Craft CMS

Craft 5 ships about 26 native field types, including Addresses, Country, Money, Icon, Link, Range, Table, Matrix and Content Block, and supports custom sections, entry types and field layouts with conditional field visibility. Schema state is serialized to version-controlled YAML through Project Config. Not higher because there is no code-first schema authoring and no true union or polymorphic field type outside Matrix entry types.

Relational fields (Entries, Assets, Categories, Users, Tags) support many-to-many links that can mix entry types and sections, and `relatedTo` queries resolve relations from either the source or the target side, including through GraphQL. Not higher because inverse relationships are not declared in the schema; reverse traversal is a separate query rather than a field resolvable in one graph selection.

Craft 5 rebuilt Matrix so blocks are full nested entries with their own entry types, allowing unlimited nesting, card or inline views and live field conditions, and Content Block fields (5.8) embed a reusable fixed structure. CKEditor fields can embed nested entries inline in rich text. Not higher because composition output is Craft-specific and the rich text equivalent is HTML rather than a portable structured format.

Field settings cover required, character limits, min/max, allowed file kinds and sizes, relation limits and unique handles, and validation runs on element save so it also applies to GraphQL mutations and Element API writes. Custom rules are added in PHP through element validation events or custom field types. Not higher because there is no editor-facing rule builder for cross-field or conditional validation; field layout conditions only control visibility and editability.

Entries keep revisions with author attribution and a revisions browser, any revision can be restored non-destructively, drafts and provisional drafts are separate from the published state, and deleted elements go to a trash from which they can be restored. Not higher because there is no field-level diff between arbitrary revisions, no branching or content releases (release bundles are planned for Craft 6.x), and assets are excluded from revisions.

Craft has native hierarchical Category groups and flat Tag groups, each with its own field layout, reusable across any content type through Categories and Tags fields, governed by per-group permissions and exposed through GraphQL queries and relatedTo filters; structure sections can serve the same role with entries. Not higher because there are no synonyms, controlled-vocabulary approval or bulk reclassification tools, and Craft now steers new projects to model taxonomies as structured entries rather than a dedicated taxonomy service.

Live Preview shows drafts in real time next to the editing form, supports multiple preview targets (including headless frontends via preview tokens), responsive breakpoints, per-site preview and shareable tokenized preview links. Not higher because there is no click-to-edit overlay on the live frontend and no official visual-editing SDK for Next.js or Nuxt; headless preview needs custom token handling.

The first-party CKEditor 5 field supports configurable toolbars, custom styles, source editing, Word paste cleanup, links to entries and assets, and nested entries embedded inline in the text. Not higher because output is an HTML string rather than a portable AST, a Markdown field is still in progress for Craft 6, and CKEditor's collaboration add-ons are separately licensed.

Assets live in volumes and folders with per-volume field layouts, translatable alt text, focal points, a built-in image editor and named or ad-hoc transforms (crop, fit, letterbox) with WebP and AVIF output, exposed through Twig and GraphQL. Craft 5.10 added reference blockers showing where an asset is used before deletion. Not higher because modern format output depends on server ImageMagick support on self-hosted installs and assets have no versioning.

Each editor works in a private provisional draft and upstream changes are merged in with a notice when the draft is loaded, and Craft 5.10 refreshes element slideouts when the element changes elsewhere. Not higher because there is no presence indicator, no entry locking, no concurrent-edit warning and no commenting; element commenting is in progress for Craft 6 and real-time collaboration requests were closed without implementation.

Craft 5 natively offers drafts, named drafts, and per-section publish permissions so authors can be limited to drafts while publishers go live, but no review states, task assignment, notifications or approval audit trail. Multi-step approvals come from the paid Verbb Workflow plugin. Not higher because native approval workflows and activity logging are only in progress for Craft 6.

Entries have native Post Date and Expiry Date fields, so publish and unpublish can both be scheduled without a cron job, and both are settable through GraphQL mutations. Not higher because there are no release bundles, no scheduled publishing of changes to an already live entry (scheduled drafts are planned for 6.x), no calendar view without the Solspace Calendar plugin, and static caches holding future-dated entries are not invalidated automatically.

Craft localizes through sites, each with its own language, and every field has a translation method (not translated, per site, per site group, per language or a custom key), while sections control propagation so entries can exist in all, some or one site. Live Preview and GraphQL queries are per site. Not higher because there are no runtime fallback chains for missing translations; untranslated fields are copied on propagation rather than resolved from a fallback locale.

Craft Pro supports unlimited user groups with granular permissions per section, entry type action, site, asset volume, category group and utility, and Craft 5.9 added field editability conditions so fields can be locked per user group or condition; MFA with passkeys and authenticator apps is native. Not higher because SAML or OIDC SSO comes from third-party plugins, there is no SCIM provisioning and permissions are additive group grants rather than entry-level ACLs.

Native GraphQL is included in every edition with GraphiQL, multiple schemas with scoped tokens, a public schema, mutations, site arguments, filtering, ordering, pagination and image transforms. REST comes from the first-party Element API plugin. Not higher because REST has no turnkey delivery API; every endpoint must be declared in config.

Craft Cloud fronts sites with a Cloudflare-based CDN, static caching with automatic tag-based purge tied to Craft element cache dependencies, ESI fragments and edge image transforms. Not higher because self-hosted Craft (most installations) has no built-in CDN, Cloud is a separate paid product, and no sub-second purge commitment is documented.

The first-party Webhooks plugin can fire on any Yii or Craft event (save, delete, propagate, element status changes), with custom headers, Twig payload templates, filter classes, retries with fixed delay and an activity log; PHP event hooks are available for everything in core. Not higher because payloads are unsigned (no HMAC), retries use a fixed delay, filtering needs custom PHP classes and no event streaming alternative exists.

Craft can run fully headless with GraphQL, and first-party starters for Next.js, Nuxt and Astro plus Craft Cloud headless guidance support decoupled builds alongside Twig rendering. Not higher because there are no official client SDKs in any language and rich text is HTML, so non-web channels must parse markup.

Craft has no segment builder, visitor profiles or CDP connector; segmentation lives in external engines such as Croct, and the Optimum plugin only limits experiments to a percentage of traffic. Scored low in the integration band because no named-CDP connector exists and audiences are not usable in content rules inside Craft.

Craft has no content variants per audience; personalization needs an external decision engine such as Croct wired into templates, or hand-written Twig conditionals on the logged-in user's group. Not higher because there is no in-editor variant authoring or audience preview.

Third-party plugins add server-side testing: ABTestCraft assigns variants before render with conversion goals and significance reporting in the control panel, and Optimum runs server-side multivariate tests. Not higher because nothing ships in core or from Pixel & Tonic, and both plugins are small community projects.

There is no recommendation engine in Craft or its Plugin Store; related content is curated by hand with relation fields or built from relatedTo queries. Scored in the none band.

Craft maintains a native search index with keyword syntax, attribute and field targeting and `searchScore` ordering that templates can use for front-end search. Not higher because it has no faceting, typo tolerance, autocomplete or analytics and slows on large sites; serious search goes through community plugins such as Scout for Algolia or Meilisearch.

Craft Commerce, a separately licensed first-party plugin from Pixel & Tonic, provides products and variants, cart, checkout, catalog pricing rules, multiple stores, multi-location inventory with transfers and subscriptions through the Stripe gateway. Scored near the add-on ceiling because it is genuine commerce but sold as its own edition-priced product.

The first-party Shopify plugin syncs products into Craft as elements via the GraphQL Admin API and webhooks, so editors enrich live product data in Craft, and the first-party Stripe plugin syncs products, subscriptions and invoices. Not higher because there are no connectors for commercetools, BigCommerce, Salesforce Commerce Cloud or SAP Commerce.

The control panel dashboard offers widgets such as recent entries and feeds but no page performance, engagement or content health analytics. Scored in the none band; plugins only display data from external providers.

Third-party plugins cover GA4 with server-side and Commerce events (Instant Analytics GA4) and show Google Analytics, Plausible and Fathom data in the control panel (Metrix). Not higher because no first-party integration exists and there is no Segment, Amplitude or Adobe Analytics plugin.

One Craft Pro installation runs any number of sites in site groups with per-site URLs, languages, templates and permissions, and sections share entries and fields across sites through propagation settings. Not higher because sites must share one database and schema, and central governance across sites beyond permissions is limited.

Translation workflow comes from third-party plugins: Acclaro's Translations plugin sends entries, categories, globals and assets to translation vendors, a Lilt connector exists, and Multi Translator adds bulk DeepL, Google and OpenAI machine translation. Not higher because there is no Smartling, Phrase, Lokalise or Crowdin connector and no in-platform translation memory.

Site groups let brands share fields, entry types and templates with per-site branding, and user group permissions can be scoped per site. Not higher because there is no cross-brand approval workflow, policy enforcement or brand-level analytics.

The asset library has per-volume metadata field layouts, folders, bulk move, focal points and, since 5.10, usage references shown before deletion. Not higher because there are no rights or expiry management, asset approvals, brand portals or asset versioning, and no vendor-maintained connector to Bynder, Aprimo or Cloudinary.

Video files can be uploaded as assets, but hosting, transcoding and captions are absent; the Transcoder plugin adds self-hosted FFmpeg transcoding and Embedded Assets handles YouTube and Vimeo metadata. Not higher because there is no streaming, adaptive bitrate or player, and Craft Cloud transforms cover images only.

Marketers compose pages from Matrix entry types and Content Block fields, choosing from a palette defined by developers, reordering blocks and watching the result in Live Preview. Not higher because layout is form-based rather than drag-and-drop on the page, and there are no template locks or visual composition for headless frontends.

Craft renders full sites natively with Twig templates, routing and URI formats per section, and Pixel & Tonic sells Craft Cloud as a separate managed hosting product with a CDN, TLS, custom domains, multiple environments, Git-based deploys, static caching and edge image transforms. Scored in the 60 to 74 band because hosting is a separately priced product from the same vendor and most installs are self-hosted.

