintained add-on, not a core feature, and is not purpose-built for rich editorial product content at scale. Community Store remains actively maintained (2026, compatible with v8 and v9) but reviews note limited ecommerce maturity versus dedicated platforms.

Community Store includes basic discount codes and automatic discounts but has no cross-sell/upsell content management, category search merchandising, or promotional content scheduling tools. This is typical for CMS-based community add-ons; Concrete CMS is not a commerce-first platform.

Two Shopify integration add-ons are on the Concrete CMS Marketplace — 'eCommerce with Shopify' (configurable Shopify storefront embedding) and 'Hutman Shopify Integration' (imports Shopify products into Concrete pages) — and Ecwid also offers a shopping cart add-on. These remain embed/product-import integrations rather than deep API federation or real-time content+product co-authoring. No documented integration with commercetools, SFCC, or BigCommerce.

Concrete CMS pages can embed Community Store product blocks alongside editorial content blocks, enabling basic product-in-context layouts. However, shoppable content, buying guide templates, or lookbook authoring patterns are not first-class features — they require manual assembly from generic blocks. No native inline product reference with purchase CTA tooling. Score reflects product embeds possible but not a purpose-built editorial commerce pattern.

Community Store has a single-page checkout flow (billing, shipping, payment) but this is rendered by the add-on, not the CMS content editor. There is no mechanism to inject CMS-managed trust badges, upsell banners, or post-add modals into the checkout flow without template modification. Scores near the floor as checkout content is fully in the Community Store template.

Community Store supports automatic digital product downloads after purchase, providing a minimal post-purchase CMS content experience. Order confirmation emails are template-based within Community Store, not CMS-managed pages. No delivery tracking pages, loyalty program content, or review solicitation content sequences managed from the CMS. Scores near the floor.

Concrete CMS's granular user-group permissions can gate product documentation or catalog pages to authenticated B2B users, providing basic access-controlled content. However, there are no B2B-specific features: no customer-specific pricing display, no quote-request workflow, no account-based catalog segmentation. Score reflects basic access control applicable to B2B without purpose-built B2B commerce content features.

Concrete CMS has a built-in site search (using PHP/MySQL full-text or Solr integration for larger deployments). Community Store products appear in site search. However, there is no faceted search enrichment, no search landing page tooling, and no blended content-product search result management. Score reflects basic search with minimal content-side enrichment for commerce.

Scheduled publishing in Concrete CMS core allows time-limited promotional banners to be activated and deactivated without developer involvement. Community Store supports discount codes with time limits. However, there are no countdown timers, promo code messaging blocks, or channel-specific promotional targeting natively. Score reflects basic scheduled banners slightly above the floor.

The multi-site architecture can serve multiple storefronts from one installation, each with its own content tree, theme, and user base. Shared block/template components reduce duplication. However, product content between storefronts is not natively federated — each site manages its own product pages via Community Store instances, creating some duplication. Score reflects multi-storefront possible with partial content sharing.

Community Store supports multiple product images with lightbox display. The file manager auto-generates thumbnails. Video embeds via YouTube/Vimeo blocks are possible on product pages. However, there are no 360-degree view capabilities, AR/3D model references, or image hotspot tooling natively. Score reflects basic image galleries and video embeds without advanced visual commerce features.

Community Store is a single-vendor storefront add-on with no multi-vendor marketplace capability. There are no seller profile pages, seller-contributed product descriptions, or content quality moderation at multi-vendor scale in either core Concrete CMS or Community Store. This is beyond the platform's intended scope.

The built-in multilingual system with separate page trees can be applied to product pages managed via Community Store, enabling locale-specific product descriptions. However, there is no currency-aware content block system, no regional regulatory content automation (EU labels, Prop 65), and no market-specific promo calendar. Score reflects generic localization applied to product content without commerce-specific locale tooling.

Google Analytics and GA4 can be integrated via script injection to track commerce events from Community Store checkouts, but this requires manual configuration and analysis happens entirely in GA4. There is no native content-to-revenue attribution within the CMS, no content-assisted conversion tracking dashboard. Score reflects basic analytics integration with conversion data in fully external tools.

Concrete CMS has a well-documented granular permissions system: permissions can be set at page, page type, or area level, inherited by child pages, and scoped to user groups, individual users, or custom roles. SSO integration is supported and used in production (BASF enterprise intranet case study). ISO 27001/SOC 2/HIPAA certification confirms enterprise-grade security posture. Score stops short of 75 because field-level sensitivity is not a native feature.