Craft core has no form builder; Formie, now published under the craftcms GitHub organization as a separately licensed plugin, adds a drag-and-drop builder with multi-page forms, conditions on pages, fields and notifications, spam protection, stored submissions, payments and CRM and webhook integrations. Not higher because it is a paid add-on and progressive profiling and form analytics are absent.

Formie pushes form subscribers to more than fifteen ESPs including Mailchimp, HubSpot and Campaign Monitor, and a Klaviyo plugin syncs lists and Commerce events. Not higher because there is no native email sending for campaigns, content push or email preview in Craft.

Element events can be forwarded to Zapier or automation tools through the first-party Webhooks plugin, and Formie sends leads to HubSpot, Salesforce, ActiveCampaign and Dynamics 365. Not higher because no drip campaigns, lead scoring or behavioral triggers exist anywhere in the ecosystem.

Core Craft gives clean URI formats per section and slug control, but meta management, sitemaps, JSON-LD and redirects come from third-party plugins, chiefly SEOmatic (metadata with previews, sitemaps, schema.org JSON-LD, GraphQL exposure) and Retour for redirects. Scored near the integration ceiling because the plugin coverage is complete and widely used, but nothing ships in core.

No native llms.txt generation, Markdown endpoints, AI crawler controls or AI citation reporting were found in Craft 5 or Craft Cloud; developers can template an llms.txt or Markdown routes in Twig and SEOmatic covers JSON-LD and robots rules. Scored in the custom band because answer-engine readiness depends on templates and the CDN, with no vendor AEO guidance.

The first-party Plugin Store, built into the control panel, lists about 1,300 plugins from nearly 480 developers with one-click install and licensing, and Pixel & Tonic maintains key first-party plugins such as Commerce, CKEditor, Feed Me, Webhooks, Shopify, Stripe and cloud filesystems. Not higher because many critical capabilities (SEO, forms history, search) rely on small third-party vendors.

Craft Pro supports front-end user registration, login, password reset, profile editing and user groups, so templates can gate content with `currentUser` and group checks, and Commerce adds customer account pages. Not higher because CIAM federation (Auth0, Okta, Azure AD B2C) and social login come from third-party plugins, and there is no consent or preference center or portal framework.

Craft 5 ships a built-in GraphQL API with a bundled GraphiQL IDE, token-scoped public/private schemas auto-generated from the content model, mutations, filtering, sorting, pagination, and @transform/@parseRefs directives. REST is served by Element API — a first-party Pixel & Tonic plugin (craftcms/element-api, Craft 5 compatible, last release 2026-08-05) that exposes configurable JSON endpoints for any element type — so the prior assessment of REST as community-only was wrong. Not higher because REST is an opt-in plugin rather than a default endpoint, and GraphQL still lacks subscriptions, user mutations, and exposure of Craft's advanced query-builder functions.

Craft Cloud fronts every project with a Cloudflare global CDN and documented static caching of HTML, plus Edge-Side Includes (cloud.esi()) that let dynamic fragments be stitched into statically-cached pages at the edge with independently-cached sub-resources. Regional compute and database placement reduce latency for uncached and control-panel requests, and the documented ceilings are permissive (60s request timeout, 6MB max response, metered outbound transfer, no request or concurrency caps). Not higher because GraphQL responses are not edge-cached by default, no rate limits or throughput benchmarks are published, and self-hosted installs get no CDN at all.

Pixel & Tonic still publishes no official JavaScript, TypeScript, Python, Ruby, Java, .NET, or mobile SDK — there is no @craftcms package on npm, and the only first-party developer surface is the PHP plugin/module API on Packagist. The official craftcms/starter-next and craftcms/starter-nuxt repos are maintained reference applications that query the GraphQL API directly rather than client libraries. Scored at the top of the community-only band because the ecosystem substitutes (Query API plugin, graphql-codegen) are real but unofficial; well below headless-native platforms shipping 4–6 maintained SDKs.

The Craft Plugin Store now lists roughly 1,300 plugins from ~478 developers — materially larger than the ~800 previously recorded — spanning SEO (SEOmatic), forms (Formie, Freeform), commerce (Craft Commerce), search (Scout/Algolia), DAM, translation, workflow, SSO (saml-sp, saml-idp, miniOrange), and a 2026 crop of AI tooling (Craft CMS MCP, LLM Ready, Sidekick). First-party plugins include CKEditor, Webhooks, Shopify, and Element API. Not higher because the count spans Craft 3/4/5 compatibility rather than all entries being Craft 5-ready, and there is no cloud-side marketplace infrastructure (OAuth app install, hosted connectors) of the kind SaaS-native platforms ship.

Craft has one of the most mature extensibility models in the traditional CMS space: full-MVC plugins with control-panel sections, modules for lightweight single-class extensions, custom field types via FieldInterface, custom element types, GraphQL schema extension from plugins, CP Twig template overrides, dashboard widgets, utilities, and a comprehensive event/hook system throughout the Yii-based framework. Self-hosted deployment permits arbitrary server-side code with full framework access. Not higher only because Craft Cloud's read-only ephemeral filesystem constrains some runtime write patterns.

Craft 5 ships native two-factor authentication via TOTP apps and WebAuthn passkeys, both enforceable per user group, plus built-in API token management for scoping GraphQL endpoint access. SSO remains entirely plugin territory: the official craftcms/oauthclient plugin covers OAuth, while SAML 2.0 and OIDC require third-party plugins (flipboxfactory saml-sp/saml-idp, miniOrange craft-single-sign-on). Held below the 78+ band because enterprise SSO is not in core at any tier — it is a paid third-party dependency carrying its own maintenance and support risk, which is weaker than merely gating SSO behind an Enterprise plan.

Craft Pro provides unlimited user groups with granular section-level and entry-type-level create/save/publish/delete permissions, plus custom permissions registered by plugins. Native field-level permissions still do not exist — field layout conditions (show/hide by user group) remain the documented workaround, and craftcms/cms issue #4238 tracking real field-level permissions is still open. Content-instance access control ('only see entries you authored') requires custom module code, keeping this in the content-type-scoping band rather than the 80+ band.

Craft now publishes a dedicated Craft Cloud security page documenting Cloudflare WAF on every project, encryption at rest for both database and assets, strict network segregation between projects, and a read-only ephemeral filesystem, alongside a public DPA page and a free GDPR DPA on request. But Pixel & Tonic holds no first-party SOC 2 Type 2, ISO 27001, HIPAA, or PCI attestation — the security page explicitly borrows its SOC 2 posture from AWS and Cloudflare ('the companies that provide infrastructure for Craft Cloud use fully SOC-2 compliant access procedures'), which is not attributable to Craft. EU residency is also only partial: region selection covers compute and database, but the Cloud management layer sits in the United States and assets cannot be pinned to a single region.

Correcting the prior record: Craft does run a funded vulnerability disclosure program with bounties, hosted on Hackrate (minimum $50, $500+ expected for significant findings), publishes GitHub Security Advisories with assigned CVEs, and follows a 30-day coordinated disclosure window after a fix ships — a mature process, not email-only. The problem is volume and severity: 2026 alone brought CVE-2026-44011 (authenticated RCE via Yii object injection), CVE-2026-92592 (signing-key reuse enabling signature transposition to RCE, 4.8.0–4.18.5 / 5.0.0–5.10.12), CVE-2026-32267 (CVSS 7.7 privilege escalation to admin via token mishandling), and CVE-2026-92590 (stored XSS in Generated Fields), with 5.11 additionally fixing high-severity RCE, authorization bypass, and account-hijack issues. Layered on CVE-2025-32432 (CVSS 10.0 unauthenticated RCE, ~300 instances compromised) and CVE-2025-23209 in CISA KEV, this is a sustained pattern of critical remote-code-execution defects that a good disclosure process only partly offsets.

Craft supports both self-hosted deployment on any PHP 8.2+ LAMP/LEMP stack via Composer and managed SaaS via Craft Cloud, with the craftcms/cloud extension detecting the platform at runtime so the same codebase runs in both places unmodified. Regulated buyers can self-host on their own infrastructure or a partner host (Fortrabbit, Nexcess, Cloudways, AWS, Hetzner) while teams wanting managed infrastructure use Cloud. Held at 75 because no private cloud, VPC, or single-tenant isolated deployment option is offered for Craft Cloud.

Craft operates a public status page at status.craftcms.com with per-component history and a Cloud docs page explaining how to read it; recent history is clean, with the last acknowledged incident affecting console.craftcms.com in May 2026. However, no contractual SLA percentage, service-credit remedy, or uptime guarantee appears anywhere in Craft Cloud's pricing, docs, or terms, and self-hosted deployments have no vendor commitment at all. That leaves this in the no-formal-SLA band despite decent transparency.

Craft Cloud is a genuinely serverless architecture — each project runs as its own AWS Lambda container image via Bref, with SQS-backed queues, S3 asset storage, Cloudflare Workers/CDN at the edge, and highly-available managed database clusters, so horizontal scaling is automatic rather than operator-provisioned. The Bref case study reports the platform serving over 310 million HTTP requests and 6TB of data in a 30-day window, and documented quotas impose no caps on entries, users, content types, or database size. Not higher because per-project throughput, concurrency, and RPS ceilings are undocumented, no named enterprise-scale customer references are published, and self-hosted Craft scales only as well as the operator's own stack.

Craft Cloud captures automated nightly database backups of production with 30-day retention, supports unlimited on-demand manual backups per environment from Craft Console, and content is exportable via native DB backup plus asset storage access. The backups documentation is candid that Console-visible backups 'are provided for your convenience and are separate from internal backups, and are not part of Craft Cloud's durability architecture' — the real durability layer exists but is undocumented. No RTO or RPO is published, no point-in-time recovery is offered, and no multi-region failover is described; self-hosted installs depend on community plugins. Adequate for mid-market, below enterprise DR expectations.

Craft Cloud ships a dedicated Local Development doc that names DDEV as the recommended environment because it matches every PHP and database version Cloud supports, and the craftcms/cloud extension detects that it is running off-platform and leaves local configuration untouched — so local and production are the same codebase with no divergence. DDEV has native Craft project-type support with committed .ddev/ YAML making `ddev start` the only setup step on a new machine, and `ddev craft` fronts the full Craft console CLI for migrations, cache clearing, and scaffolding. Well into the local-server band; not higher only because there is no Cloud-specific emulator reproducing Lambda, edge caching, or ESI behaviour locally.

Project Config captures all schema changes (sections, fields, entry types, sites, plugin settings) as YAML committed to git and applied with `php craft up --interactive=0`, giving real schema-as-code migration tooling. Craft Cloud layers branch-bound environments on top: each environment binds to a git branch and gets its own database, asset storage, environment variables, logs, preview domain, and deploy trigger (on-push or manual), with pre-migration DB snapshots on deploy. Held below 80 because environments are manually created rather than ephemeral per-PR, data is not cloned between them (you restore a backup by hand), and environment count is capped by plan tier.

Craft maintains parallel versioned docs for v3/v4/v5 plus a separate, well-organised Craft Cloud doc set (security, regions, quotas, environments, deployment, static caching, ESI, backups, local dev, status), a 100+ article knowledge base, and GraphiQL as a built-in interactive playground. Framework-specific onboarding is now first-party: craftcms.com/starters plus the officially maintained craftcms/starter-next and craftcms/starter-nuxt headless starters give Next.js and Nuxt teams a running reference implementation. Not higher because there are no multi-language code examples for API consumers and the sheer volume remains hard to navigate for newcomers.

Pixel & Tonic publishes no TypeScript SDK and no first-party type-generation tooling; there is no @craftcms npm package. The community pattern is graphql-codegen run against Craft's introspected GraphQL schema, documented in craftcms/cms discussion #15399, plus the third-party Query API plugin. That pattern also degrades at Craft 5 scale — the same discussion reports entry types going from 23 in Craft 4 to 67 in Craft 5, with generated output growing from ~8MB to ~22MB and slowing IDEs. Type safety is an ecosystem workaround with known friction rather than a platform capability, leaving Craft well below headless platforms that generate types from the content model natively.

Craft shipped 5.9 (Jan 28, 2026) and 5.10 (May 13, 2026) on the stable line while running a parallel Craft 6 alpha track — six alpha releases in the month following the June 2026 alpha announcement, then weekly updates through the summer, with the Laravel port declared complete in the September 2026 newsletter. Craft Cloud also shipped and has been iterating independently. Not higher because the stable 5.x line only took two feature releases in 2026 as engineering shifted to Craft 6, and the Q3 2026 Beta target has not landed as of Sept 20.

Craft maintains a structured CHANGELOG.md per major line on GitHub with per-version sections, explicit breaking-change callouts, and links to upgrade notes, supplemented by a monthly newsletter and a 'What's New' page that translate raw entries into human-readable summaries. Not higher because there are no auto-generated codemods or machine-readable migration manifests alongside the changelog.

The public roadmap at craftcms.com/roadmap gives quarter-level phases for Craft CMS and Craft Commerce (Craft 6 Alpha → Beta Q3 2026 → GA Q4 2026), backed by a dedicated /laravel explainer, monthly newsletters reporting concrete progress on the port, and quarterly accessibility-update posts; the 2026 Dot One roadshow is explicitly a Craft 6 briefing series. Not higher because there is still no community voting portal (Canny or equivalent) — feature requests route through GitHub issues with no public prioritization signal.

Craft 5 is designated LTS with active support through Dec 31, 2030 and critical security support through Dec 31, 2031 — a roughly five-year window among the most generous in the tier — and the Yii 2 → Laravel change is framed as a 'port, not a rewrite' with a Yii 2 adapter package intended to keep most Craft 5 plugins running unmodified. Not higher because the adapter is unproven until Craft 6 actually ships, and Craft still offers no codemods or automated upgrade tooling beyond documented migration notes.

Signals are flat year-over-year: GitHub sits at 3.6K stars / 706 forks (up ~100 stars), Discord at 8,132 members (down slightly from 8,206 a year ago), and the 2026 community survey drew only 253 respondents against a customer base estimated at ~6K. Scored below the 5K–20K star band because absolute numbers are small and no channel is growing meaningfully.

Engagement is high relative to the community's size: three Dot One events in 2026 (Antwerp, London, Melbourne) versus two conference editions in 2025, all built around Craft 6 talks from the core team; Discord and GitHub Discussions see daily activity with Pixel & Tonic staff participating directly; and CraftQuest independently runs an annual community survey. Not higher because the participation base is thin in absolute terms — a 253-person survey and a flat-to-shrinking Discord cap how far engagement quality can carry the score.

The Craft Partner Network runs three verification tiers (Craft Verified, Commerce Verified, Enterprise Verified) where Pixel & Tonic directly reviews code and interviews clients, with a public directory, verified badges, prioritized placement, direct-lead eligibility, and sales support; new partners continue to announce verification through 2026. Not higher because the roster is entirely boutique digital agencies — no Accenture, Deloitte, or Valtech — which limits enterprise procurement confidence.

CraftQuest operates as a dedicated commercial Craft tutorial and course platform (lessons, Dot All session archives, the annual community survey), and the Craft 6 Laravel announcement drove a wave of independent agency explainers through 2026 — Enovate, Convergine, Media Surgery, webdna, Mutual, ContentReactor and others — plus coverage on Laravel News that reaches outside the Craft bubble. Not higher because there is still no significant presence on mainstream course platforms (Udemy, Pluralsight, LinkedIn Learning) and video content is concentrated in a single community site.

Job volume ticked up year-over-year — 83 Craft CMS developer listings on Glassdoor (from 67) and 87 on Indeed, with average US pay around $92,879/yr and roughly $73/hr for contract work, plus vetted freelancer pools on Toptal, Arc, and Upwork. Still niche: Craft does not appear in the Stack Overflow developer survey and there is no certification program, so buyers cannot screen for verified expertise and must recruit from general PHP/Twig talent and train up.

Craft Cloud is the first hard momentum number Pixel & Tonic has published: nearly 200 hosted projects serving 7.5 billion requests in the year, with 200 million malicious requests blocked and eight DDoS attacks mitigated — evidence of a new recurring-revenue line taking real traffic, alongside a three-city 2026 event roadshow and continued partner verifications. Not higher because ~200 Cloud projects against a ~6K customer base is early traction, and Craft still publishes no enterprise logo wins, customer-count growth, or ARR signals.

Pixel & Tonic remains privately held and bootstrapped with no funding rounds on Crunchbase, and third-party estimates put headcount at roughly 8 people (up from 6 in 2023) serving ~6K customers — thirteen years of continuous shipping without outside capital and no layoff or distress signals. Not higher because that team carries Craft CMS, Craft Commerce, and a serverless hosting platform simultaneously while executing a year-long framework port, leaving severe key-person and capacity concentration; not lower because headcount is growing and a new revenue line just shipped.

The Laravel bet has moved from announcement to execution — the codebase was fully ported as of September 2026 — repositioning Craft from a standalone Yii CMS into a package consumable by the largest PHP application ecosystem, a genuinely defensible differentiation against both headless CMSes and WordPress; Craft Cloud adds a vertically integrated hosting story. Not higher because Craft appears in no Gartner Magic Quadrant or Forrester Wave, the repositioning is unvalidated until Craft 6 GA, and Statamic plus the headless field continue to contest the developer-first PHP niche.

G2 shows 4.2/5 across approximately 48 reviews, corroborated by FindStack at 4.2 across 47 — essentially identical to the count a year ago, meaning effectively zero review growth, and well inside the prompt's sub-100-review band. Tone is positive (flexibility, clean authoring UI, security) with no recurring pricing or reliability complaints surfacing on forums, but the thin and static volume caps both confidence and score.

Craft publishes dollar amounts for every tier except Enterprise on both the license and hosting side: Solo $0, Team $279/project, Pro $399/project, $99/yr renewals, plus Craft Cloud Team $130/mo ($120 annual) and Pro $260/mo ($240 annual). Unusually, it also publishes the things most vendors hide — asset-storage add-on rates (+$10/$50/$100/$150 per month), bandwidth overage at $25/50GB, and a 15% nonprofit discount — alongside a four-column feature matrix. Not higher because Enterprise, which holds SAML SSO and the 99.99% SLA, is entirely sales-gated with no indicative floor.

Self-hosted Craft is a perpetual per-installation license with no metering of any kind — no API calls, no seats beyond the edition cap, no bandwidth billing — and the renewal is genuinely optional: Craft's KB states 'You are never charged for gaps in renewals' and that auto-renew quotes are locked at the reminder-email price, with pre-payment for up to five years available. The offsets are real but secondary: per-project licensing multiplies across a site portfolio, Craft Cloud does meter bandwidth and asset storage, and practitioners report 5–15 commercial plugins whose combined renewals typically exceed the Craft license itself. Not higher because that plugin-renewal stack is an unbudgeted second invoice on most real projects.

The free Solo edition carries unlimited entries, content types and locales, multi-site + localization, GraphQL, live preview, versioning, scheduling and the full plugin store — unusually generous — and 2FA/passkeys are core rather than tier-gated. Against that, first-party SAML SSO appears only on the Enterprise card at custom pricing, which the rubric flags as problematic gating, while custom roles and permissions require Pro at $399 and Team caps at five users and a single user group. Not higher because SSO sits behind an undisclosed sales-gated tier; not lower because nothing in content, security basics or the API is paywalled.

Two previously assumed gaps do not exist: Craft Cloud bills monthly ($130 Team / $260 Pro) with annual merely a $10–20/mo discount rather than a lock-in, both behind a free seven-day trial, and craftcms.com publishes a flat 15% nonprofit discount on Team and Pro. Exit is effectively penalty-free — a lapsed renewal leaves the site running perpetually on the last licensed version, gaps are never back-billed, and Pro/Team can be trialled indefinitely on a non-public domain before purchase. Not higher because there is no startup or education program, licenses are per-project rather than portable, and Enterprise requires a custom agreement.