Concrete CMS supports version history, approval workflows, and content moderation which covers basic knowledge article lifecycle. There is no native knowledge taxonomy, content expiry/review scheduling, or internal search tuning beyond site search defaults. Functional for moderate intranet needs but lacks dedicated knowledge management tooling.

Concrete CMS actively markets HR portal and internal communications solutions with configurable news feeds, team pages, and SSO-backed access — a step above most generic CMS platforms for intranet use. The Army Senior Executive Portal case study reports usage growth (cited at ~150%) after a UX-focused rebuild, adding to the government portal case study roster. However, it lacks native employee directory integration, social features (likes/comments), or a mobile app, keeping it in the low-50s rather than 60+.

Concrete CMS supports targeted news publishing by user group, enabling department-specific announcements. The HR portal and internal communications solution page highlights news feeds and workflow-backed approvals. However, there are no read receipts, acknowledgment tracking, or mandatory-read workflows in core or the marketplace. Score is in the 30–50 range for basic news publishing with audience targeting.

Concrete CMS has no native employee directory or org chart visualization. User profiles exist in the system but are minimal (name, email, groups). A directory could be custom-built using page types and the member list block, but this requires developer effort and is not a configurable out-of-the-box feature. No HR system integration (Workday, BambooHR) is documented. Score reflects basic directory buildable with custom development.

Concrete CMS provides version history (full page version control), multi-level approval workflows, and content expiration — covering the basics of policy document lifecycle. There is no mandatory acknowledgment tracking, no automated review expiry reminders for policy authors, and no audit trail viewer beyond version history. Score reflects basic document publishing with version control above the floor.

The HR portal application page references onboarding workflows and structured content for new hires, enabled by Concrete CMS's page-type system and access control. However, there are no structured onboarding journeys with progressive disclosure over 30/60/90 days, role-specific content paths, or task checklists that activate automatically from an HR event. What exists is the ability to build onboarding pages rather than a purpose-built onboarding delivery system.

Concrete CMS has built-in site search based on MySQL full-text indexing for smaller deployments, with a Solr/Elasticsearch add-on available for larger installations. Search covers pages, files, and user-submitted content. There is no federated search across external systems (SharePoint, Confluence), no AI-powered relevance ranking, and limited faceted filtering. Score reflects adequate internal search with basic faceting capability.

Concrete CMS front-end themes are responsive and render on mobile browsers. The inline editing interface is available on mobile browsers but is not optimized for touchscreen use. There is no native mobile app, no offline support, no push notifications, and no low-bandwidth mode or kiosk/shared-device configuration. Score reflects responsive web access without native mobile app support.

Concrete CMS can host training content as standard web pages or documents accessible to specific user groups. The HR portal page mentions training materials. However, there is no LMS integration (Cornerstone, Workday Learning), no course assignment, completion tracking, or certification management in core or the marketplace. Score reflects basic learning content hosting without any tracking or LMS connectivity.

Concrete CMS HR portal and intranet marketing reference employee recognition tools and engagement surveys, but evidence for native social features is thin. The Conversation block provides threaded discussion on pages. There are no reactions, polls, community spaces by department/interest, or peer recognition workflows in core. The Conversation block and community forum usage suggest limited social capability rather than a full social layer.

No documented integration with Microsoft 365/Teams, Google Workspace, or Slack was found in the Concrete CMS marketplace or official documentation. SSO can authenticate against Azure AD (Microsoft) or Google via third-party add-ons, but that does not constitute embedded content cards or bot-driven notifications in workplace tools. Score reflects no meaningful workplace tool integration.

Concrete CMS has content expiration dates in core — pages can be set to expire automatically on a future date. Version history enables rollback. Approval workflows provide a structured review cycle. However, there is no automated stale content flagging based on age, no ownership assignment for review reminders, and no formal archival workflow. Score reflects basic content expiry and manual review above the floor.

Concrete CMS HR portal marketing references analytics and reporting for employee engagement. However, no native department-level page view analytics, failed search term dashboards, or intranet adoption dashboards exist in the platform. Analytics relies on GA4 or similar external tools injected via script. Score reflects basic page view analytics available externally without intranet-specific engagement measurement.

Concrete CMS supports multi-site architecture from a single installation with separate content trees, separate user bases, and configurable permission isolation per site. The IMCOM case study (hundreds of garrison websites on one install with compliance controls) validates silo-based isolation at scale. This is not a true multi-tenant SaaS architecture with independent environments, but provides meaningful silo-based separation.