Solo is free forever — not a trial — and is functionally the whole CMS: unlimited entries, content types and locales, multi-site + localization, GraphQL, live preview, image editor, content versioning and scheduling, and the full plugin store, with none of the entry or traffic caps that define most free tiers. The one hard limit is a single user account; Craft's own FAQ says Solo is technically usable for client work but 'we don't recommend it,' a soft discouragement rather than a license restriction. Not higher because the one-admin cap makes any team or client project a paid purchase.

Craft now ships official starter projects at craftcms.com/starters — a Basic Blog in Twig, Nuxt, Next.js or Astro plus a WordPress-Inspired Blog with a familiar posts/pages/comments model — on top of `composer create-project` and documented DDEV setup, so a working site with real content is reachable inside a day rather than assembled from a blank slate. Craft Cloud's seven-day trial deploys straight from GitHub/GitLab/Bitbucket with a complete Composer and npm build pipeline, removing local-environment setup entirely. Not higher because Twig templating and Craft's deliberately unopinionated content modeling still impose a genuine learning curve on first-time developers.

Independent 2026 practitioner data puts basic Craft sites at 1–2 weeks, custom marketing sites at 2–6 weeks and enterprise projects at 2–4 months — squarely in the rubric's strong band at both ends, with no community signal of chronic overruns. The structural cost is front-loaded: Craft has no theme marketplace, so every site is bespoke or built from internal agency templates, and content modeling consumes a larger share of the project than on WordPress. Not higher because that higher starting line is a consistent, acknowledged tax on the first weeks of any Craft build.

ZipRecruiter's September 2026 data puts the US average Craft CMS developer at $73.23/hr with most between $65.14 and $84.13 — essentially generalist web-developer territory rather than a specialist premium — and the stack is mainstream PHP + Twig with no certification requirement or proprietary language. UK senior freelancers run £400–700/day and specialist agencies £1,000–1,500/day blended, consistent with a modest 15–25% uplift over generalists rather than the 25–40% previously assumed. Not higher because the talent pool is materially smaller than WordPress or plain PHP, and Craft-specific knowledge of Matrix, custom field types and project config still requires ramp-up.

Most Craft buyers self-host, so server, database, CDN and backups are a separate line from the $279–399 license, and the floor is higher than a PHP CMS's reputation suggests — practitioners are explicit that a serious Craft site will not run on a £5/month shared host, putting realistic managed Craft hosting in the $30–100+/month bracket. Craft Cloud is a credible, fully-priced first-party alternative that bundles the Team or Pro license at $130/$260 per month per project, which is honest but expensive per site next to self-hosting a comparable open-source CMS on a $20 VPS. Not higher because hosting is unavoidably additive on every path; not lower because the stack is commodity PHP/MySQL with many competent hosts rather than bespoke infrastructure.

Self-hosted Craft's ongoing burden is quantified by practitioners at roughly half a day to a day of senior developer time per month for minor updates, plugin updates and PHP version moves — far short of a dedicated ops person — plus a project-shaped major-version upgrade every few years. Craft Cloud removes nearly all of it: push-to-deploy builds, a zero-config on-demand queue worker, automatic and manual backups, Cloudflare firewall/DDoS and static caching, and serverless autoscaling. Not higher because the self-hosted majority still owns patching and monitoring, and Craft 6's rearchitecture onto Laravel (alpha targeted Q2 2026) makes the next major upgrade a larger-than-usual planned project.

Native export is no longer missing: as of Craft 5.9.0 every element index carries an Export button producing CSV, JSON, XML, XLSX or YAML, content sits in a standard MySQL or PostgreSQL schema the owner controls, configuration is plain-text YAML project config, and the source is on GitHub under the Craft License. On the import side, Feed Me is now a first-party Pixel & Tonic plugin — free, 18,678 active installs, released 16 September 2026 — not the abandoned community workaround previously assumed. Not higher because bespoke Twig templates and Craft-specific structures such as Matrix do not port to another CMS, so a platform exit still means rebuilding the presentation layer even when the data moves cleanly.

Craft's core vocabulary (Sections, Entry Types, Fields, Field Layouts, Assets/Volumes, Project Config) maps to standard CMS mental models, and the 'entrification plan' is actively collapsing element types rather than adding them — Matrix blocks became entries in Craft 5, and 5.9 officially deprecated Categories and Tags so nearly everything is now an entry. Offsetting that, Content Block fields (added 5.8) are a second nested-content abstraction alongside Matrix with their own rules (no nesting inside each other), and Twig plus Project Config remain platform-specific things to learn. Not 75+ because the coupled path still carries Twig, Project Config sync semantics, and two overlapping nested-content field types.

Craft ships a multi-chapter official 'Intro to Craft CMS' tutorial (install → configure → authoring) plus a separate audience-agnostic Knowledge Base, a Glossary, four framework-specific starters at craftcms.com/starters, and CraftQuest as the official training partner with a free sub-hour Craft 5 quick-start and ~80 paid courses. The built-in setup wizard walks first-run database, site, and admin-user configuration in-console. Not 75+ because there is no in-app interactive product tour and no certification path — the guided sequence is docs- and video-based.

The headless path is fully mainstream — GraphQL is native to core with no plugin required, and Craft maintains official Next.js, Nuxt, and Astro starters, so a JS developer never touches PHP. The coupled path still requires Twig templating on a Yii 2 PHP core, which is transferable (Symfony/Drupal-adjacent) but not what most modern JS developers know. Craft 6's port to Laravel — a far more mainstream PHP framework — has been in alpha since May 2026 with a craftcms/yii2-adapter compatibility layer, but it is not GA (beta Q3 2026, release late 2026/early 2027), so it is directional rather than creditable today.

Craft runs a dedicated vendor-maintained starters hub with four options — Twig, Nuxt, Next.js, and Astro — each installed by a single composer create-project command and each shipping seeded example content (a GraphQL-powered blog with posts, pages, and a working guestbook form), plus documented GraphQL token generation and functioning live preview. Prior scoring credited only two starters and missed the Nuxt and Twig ones. Not 75+ because the frontend starters are relatively lean blog demos with no CI/CD pipeline config beyond the Craft-side craft-cloud.yaml, and no SvelteKit/Remix coverage.

`ddev composer create-project craftcms/craft` scaffolds a project and auto-launches a setup wizard that writes the database connection, security key, first user, and default site, so the raw .env surface is generated rather than hand-authored; on Craft Cloud there is no infrastructure config at all — database, queue, cache, and session are managed, with only a craft-cloud.yaml declaring PHP/Node versions. Self-hosting still means bringing a PHP runtime, MySQL/PostgreSQL, Composer, and a local orchestrator (DDEV), and headless projects add a GraphQL schema plus token issuance on top. Sits in the moderate band rather than 70+ because the near-zero-config experience depends on adopting both DDEV and Craft Cloud.

Schema lives in version-controllable Project Config YAML with a documented conflict-resolution path (project-config/touch then apply), there are no field-count caps, migrations have a first-class extend API, and Feed Me plus native CSV/JSON/XML/XLSX/YAML exporters cover import/export; Craft 5.10 added a deletion workflow that surfaces blocking relations and lets you replace or remove them before destroying content. Against that, field type changes can still lose data, cross-environment plugin migrations can clobber pending YAML unless schema versions are checked, the Matrix-to-entries migration was a genuine breaking change, and the 5.9 categories/tags deprecation queues up another content-model migration before Craft 6. Above 60 because tooling support is real, but well short of risk-free.

On the coupled Twig path, live preview and shareable draft URLs are genuinely plug-and-play with zero frontend code — prior scoring graded only the headless path and undersold this. Headless preview now also works out of the box in the official Nuxt, Next.js, and Astro starters, whose READMEs state live preview "works as expected" with copyable secure draft URLs, so it is reference-implementation rather than blog-tutorial territory. Held to the mid-60s because a from-scratch headless frontend still requires per-Section preview targets, token plumbing, and Next.js draft-mode handling, with documented {sourceUid} vs {uid} gotchas.

There is no certification requirement or partner-gated skill set: headless consumers need only GraphQL, and CraftQuest (the official training partner) plus an active Discord and Knowledge Base cover the rest. Platform-specific knowledge is still needed for Twig, Project Config deployment semantics, and Craft's field-layout conventions, and the Craft developer pool is materially smaller than WordPress's. A growing third-party AI tooling layer (stimmt/craft-mcp with ~55 tools, markhuot/craft-ai) lets generalists query the content model directly, but it is community-maintained, not first-party.

Craft is a solo-developer platform in practice — one developer can scaffold, model, build, and ship a production site, and Craft Cloud removes the dedicated ops role entirely by managing database, queue, cache, session, and deploy-on-push from Craft Console with no infrastructure to provision. There is no mandatory implementation partner or solution-architect model of the kind AEM, Sitecore, or Liferay impose. Crosses 75 because the minimum viable team is genuinely one person, though on the coupled path that person needs PHP-side comfort as well as frontend skills.

After go-live, editors self-serve routine operations — entries, assets, drafts and revisions, live preview, and shareable preview links — and Content Block plus Matrix fields let them assemble page layouts from developer-defined components without a ticket; 5.9 added custom entry index pages so content navigation can be reorganized in-console, and 5.10's deletion blockers let editors resolve relations themselves instead of escalating. Reviewers consistently cite the control panel as accessible to non-developers. Capped below 75 because any new field or entry type still requires a developer and a Project Config deployment, and there is no free-form visual drag-and-drop page builder for marketers.

Craft 5 was the first major release that may not require breaking changes for all plugins — maintainers can tag a compatibility-only point release — and Craft runs its own schema migrations through the CP/CLI updater rather than hand-written SQL, so minor updates apply cleanly via `composer update`. Real 4→5 friction remains: Matrix block type IDs change as blocks convert to entry types (breaking any code loading them by hardcoded ID), Commerce had breaking API changes for multi-store, and projects must step to the latest preceding minor and test on staging first. Not higher because it is still self-hosted PHP requiring a staging rehearsal per major; not lower because Craft 6's `craftcms/yii2-adapter` lets Craft 5 plugins run unported, so the Laravel rewrite is not the cliff it was previously scored as.

Pixel & Tonic ships fixes in ordinary point releases fast (CVE-2025-32432, CVSS 10.0, patched three days after notification; the 2026 CVEs landed in 5.10.0, 5.10.12 and 5.10.13) and operates real notification plumbing prior scoring missed — a dedicated Critical Releases Atom feed plus an alert banner injected across the top of every unpatched Craft install once a public exploit exists. Craft still never auto-updates, so operators must apply patches by hand, and 2026 has carried a steady CVE cadence (CVE-2026-55791 SSRF/JS injection, CVE-2026-86731 privilege escalation CVSS 6.5, CVE-2026-92591 secret disclosure CVSS 5.9, CVE-2026-92593 code injection CVSS 8.8). Not higher because the 2025 RCE left roughly 13,000 instances exposed and ~300 compromised, proving the real-world patch-application lag; not lower because severity in 2026 is materially below that event and disclosure quality is strong.

Craft 5 has been designated an LTS release supported for five years after Craft 6 GA — through the end of 2031 — which means the Laravel rewrite shipping in Q4 2026 is explicitly not a forced migration; teams can stay on Craft 5 for roughly five more years. The `craftcms/yii2-adapter` further softens the eventual move by running existing Craft 5 plugins on Craft 6 with little or no porting. Not higher because Craft 4 did reach security EOL in April 2026 on a conventional ~2-year window and the Yii-to-Laravel port will eventually require rework for custom code and plugins that want native Craft 6 APIs.

Craft runs on a conventional, small PHP/Composer stack — PHP with modest memory and execution-time floors, MySQL or PostgreSQL, a web server, optional Redis — with no exotic runtimes and a far shallower dependency graph than Java-based DXPs. Craft Cloud removes the server-dependency question entirely for hosted customers by managing the runtime, database, queue runners and WAF. Not higher because self-hosted operators still own the full server stack and transitive framework issues do surface (Yii 2's CVE-2024-58136 was part of the CVE-2025-32432 exploit chain); not lower because Composer makes the plugin and framework graph legible and patchable.

Craft ships a little more monitoring surface than previously credited — a documented no-op health-check controller action built for automated uptime probes, CP utilities for the queue and logs, a public status page for Cloud, and a CP "Activity" delivery log with configurable retries in the first-party `craftcms/webhooks` plugin. Everything beyond that is third-party: Pulse, Control Tower, Oh Dear and Semonto all supply the health, queue-depth and system-metrics dashboards that core lacks, and there is no native APM. Not higher because self-hosted deployments still require the operator to stand up all OS, database and application monitoring themselves; not lower because the health endpoint and managed Cloud queue runners give teams a real starting point.

Craft covers the basics — drafts and provisional drafts, revision history, per-field change tracking, entry statuses — and since 5.9.0 every element index carries a native Export button producing CSV, JSON, XML, XLSX or YAML, with first-party Feed Me handling import, which makes bulk content remediation far easier than prior scoring allowed. What is still missing natively is the automated hygiene layer: no orphan-asset detection, no broken-reference alerting, no content-expiry workflow, and no activity log or approval workflow (both Craft 6 roadmap items, not shipped). Broken-link coverage requires third-party plugins such as Bulk Link Checker or Craft Link Checker. Not higher because 60+ is reserved for platforms with automated hygiene tooling, which Craft lacks; not lower because the structured content model and native exporters reduce drift materially.

The prior score treated Servd as the only managed option, which is stale: Craft Cloud is first-party and GA, bundling a global CDN, Cloudflare static page caching with automatic invalidation, on-demand edge image transforms that bypass PHP entirely with no transform or compute limits and no storage charge, edge-side includes via `cloud.esi()`, and three purge granularities including surrogate-key purging that reuses Craft's own cache dependency graph. Core Craft 5 also defuses the classic N+1 footgun with `.eagerly()`, which auto-triggers eager-loading without the manual `.with()` tuning Craft 4 demanded. Not higher because self-hosted deployments — still the majority — own CDN setup, Redis/Memcached configuration and query tuning entirely; not lower because a genuine near-zero-effort managed path now exists from the vendor.

Basic Developer Support is bundled free with every Craft Pro license for a year and is genuinely developer-to-developer — plugin and module development help, install troubleshooting, Twig errors, licensing — so reasonable support is not Enterprise-gated, and Craft Cloud staffs support across all four regions (US, Canada, EU, APAC). The ceiling is low, though: guaranteed response SLAs exist only under enterprise agreements, 2026 user reports put standard email turnaround at 24–48 hours for a meaningful answer, there is no phone channel or dedicated CSM below Enterprise, and launch-window on-call support starts at $2,500. Not higher because no response-time commitment of any kind attaches to the mid-tier plans; not lower because G2 rates Quality of Support at 8.2/10 and the included tier is substantive.

Craft CMS has one of the most consistently praised developer communities in the CMS space — an extremely active Discord with 8,200+ members, daily discussion, direct Pixel & Tonic participation, and beginner-friendly channels with explicit no-judgment policies, backed by Stack Exchange and GitHub Discussions. Multiple review sources cite the community as a primary reason teams choose Craft. Not higher because the ecosystem is an order of magnitude smaller than Drupal's or WordPress's and global timezone spread introduces response gaps.

Release cadence is fast and sustained: the CVSS 10.0 RCE was patched three days after notification, every 2026 CVE shipped in an ordinary point release, and 5.10.14 and 5.11.3 both landed in September 2026 while Craft 6 alphas ship most weeks — with a detailed public changelog naming individual bug fixes. Counterweight: bug issues opened in June and July 2026 were still open on craftcms/cms in September, so lower-priority items do linger, and self-hosted operators add lag after a fix is published. Not higher because of that long tail; not lower because critical-path response is demonstrably among the better records for a self-hosted CMS.

Craft 5's Content Block fields and the Craft 5.9 Matrix improvements (entry-type groups with per-group new-entry menus, Duplicate/Delete field-level actions on selected nested entries, inline-list relational view) make block assembly noticeably more marketer-friendly, and the third-party Neo plugin adds grouped/tabbed/conditional block structures often used to build page-builder-like experiences. But there is still no native drag-and-drop page builder or visual component editor in Craft 5 — a new page layout requires a developer to build the Twig template and field layout. Live Preview covers pre-publish review. Nothing in 5.9/5.10/5.11 changed this. Holds at the floor of the 50–65 band: marketers edit and rearrange content within developer-built templates but cannot create new layouts independently.

Craft provides scheduled publishing (postDate), entry status lifecycle, and expiry dates — enough to manage campaign on/off windows but no multi-channel campaign coordination, content calendaring, or native campaign analytics. The third-party Campaign plugin adds email campaign management but is not bundled. Content Releases (grouping and scheduling changes across many entries) and scheduled drafts remain Craft 6 roadmap items — Craft 6 is still pre-beta against a Q3 2026 beta / Q4 2026 GA target, so neither is creditable in Craft 5. Holds in the 20–40 band where scheduled publishing is the primary campaign feature.

Craft core still ships no native SEO field types, sitemap generation, or redirect management; all SEO capability is plugin-driven. The ecosystem remains mature and deeply integrated: SEOmatic (34,000+ active installs) covers meta tags, JSON-LD structured data, XML sitemaps, robots.txt, hreflang, canonical management, and social previews under one cascading configuration model; Retour handles 301/302 redirects with 404 capture and hit tracking. No native SEO tooling emerged in 5.9, 5.10, or 5.11. Holds at 55, the upper end of the plugin/manual tier, given the breadth and quality of ecosystem coverage.

Craft core still has no form builder, lead capture, CTA management, or conversion tracking. Formie (Verbb) is the de facto standard and is genuinely marketer-operable — drag-and-drop builder, multi-page forms, conditional logic, and a built-in integrations layer that posts submissions directly to HubSpot, Salesforce, Klaviyo, Mailchimp, ActiveCampaign and Pipedrive without developer glue; Freeform is the comparable commercial alternative. UTM awareness and conversion goals still require template work or external tag management. Nudged from 30 to 33 to recognize that the form/lead-capture path is a mature, no-code plugin inside the Craft ecosystem rather than a purely external tool, but it stays in the 20–35 band because none of it ships with Craft.

No native personalization, audience segmentation, geo-targeting, or behavioral rules in Craft CMS as of 5.11, and none on the Craft 6 roadmap. Sprig enables reactive/dynamic components but is a rendering framework, not a personalization engine. Croct provides an external personalization engine with a documented Craft integration. Building personalized experiences requires a separate CDP or personalization engine plus substantial custom development. Holds in the 15–35 band for CMS platforms with no native personalization.

Still no native experimentation in Craft core. But ABTestCraft has matured from the unsupported community GitHub project the prior score assumed into a commercial Plugin Store product ($99/yr per installation with updates and support) that is genuinely Craft-native: variants are ordinary Craft entries, tests are configured in the control panel, results render alongside content, assignment is server-side before render, chi-squared significance runs at a configurable 80–99% threshold, multiple conversion goal types are tracked (forms, phone, email, download, page visit), GA4/GTM dataLayer events are pushed, variants get automatic noindex/canonical SEO protection, and child pages cascade the parent's assignment. That is closer to the 40–60 "tight integration" band than to "no testing capability," but it remains third-party, single-vendor, with no automatic winner promotion and no first-party support commitment. Raised 25 → 36.

Content Block fields let marketers add and reorder pre-defined blocks inside existing templates without a developer. Craft 5.9 (Jan 2026) added custom entry index pages that split large sections into named, icon-labeled views, per-entry-type-group creation menus in Matrix, and Duplicate/Delete field-level actions on selected nested entries; 5.10 added a deletion-blocker modal that surfaces and remediates relations before deleting, reducing broken-reference rework. Element copy/paste, cross-site field copying, inline relation search, and Live Preview all still apply. A growing AI plugin layer (in-CP alt text, summaries, draft generation) shaves further steps. New page types still require developer involvement. Raised 55 → 57, staying in the 40–60 band.