Multi-site installs in Concrete CMS share a single codebase, theme, and block library, allowing centrally maintained templates and blocks to be reused across all sites while permitting local overrides. Branding consistency is a stated feature of the multi-site product. Not a federated content API model but provides shared component infrastructure through the install architecture.

The IMCOM deployment demonstrates centralized compliance and security controls across hundreds of sites, with thousands of individual content managers operating within enforced governance. Concrete CMS provides multi-level approval workflows, page-level and block-level access controls, content expiration, and centralized user management across the multi-site network. Cross-brand approval workflows are limited to within-site workflows rather than a true cross-brand governance console.

Concrete CMS is open source (free community edition), so adding sites does not incur per-brand licensing fees — only infrastructure and managed hosting costs scale. The multi-site architecture runs many sites on one install, reducing server overhead versus separate deployments. Commercial support packages exist but are not required per-site.

Each site in a Concrete CMS multi-site installation can have its own theme, color palette, typography, and style settings via the Style Editor. Per-site theme assignment and style customization are straightforward. However, this is CSS/configuration-level theming rather than a design token system with inheritance from a central brand library. Score reflects basic CSS/config theming per brand with shared component structures.

The multilingual system combined with multi-site architecture allows per-brand, per-locale content trees. Each brand/site can have its own translation workflow via the dashboard. However, there is no governance layer for brand-aware translation approvals, no differentiation between shared vs. isolated translation workflows at the brand level, and no regional legal content governance per brand. Score reflects basic per-brand localization with shared workflows.

No cross-brand analytics dashboard exists in Concrete CMS. Each site's analytics relies on separately configured external tools (GA4, etc.), and there is no aggregated portfolio view of content performance across sites. A multi-site admin can navigate between sites but sees no unified metrics. Score reflects no cross-brand analytics with manual aggregation required.

Approval workflows in Concrete CMS can be configured per page type and per site, giving individual brand sites some control over their publishing workflow stages and approvers. The multi-site admin can see and manage all sites but workflow configuration is per-site. There is no central workflow audit console spanning all brands. Score reflects some workflow variants per brand without central audit trail across brands.

In a multi-site Concrete CMS installation, globally shared blocks, templates, and page types cascade to all sites from the central codebase. However, there is no CMS-level mechanism to push a specific piece of content (e.g., a press release or legal disclaimer) from a corporate parent site to child brand sites with controlled override points. Content syndication requires developer-built solutions. Score reflects basic content sharing through architecture with no native push-syndication workflow.

Concrete CMS has ISO 27001/SOC 2/HIPAA certifications and per-site configuration options allowing compliance settings (cookie consent, legal page content) to be managed per brand. Cookie consent add-ons are available in the marketplace. However, there are no automated publishing guardrails preventing non-compliant content, no per-brand accessibility enforcement, and no data residency configuration per tenant. Score reflects basic compliance settings available per brand without automated guardrails.

The shared codebase in a Concrete CMS multi-site installation provides a centrally maintained block and template library that all sites inherit. Individual sites can override theme styles. However, there is no formal design system versioning, no component versioning with update propagation, and no brand-level extension model beyond CSS overrides. Score reflects shared components with some brand override but no formal design system management.

In a Concrete CMS multi-site installation, a super-admin can manage users, groups, and permissions across all sites from the main dashboard. SSO via SAML is supported and can span all sites. Individual brand teams can be granted autonomous admin rights within their site. This provides meaningful central oversight with brand team autonomy, though there is no SCIM provisioning or true cross-brand contributor role that spans sites without super-admin privileges.

All sites in a Concrete CMS multi-site installation share the same block types and page type templates from the central codebase. Per-brand content type extensions require code changes rather than configuration, meaning adding brand-specific fields involves developer work and risks diverging the codebase. There is no interface for per-brand content model extension without forking. Score reflects basic shared types with limited no-code customization per brand.

There is no executive portfolio reporting dashboard across the Concrete CMS multi-site network. A super-admin navigates to individual sites and views their own content/form reports. Content freshness, publishing SLA adherence, and capacity metrics across the portfolio are not aggregated anywhere in the platform. Manual aggregation from external analytics tools would be required. Score reflects no portfolio reporting capability.

PortlandLabs now offers a standard Data Privacy Addendum (DPA) to hosting clients on request, and the platform is stated to be aligned with GDPR controls — a real improvement over the prior no-DPA posture. However, the public privacy policy still references the invalidated EU-US Privacy Shield framework (struck down 2020) rather than SCCs or the EU-US Data Privacy Framework, no public sub-processor list is published, and no EU data residency option exists (hosting is US-only). The stale transfer mechanism and residency gap hold this below the 60+ DPA band.