Craft 5 ships a built-in GraphQL API available even on the free Solo edition, enabling headless delivery to web, mobile apps, and custom frontends. Pixel & Tonic maintains first-party starter kits for Nuxt and Next (with working Live Preview and secure shareable draft URLs) plus an Astro starter, demonstrating supported multi-channel headless patterns. There is still no native email, social, push, or SMS channel delivery and no channel-specific rendition model — those require external integrations. Holds at 48 in the 40–60 band: web-first with API-based delivery elsewhere, no orchestrated multi-channel workflow.

No native analytics dashboards in Craft CMS. The Instant Analytics plugin provides GA4 server-side event tracking; GTM is integrated via template modification; Formie and ABTestCraft both push conversion events to the GA4 dataLayer. All content performance data lives in external tools. Craft Console traffic metrics are listed among planned 2026 Console improvements but have not shipped, and would be infrastructure-level traffic data rather than content performance analytics anyway. Holds at 35, the floor of the 35–55 band.

Brand consistency in Craft is enforced at the developer level through template architecture, not native platform tooling. Section-independent entry types (Craft 5) enable shared content structures, field layout conditions can show/hide fields by user group or entry state, and custom field validation restricts author inputs. There are still no locked style tokens, approved component palettes, or visual brand guardrails in the CMS. Consistency depends on developer discipline. Holds at 38 in the 35–55 band: component-based consistency without platform-level enforcement.

SEOmatic handles Open Graph and Twitter/X Card meta management and social preview rendering for share cards. Social widgets and embeds are template-level integrations. There is still no native social media scheduling, push-to-social workflow, or UGC embed system, and none appeared in 5.9–5.11. Holds at 42 in the 30–50 band: OG/card management is strong via plugin, social publishing workflow requires external tools.

Craft's native Assets system covers volumes, image transforms (eager/lazy/on-demand), focal points, custom asset fields, and folder organization. Craft 5.10 added configurable asset transformers manageable from Settings → Assets → Asset Transformers and assignable to volumes by handle, plus automatic population of the native alt text field from embedded image metadata on upload — a real accessibility and metadata win at marketing asset volume. On Craft Cloud, edge image transforms are unmetered and do not count against storage quota. Still not an enterprise DAM: no rights management, no usage tracking, no rich tagging/search at scale. Raised 48 → 50, staying in the 35–55 band.

Craft has robust native multi-site/multi-language support: per-site locales, per-site content with configurable propagation, per-site scheduling and expiry, and per-site URL structures. Cross-site field copying (5.6+) speeds locale variant creation, and the plugin layer now includes AI translation (Multi Translator; DeepL/Google/OpenAI) alongside newer in-CP AI content assistants. Regional cookie consent and legal disclaimers still require third-party plugins. No transcreation workflow tooling or market-specific campaign variant management beyond generic multi-site. Holds at 52 in the 35–55 band.

The prior score of 32 undercounted the ecosystem. Formie ships a maintained integrations layer spanning three MarTech categories — CRM (HubSpot, Salesforce, Pipedrive, Zoho), email/marketing automation (Mailchimp, Klaviyo, ActiveCampaign, Campaign Monitor), and generic webhook/API targets — configured in the control panel rather than in code. Klaviyo Connect wires Craft Commerce checkout events into Klaviyo for segmentation, and the HubSpot Connector exposes HubSpot CRM and form data to Twig. Event-based orchestration is served by the first-party craftcms/webhooks plugin, which binds any Yii2 event on any sender class and keeps a CP delivery log with configurable retries (though it has no HMAC signing). Nothing here is bundled with Craft and nothing is a first-party CRM connector, so this sits at the bottom of the 35–55 "some integrations plus generic webhook/API" band. Raised 32 → 38.

Craft Commerce (first-party, Pixel & Tonic) provides custom product types with unique field layouts, variant-level content, rich media per SKU, product taxonomy, and editorial content living beside commerce data in one control panel. 2026 releases continued to deepen this: variant statuses settable from the Edit Product screen, a Promotional Price column on product indexes, and configurable per-variant defaults for Promotable / Track Inventory / Allow out-of-stock purchases / Available for purchase in variant field layouts. This is purpose-built product content modeling, not a repurposed generic content type. Holds at 65.

Craft Commerce Pro includes the full catalog pricing and discount engine, coupon management, promotional pricing, and inventory across up to five locations. 2026 releases sharpened the merchandiser's view: a Promotional Price column on product indexes, custom metadata displayed on Catalog Pricing Rule screens, explanatory coupon validation errors when a code fails order/customer/address conditions, and broader condition rules throughout the system. Still absent: search-result merchandising, automated cross-sell/upsell rules, and category-level product spotlights without custom template work. Raised 38 → 40, at the top of the 10–40 band and just short of real merchandising tooling.

Craft Commerce is a first-party, deeply integrated commerce layer with products as native elements in the control panel alongside editorial content. The first-party craftcms/shopify plugin syncs Shopify products into Craft as native elements usable in Twig and element queries — deeper than webhook-only custom integration. Commerce 6 will add authentication-based GraphQL queries to improve headless support, but Commerce 6 has not shipped. Integration with commercetools, BigCommerce, and SFCC still requires community plugins and custom API work. Holds at 58.

Craft's relation fields let editorial entries (buying guides, lookbooks, articles) reference Commerce products natively, and Craft 5.9's inline-list relational view mode makes selected products display side-by-side in the authoring UI. Templates render product data inline with editorial content, enabling shop-the-look patterns within developer-built templates. It is still not a first-class visual authoring pattern — building shoppable content requires developer template work. Holds at 50 in the 35–55 band.

Craft Commerce gives full Twig template control over every checkout step, so trust badges, shipping callouts, cart upsell banners, and post-add modals are all CMS-managed for Commerce's own checkout, with Commerce events available for dynamic insertion. 2026 releases hardened rather than expanded this surface: the Share cart action now issues a secure tokenized URL with a configurable loadCartUrlExpiry (7 days default), coupon submission is rate-limited, and PDF download tokens use Craft's native token expiry. For third-party checkouts (Shopify, commercetools), injecting CMS content requires custom headless work. Holds at 48 in the 30–50 band.

Order status emails in Craft Commerce use Twig templates editable from the control panel, and PDF order documents are CMS-templated. Product onboarding and review solicitation content can be modeled as entries linked to order data, but sequencing content off order status changes still requires custom plugin work against Commerce events. No native event-triggered post-purchase journeys and no loyalty program content tooling; nothing added in 2026. Holds at 38 in the 30–50 band.

Craft Commerce supports customer-specific catalog pricing via the catalog pricing rule engine with customer and address conditions, complex pricing rules, and B2B plus B2C from one installation; agencies document purchase-order approval flows built on it. Craft user groups and field-layout conditions gate catalogs and documents to authenticated customers. Gated spec sheets and quote-request flows still require custom form/entry development. Holds at 48 in the 30–50 band: native B2B pricing and access control exist, B2B-specific content management does not.

Craft's native search index handles keyword search over element content with attribute filtering, but it is not faceted, not commerce-aware, and has no merchandising controls. Faceted search and blended content-product results come from third-party plugins (Algolia, Elasticsearch, Scout). No native synonym management, search landing pages, or relevance tuning, and nothing was added in 5.9–5.11. Holds at 35, the floor of the 35–55 band.

Craft Commerce provides discount and coupon rules, catalog pricing rules with time windows, and promotional pricing now surfaced as a column on product indexes. On the content side, entry postDate/expiryDate scheduling activates and retires promotional banners and messaging. Countdown timers remain custom template work, and channel-specific promotional variants require per-channel template logic. Holds at 42 in the 30–50 band.

Craft Commerce Pro supports up to five stores per installation, each attached to one or more Craft sites, with per-store currency, pricing, and catalog configuration; editorial content is site-scoped with cross-site propagation for shared material. This is functional multi-storefront management for a small-to-mid brand portfolio within one install. Beyond five storefronts requires separate installations. Holds at 52 in the 35–55 band.

Craft's Assets support image transforms (now with configurable, per-volume asset transformers added in 5.10), focal points, and Craft Cloud edge delivery with unmetered transforms. Video is handled via custom fields and third-party embeds. There is still no native 360-degree viewer, AR/3D model reference type, image hotspot tooling, or zoom — all require third-party JavaScript and developer template integration. Holds at 38 in the 30–50 band.

Neither Craft CMS nor Craft Commerce has marketplace features: no seller profile system, no seller-contributed product moderation queue, no review aggregation, no content quality controls at marketplace scale. Multi-author content is possible via user groups, and a third-party Commerce multi-vendor package (batchnz/craft-commerce-multi-vendor) exists on Packagist with agency write-ups describing multi-vendor builds — but it is a single unaffiliated package, not a supported marketplace layer, and a real marketplace on Craft remains an extensive custom build. Nudged 22 → 25 to acknowledge a concrete third-party path while staying at the bottom of the 25–45 band.

Per-site product content localization is native: each Craft site carries its own locale and language, and each Commerce store has its own currency and pricing, so locale-specific product descriptions, regional pricing, and per-site promotional calendars work within the multi-site/multi-store architecture. Regulatory content (EU labels, CA Prop 65) requires custom fields. AI translation plugins assist with product copy across sites. Holds at 52 in the 35–55 band.

No native content-to-commerce revenue attribution in Craft or Craft Commerce. Instant Analytics pushes GA4 events server-side, Klaviyo Connect tracks checkout events for segmentation, and ABTestCraft reports conversion rates per variant with significance — but that last is test-scoped, not portfolio revenue attribution, and everything else lives in GA4 or Klaviyo. Connecting content engagement to revenue still happens entirely outside the CMS. Holds at 28.

Craft Pro supports user groups with granular permissions per section, entry type, and asset volume — solid RBAC on content types. Beyond that, field layout tabs and individual fields accept a Current User Condition, giving native field-level sensitivity control by user group inside the editing experience, and the third-party Isolate plugin restricts users to specific entries. SAML SSO is first-party but Enterprise-edition-only; miniOrange and Flipbox provide SSO on lower tiers. What is still missing is audience-based content visibility — restricting a published entry to a department or individual on the front end is not native and remains an open feature request (issue #4238). Nudged 50 → 52 for the native field-level conditions; stays in the 40–60 band.

Craft offers drafts, revision history with configurable retention, categories/tags taxonomy, and entry expiry — adequate content modeling for a knowledge base. There is still no knowledge lifecycle tooling: no review-due dates, no native approval workflow, no expiry reminders, and internal search needs Algolia/Elasticsearch to be usable at volume. Approval workflows and element activity logs are Craft 6 roadmap items still in active development (PR #19667 open as of Sept 2026), so they cannot be credited. Holds at 42 in the 35–55 band.

Craft has no portal features: no news feed, employee directory, social reactions, notification system, or personalized dashboards. Building an intranet on Craft means custom front-end development for every employee touchpoint. Craft does not appear on 2026 intranet CMS comparisons (Staffbase, Happeo, AgilityPortal), and searches for Craft intranet deployments surface CrafterCMS — a different vendor — rather than Craft CMS case studies. Holds in the 20–35 band.

Craft can publish news and announcements through ordinary entry sections, but there is no targeted delivery by department or user group, no read receipts, no acknowledgment tracking, no mandatory-read workflow, and no internal notification channel. All of it would be custom development. Holds at 18 in the 10–25 band.

No native people directory, org chart, or team page features. A basic directory is buildable on Craft's Users element type with custom fields (title, department, bio, photo), but org chart visualization, manager hierarchy, and HR system integration (Workday, BambooHR) are all custom work with no plugins available. Holds at 18 in the 10–20 band.

Craft gives entry revision history with configurable retention, draft/live states, and expiry dates — basic versioned document publishing. There is no policy-specific audit trail, no mandatory acknowledgment tracking, no automated review-due reminders, and no native approval workflow; Verbb's Workflow plugin ($49 + $15/yr) adds approval chains but is paid, third-party, and not policy-lifecycle-specific. Craft 6's approval workflows and element activity logs remain unshipped (PR still open as of Sept 2026). Holds at 28.

No onboarding features in Craft. Role-specific content paths, 30/60/90-day progressive disclosure, task checklists, and HR-triggered new-hire portals would all be custom development. Content modeling for an onboarding journey is possible via entry types, but there is no native framework. Holds at 18 in the 10–20 band.

Craft's built-in search index handles keyword search and basic attribute filtering over its own content. There is no federated search across SharePoint, Confluence, or Drive, no AI relevance tuning, and minimal faceting. Algolia/Elasticsearch plugins raise quality substantially but remain site-scoped rather than enterprise-federated. Holds at 22 in the 15–30 band.

Craft's GraphQL API enables content delivery into custom-built native mobile apps, and the control panel itself is responsive for editors — Craft also continues shipping quarterly accessibility work on the CP. But there is no native mobile app for content consumers, no offline support, no push notifications, and no low-bandwidth or kiosk mode for frontline workers. A frontline app is a full custom build on the headless API. Holds at 25, below the 30–50 band.

No LMS integration in Craft. Learning content can be hosted as entries, but there is no connector to Cornerstone or Workday Learning, no course assignment, no completion tracking or certification, and no micro-learning sequencing. A training hub would be a full custom build against an external LMS API. Holds at 12 in the 10–20 band.

No native social or collaboration layer. Comments, reactions, forums, peer recognition, polls, and community spaces all require custom development. Comment plugins in the store target public-site blog comments, not employee engagement. Craft also has no real-time co-editing or presence — issue #2679 is closed and locked, and element commenting is a Craft 6 roadmap item that has not shipped. Holds at 18 in the 10–25 band.

No first-party integration with Microsoft 365, Teams, Google Workspace, or Slack, and no such connector in the Plugin Store's Integrations category. Content can reach Teams or Slack via the first-party webhooks plugin or Zapier, but that is generic outbound orchestration — not embedded content cards, bots, or single-pane experiences. Holds at 15, the floor of the 15–30 band.

Craft supports scheduled expiry (disable or change status at a set time), draft/live states, and configurable revision retention. Craft 5.10's deletion-blocker modal adds a genuine safety step — before deleting an element, Craft surfaces related entries and CKEditor references with options to replace or remove them — which improves archival hygiene but is not lifecycle automation. There are still no automated review-due reminders, stale content flagging, ownership assignment, or archival workflows with audit trail; activity logging is Craft 6 and unshipped. Holds at 30 at the floor of the 30–50 band.

No native internal content analytics. Page views and engagement require external GA4 via template tags. There is no department-level view breakdown, no failed-search-term reporting, no engagement heatmaps, and no adoption dashboards. Craft Console traffic metrics remain a planned 2026 item and are infrastructure-level in any case. Holds at 18 in the 10–20 band.

Craft's native multi-site feature runs multiple sites in one installation with separate domains, template paths, locales, and per-site permissions, and practitioners document mature patterns for shared content with per-site overrides and mixed propagation strategies. This is silo-based isolation: all sites share one database, one user table, one plugin set, and one project config. Genuinely independent environments require separate installations. Holds at 55, at the bottom of the 55–70 silo band.

Global Sets provide centrally managed content (navigation, footer, global config) shared across all sites in an installation; cross-site entry propagation shares or translates content per site; cross-site field copying speeds variant creation; and Craft 5's section-independent entry types are reusable across sections serving different brands. Cross-installation federation still requires API-level workarounds. Holds at 55 in the 40–60 band.

Craft supports installation-level user management, site-specific permissions, group-based access, and project config as a version-controlled source of truth for schema across environments. There are still no native cross-brand approval workflows, no enforced global content standards, and no centralized governance dashboard. Craft Console improvements for 2026 (traffic metrics, better VCS integration, environment cloning and syncing, improved scheduled commands) remain planned rather than delivered, and Craft 6's approval workflows are still in development. Independent 2026 comparisons position Craft as a platform enterprises outgrow at the governance layer. Holds at 47 in the 40–60 band.

Craft licensing is per-project and perpetual, not per-site: Pro is $399 per project with optional $99/yr renewals, and unlimited sites can run inside one installation, so adding brands to an existing install adds no base CMS license cost. Craft Cloud is $260/mo per project (Pro) including the license. Commerce Pro is per-project and covers up to five stores. The real per-brand cost tail is commercial plugin renewals and hosting, and separate installations do scale linearly. Holds at 65.

Each site in a multi-site installation gets its own template path, so distinct visual identity per brand is straightforward at the file-system level; CSS, typography, color, and logo treatment are managed in templates and build tooling. There is no design token system, no visual theme management UI, and no token propagation across brands inside the CMS — theming is entirely developer-controlled. Holds at 40 in the 35–55 band.

Per-brand, per-locale content is managed through multi-site, with each site scoped to a locale and configurable propagation between them; AI translation plugins assist the translation step. But brand-differentiated approval chains — Brand A's French content routing through a different review path than Brand B's — are not supported natively, since Craft has no native approval workflow at all until Craft 6. Per-brand legal content governance is custom work. Holds at 35 in the 30–50 band.

No portfolio-level analytics in Craft. Each site can be tracked individually in GA4, but aggregating across the brand portfolio happens in the analytics platform, not the CMS. No content velocity benchmarking, publishing cadence comparison, or cross-brand engagement views exist natively or via plugins. Console traffic metrics are planned for 2026 and would be infrastructure-level. Holds at 18 in the 10–20 band.

Verbb's Workflow plugin (paid, $49 + $15/yr) adds configurable review stages, and per-site user groups plus section permissions allow some differentiation of who approves what per brand. There is no first-party multi-brand workflow management, no central audit trail, no independently configurable approval chain per brand, and no publishing SLA monitoring. Craft 6's approval workflows (per-group requirements, carried approvals, review notifications, workflow activity history) would materially change this item but were still in active development as of Sept 2026. Holds at 32 in the 30–50 band.

Cross-site field copying (Craft 5.6) lets content authored at a parent site be propagated to child brand sites with per-site override, and configurable propagation methods let an entry be shared across all sites, a site group, or a chosen subset. Practitioners document shared-content-with-per-site-override as a core multi-site pattern. This is not a formal syndication hub with push-update mechanics or subscription semantics, but it is functional sharing within one installation. Holds at 42 in the 35–55 band.

No native compliance guardrails for per-brand or per-region publishing. GDPR cookie consent and accessibility auditing require third-party plugins or external tools. Per-site locale settings and field validation constrain some inputs, but there is no data residency control per brand, no regional publishing guardrail, and no compliance-blocking workflow. Craft Cloud offers regional deployment across North America, Europe, and Asia Pacific zones, which helps residency at the infrastructure layer but is a hosting choice, not a content governance control. Holds at 25 at the floor of the 25–45 band.

No design system management in Craft. Shared Twig components (macros, includes) and Craft 5's reusable, section-independent entry types are the closest equivalent, but there is no centrally versioned component library, no brand-level extension mechanism, and no update propagation across installations. Template files live in the file system with no CMS-level versioning of the design system. Holds at 22 in the 10–25 band.

Craft Pro and Enterprise support unlimited users and groups with granular per-site permissions, so a central admin can manage every brand in one installation while brand teams work autonomously in their own sections; field-layout user conditions add per-group field visibility. First-party SAML SSO covers all sites in an installation but is Enterprise-edition-only (custom pricing), with miniOrange/Flipbox filling the gap on lower tiers. User federation across separately deployed brand installations requires custom SSO work. Holds at 48 in the 35–55 band.

Craft 5 made entry types section-independent, so a content type (e.g. Product Page) is defined once and reused across sections serving different brands, and per-section field layout customization plus field-layout conditions let a brand extend a shared base without forking it. Craft 5.9's Matrix entry-type groups make large shared block libraries manageable in the authoring UI. There is still no formal inheritance hierarchy, no entry-type versioning, and no model governance across brands. Holds at 45 in the 30–50 band.

No executive portfolio reporting. Content freshness by brand, publishing SLA adherence, per-brand cost allocation, and capacity planning are all absent, and per-brand figures must be assembled by hand from external tools. There is no reporting layer, no cross-brand publishing audit, and no content velocity benchmarking; Craft 6's activity logs are element-scoped and unshipped in any case. Holds at 18 in the 10–20 band.