A Business Associate Agreement (BAA) is now explicitly available: hosting customers collecting PHI are directed to contact their account rep or security@concretecms.com to enter into a BAA, and healthcare use is documented on a dedicated page (health-care form fields, uploads, encryption at rest and in transit). PortlandLabs hosting is externally audited for HIPAA Security Rule and HITECH controls. Not higher because HIPAA coverage is limited to managed hosting (not self-hosted open source) and there is no HITRUST or deep healthcare implementation guidance.

PortlandLabs hosting meets FedRAMP Moderate controls at DoD Impact Level 2 with continuous monitoring, and states compliance with the controls for HIPAA, HITECH, PCI-DSS, COPPA, GDPR, CCPA and PIPEDA — broader regional coverage (now including CCPA, PIPEDA, COPPA) than previously documented. Not higher because several frameworks are self-attested 'controls' alignment rather than independent certifications, and UK GDPR/IDTA, LGPD, IRAP, and C5 remain unaddressed.

SOC 2 Type 2 is confirmed covering Security and Availability Trust Service Criteria, with the report available on request, and the scope explicitly includes development of the open-source Concrete CMS as well as hosting. Supply-chain SOC 2 reports (AWS, Atlassian, Google Cloud, New Relic carve-outs) are reviewed. Confidentiality, Processing Integrity, and Privacy TSCs are not covered, keeping this below the 85+ band.

PortlandLabs holds ISO 27001 certification — 'This certification proves that Portlandlabs has a robust security and risk management program' — with the certificate available on request. No ISO 27018 (cloud PII processing) is mentioned anywhere. The certification covers PortlandLabs' hosting and development operations, not the open-source software package independently, so it falls in the infrastructure/operations band.

Beyond SOC 2 and ISO 27001, PortlandLabs meets FedRAMP Moderate (DoD IL2) controls with continuous monitoring and has PCI-DSS and HIPAA/HITECH external audit validation, plus US Army PIV authentication licensing. The open-source core runs a HackerOne vulnerability disclosure program with monthly patches and CVE tracking on NIST, and infrastructure access uses FIPS 140-2 MFA. This is an unusually strong portfolio for a tier-4 traditional CMS; no CSA STAR, Cyber Essentials Plus, IRAP, or C5.

Hosting infrastructure remains AWS US-based and the FedRAMP environment is inherently US-only. No EU or APAC data residency options or contractual residency guarantees are documented on any hosting page. Self-hosted deployments can choose any region, but without vendor contractual guarantees that does not earn residency credit — a significant gap for EU-based customers.

The Hosting Privacy Policy page now resolves (previously 404) and the DPA covers data-handling obligations for hosting clients, so documentation has improved. A 'Personal Information Deletion' process is listed in the legal index, and for the open-source platform full database export is inherently available. Still no documented self-service export portal for hosted customers, no published post-termination retention period, and deletion tooling specifics remain thin.

Concrete CMS provides an audit trail that tracks all content changes (who changed what and when) alongside login history, email logging, and error logging. However, no SIEM integration, configurable log retention, or log export APIs are documented. Present but basic — not enterprise compliance-reporting grade.

No formal WCAG 2.1 AA conformance documentation exists for the Concrete CMS authoring interface, and no ATAG 2.0 commitment is documented. The accessibility offerings found (e.g. the All-in-One Accessibility marketplace widget) target the delivered public website, not the CMS editor, and so do not count toward authoring-UI conformance. Federal usage (US Army portal licensing) implies some Section 508 attention in practice, but no formal editor conformance statement is published.

No official VPAT or ACR for Concrete CMS was found on concretecms.com, concretecms.org, or in the legal index, and no Section 508 formal conformance statement is published. VPAT results that surface are third-party marketplace audit services for customer sites, not a product accessibility conformance report. Given federal usage a VPAT may exist on request, but it is not publicly accessible for procurement — which is what this item measures.

The 'AI Integration - GPT 4 Turbo' marketplace add-on (De Webmakers, updated Jan 2026, requires v9.3.0+) delivers GPT-4 Turbo content generation with WYSIWYG editor integration. Core remains AI-free through 9.5.0 (which shipped Twig templating + PHP 8.5, no AI); AI integration for site building and content optimization now appears on the official roadmap but has not shipped. No brand voice controls, prompt templates, or native assistance — capped at the third-party-plugin band.

The Brand Central DAM add-on uses AI to auto-tag uploaded media files with relevant metadata, improving searchability. No smart focal crop, no native auto alt-text generation, and no AI image generation are documented in core or marketplace through the 9.4.x/9.5.0 releases. Auto-tagging remains the only confirmed AI media feature.

No native machine translation in Concrete CMS core through 9.5.0. Linguise (third-party SaaS) can integrate via script injection and API key, using Google Cloud Neural MT and a proprietary LLM model, but this is a fully external cloud service. No core changelog or marketplace entries reference MT features.

The 'AI Integration - GPT 4 Turbo' add-on generates SEO meta titles/descriptions and confirms bulk SEO updates across pages (marketplace listing, Jan 2026). The 'Large Language Models Generator' add-on generates an /llms.txt AI-discoverable site inventory. Both are third-party marketplace add-ons, not core — no on-page SEO scoring or native automation.

AI-powered metadata auto-tagging on media upload (Brand Central DAM) plus bulk SEO updates via the AI Integration add-on are the only confirmed AI ops assists, both outside core. Official blog posts describe AI scheduling and content lifecycle automation aspirationally; no AI content-ops features have shipped in core through 9.5.0.

No agentic products exist in the Concrete CMS ecosystem as of mid-2026 — no named agent suite, multi-step content pipeline, or autonomous automation. The org roadmap now lists generic 'AI integration for site building and content optimization' as planned, but this is neither agentic-specific nor shipped; the project's concrete AI activity remains a contributor AI-use policy and community 'skills files' for external coding assistants.

No content intelligence features exist. The blog post mentions AI could 'identify stale, duplicated, or outdated pages' but frames this as general guidance for external tools, not as a Concrete CMS feature. No marketplace add-on delivers content gap analysis, topic clustering, or AI editorial recommendations as of mid-2026.

No AI auditing tool exists in core or marketplace through 9.5.0. The 'Smart Ways to Integrate AI' blog post lists editorial QA and tone checking as recommended external AI use cases, but no Concrete CMS add-on implements these. A third-party accessibility widget (Skynet Technologies) is rule-based, not AI-driven.

Concrete CMS uses standard full-text search with no vector or semantic search capability through 9.5.0. No marketplace add-on or core feature provides AI-enhanced relevance ranking, embedding generation, or RAG-ready content indexing. Custom external integration would require substantial developer work from scratch.

No native ML personalization engine. The 'Poper Widgets Popups Embeds Powered by AI' marketplace add-on is an external SaaS JavaScript embed that adapts CTAs based on visitor context, but it operates outside the CMS layer. No predictive audience segmentation, no behavioral ML, no native A/B testing with AI as of mid-2026.

The community-built TypeScript concretecms-mcp-server (MacareuxDigital) remains the only MCP option: it wraps the REST API with OAuth2 auth (loading openapi.yml to discover endpoints) and supports system info, content read/write, file upload, and user access. As of mid-2026 it has minimal adoption and no formal releases published, is not officially endorsed by Concrete CMS, and lists a remote Streamable-HTTP server as a future goal — keeping it below the well-supported-community band.

BYOK is confirmed: the 'AI Integration - GPT 4 Turbo' add-on (free, Jan 2026) requires users to supply their own OpenAI API key, configured via the dashboard's AI Integration settings page. However, it is a third-party marketplace add-on limited to a single provider (OpenAI) — no official Concrete CMS BYOM framework, no Anthropic/Azure/Gemini support, no model switcher.

Concrete CMS is open-source (MIT, PHP) with a REST API usable for AI consumption, as demonstrated by the community MCP server that reads its openapi.yml. No official AI SDK, no LangChain/LlamaIndex connectors, and no LLM-friendly content API. The community 'skills files' initiative (structured Markdown docs to help coding LLMs work with Concrete) remains a proposal — AI tooling is still developer-DIY.

Concrete CMS has mature general-purpose governance — approval workflows requiring human review before publish, comprehensive audit trail, ISO 27001, SOC 2, HIPAA compliance, and role-based permissions — serving as de facto AI safety layers. The official AI policy governs contributor AI use in the open-source project, not AI output in the product. No AI-specific output logging, decision audit trail, or prompt governance exists.

No AI usage dashboards, token consumption tracking, model performance monitoring, or AI observability tooling exists in Concrete CMS core or marketplace. AI usage through the BYOK AI Integration add-on is entirely opaque to CMS administrators — cost and usage monitoring relies on the user's own OpenAI dashboard.