Three of the four gating conditions are now met: a DPA free to every customer (not enterprise-gated), genuine EU/UK data residency for Craft Cloud (Germany, Sweden, United Kingdom), and a formal standalone sub-processor page listing 12 named processors with addresses and processing purposes — a material upgrade from the informal three-vendor mention buried in the privacy policy. The DPA also carries a 10-business-day sub-processor objection window and a 90-day post-termination deletion obligation. It falls short of 80+ because its transfer mechanism is the Standard Contractual Clauses approved by Commission Decision C(2010)593 of 5 February 2010, annexed to a Feb-2021 PDF that still cites Directive 95/46/EC — that SCC set was repealed by Decision (EU) 2021/914 and has been invalid for new transfers since 27 December 2022. There is no UK IDTA or Swiss addendum despite a UK hosting region, the DPA must be arranged by email rather than click-through, right-to-erasure is an email request, and the privacy statement's 'Last Updated' date is still 29 January 2020.

Craft contractually prohibits HIPAA-regulated data rather than merely lacking a BAA: the Acceptable Use Policy states the Services 'are not designed to process or host data that is sensitive in nature or subject to regulatory oversight' and bars protected health information under HIPAA, and the Terms of Service independently classify health information as 'Prohibited Data' the customer promises never to supply. No BAA exists and no healthcare guidance appears anywhere in the documentation. This is the floor of the 20–35 band — an explicit contractual exclusion is worse than silence.

GDPR remains the only regulatory framework Craft addresses. The privacy statement predates CPRA (last updated January 2020) and contains no CCPA section or California rights disclosure; there is no UK IDTA or UK GDPR addendum even though Craft Cloud now sells a United Kingdom region, and no PIPEDA statement despite a Canadian region or IRAP despite an Australian region — regional hosting has outpaced regional compliance. PCI DSS is affirmatively excluded: the AUP bars 'cardholder data protected under PCI DSS regulations.' No FedRAMP, C5, ENS, HITRUST, or LGPD coverage exists, holding this at the GDPR-only band.

Pixel & Tonic holds no SOC 2 attestation of any type. Its December 2025 year-in-review publicly committed to 'pursuing SOC 2 and ISO 27001 compliance,' but nine months later no attestation, trust center, or report-request process exists — craftcms.com/trust returns 404. The Craft Cloud security page only claims the underlying providers 'use fully SOC-2 compliant access procedures,' which is inherited infrastructure compliance and does not count. Scores mid-range within the 30–50 no-SOC-2 band: credit for a publicly stated, in-flight program, but nothing a procurement team can act on.

No ISO 27001 or ISO 27018 certification exists for Pixel & Tonic at either the platform or ISMS level, and none is claimed anywhere on craftcms.com. The same December 2025 blog names ISO 27001 as a goal being pursued, but there is no certificate, registrar, scope statement, or surveillance-audit cadence to verify. The DPA offers a contractual right to a four-hour onsite customer audit in lieu of any third-party certification, which is a weak substitute. Floor of the 30–50 no-ISO band.

The additional-certification portfolio is empty: no CSA STAR, PCI DSS, Cyber Essentials Plus, FedRAMP, IRAP, ENS, or C5. Craft does run a credible informal security program — a documented Security FAQ, a coordinated vulnerability disclosure path, a critical-releases Atom feed, GitHub security advisories, and a #security Discord channel — but none of it is third-party attested. Sits below the 45–55 base band because there is no anchor certification at all for additional credentials to build on, and PCI DSS is contractually excluded rather than merely absent.

The prior US-only assessment is obsolete — Craft Cloud now offers six regions (United States, Canada, Germany, Sweden, United Kingdom, Australia) at consistent pricing, with the project's database and compute resources always located in the selected region and 2025 engineering work explicitly moving 'more parts of the system regional.' Two material gaps hold it out of the 78+ band: uploaded assets are expressly not region-bound ('cannot be kept in a single region, by virtue of the underlying infrastructure's geographic redundancy'), and the management layer is deployed in the United States. No contractual residency guarantee is published — the docs merely 'encourage all customers to research their country's data transfer laws' — and a project's region is immutable once created. Self-hosted deployments are unconstrained.

Craft Console provides genuine self-service export: unlimited manual database backups plus nightly automated backups, both downloadable directly from the environment's Backups screen in standard mysqldump/pg_dump custom formats restorable anywhere, with a documented 30-day retention window and encryption at rest. The DPA adds a contractual 90-day post-termination deletion obligation with written confirmation on request. It stops short of 75+ because there is no API-based erasure or self-service DSAR portal — personal-data deletion is an email to hello@craftcms.com — asset export is not documented as a bundled tool, and the Terms of Service state 'Your Content may remain on the Craft Cloud after termination of these Terms unless you delete it,' leaving automatic post-termination purge undefined outside the DPA.

Craft core still ships no audit log. Content-level accountability comes from the revision system (per-entry revisions with author, timestamp and change notes) and Monolog-based application logs writable to files, databases or web services; Craft Cloud surfaces build and deployment logs in Console. Everything compliance-grade is missing or delegated: no native SIEM push or log drain, no configurable retention policy, no admin-action log, and no compliance reporting. The mature paid Audit plugin has gone stale (Craft 3/4 only, last released January 2024), leaving free community options — User Audit and Rat — as the Craft 5 path. Sits in the upper half of the 25–45 band on the strength of revisions and configurable Monolog targets for self-hosted operators.

Craft is one of very few CMSs to commit publicly to both WCAG 2.2 AA and ATAG 2.0 AA for the authoring interface, to staff the work, and to publish quarterly accessibility progress posts (most recently Q2 2026). The audits themselves, however, document substantial non-conformance rather than conformance: the v5.0.0 ACR records 18 Supports, 30 Partially Supports and 4 Does Not Support across WCAG 2.0/2.1/2.2 A and AA, and the ATAG report records 11 passed against 19 failed — the prior assessment's '~25 supports / ~8 does not support' overstated the picture. Concrete failures include no caption tracks for uploaded video, modified-state indicators not programmatically exposed on complex fields, and character limits not linked to their inputs. Real screen-reader testing across NVDA/Firefox, JAWS/Chrome and VoiceOver/Safari plus 200% zoom and colour-independence support keep it at the top of the 45–65 'stated target without demonstrated conformance' band.

Craft publishes two formal, procurement-usable artifacts — an ACR on the ITI VPAT 2.4 template scoping WCAG 2.0/2.1/2.2 A and AA, and a separate ATAG 2.0 conformance report — with a named evaluator, a dedicated accessibility@craftcms.com contact, and a documented test methodology and screen list. That is well above what most mid-market CMSs offer. It no longer clears 70 on currency: the ACR is dated 26 March 2024 against Craft v5.0.0 and the ATAG report 12 August 2024 against v5.3.0, while the shipping release is 5.11.3 — neither has been refreshed across eleven minor versions and roughly two and a half years, and there is no Section 508 conformance statement. The quarterly accessibility blog series partially compensates by evidencing continued remediation, but blog posts are not a VPAT a procurement office can file.

Craft ships zero native AI — the Craft 5 CHANGELOG contains no occurrence of AI, LLM, OpenAI or Anthropic, and the public roadmap lists no AI item for 6.0 or 6.x. But the plugin layer now has real controls: CoPilot (v1.1.0, Aug 2026, 66 installs, $59) is an in-CP chat and entry-slideout agent across Anthropic/OpenAI/Gemini with Brand Voice & Glossary (tone, terminology, forbidden words), per-section read/write/block permissions and a field-level audit log, while Loki (v0.3.2) puts admin-predefined prompt templates on individual fields with draft-or-direct writes. Content Buddy (133 installs), Sidekick (250), GPT Content Generator (94), OpenAI Content Writer, AI Assistant and Autofill fill out the band. Scores above the 20–35 plugin-only guidance because brand guardrails, prompt-template governance and human review now genuinely exist; held well below 70 because every one of them is a paid third-party plugin and nothing is in core.

Both halves of the rubric's 70+ test now exist in the ecosystem, just not natively. AI Image Editor (v1.0.0, Aug 5 2026, $39) does natural-language editing and from-scratch generation inside the control panel with four BYO drivers (Gemini, OpenAI, FLUX, Grok) and a low-res-draft-then-final-render loop; Lens (v1.0.2, Sept 4 2026) writes alt text in every site language, a title and a focal point on the subject at upload or in bulk, flags NSFW/watermarks/logos/people, and grades sharpness, exposure, compression and color profile — all in a free Lite edition. AI Alt Text (191 installs) and Content Buddy's DALL·E 2 / Stable Diffusion round it out, plus AI video subtitling and TTS plugins. Scores in the 40–60 band rather than 70+ because the smart focal point and image generation arrive only through brand-new third-party plugins with single-digit install counts, and Craft's own DAM has no AI whatsoever.

Correcting a stale anchor: LILT, previously cited here at 927 installs, does not appear in the Craft 5 plugin store or its AI/Localization listings — it remains a Craft 3/4 plugin, so it cannot carry this score. The Craft 5 story is instead Multi Translator (v2.30.0, Sept 17 2026, 753 installs) — DeepL, Google Cloud Translation and OpenAI, translating entries, assets and Commerce products with variants one-by-one or in bulk, with recursive support for Matrix, Neo and Super Table — plus CoPilot's multi-site AI translation with automatic propagation and glossary/forbidden-word enforcement, Translingua's AI field and batch translation, and Weglot's 110+ languages. Lands mid-band at 40–60: a well-maintained, high-adoption MT hookup with genuine brand-voice preservation via CoPilot, but no bulk quality scoring, no native MT engine, and nothing in core.

Coverage has broadened past the alt-text-only floor. Lens auto-generates alt text, titles, tags and focal points across the asset library for free; AI Summary and Sidekick's AI Summary field produce summaries usable as meta descriptions; and Sanka (v5.0.1, Aug 28 2026, Free–$129) pushes changed URLs to Google's Indexing API and IndexNow while auditing which AI crawlers are served what and whether a page is written in a shape an answer engine can quote. LLM Ready (395 installs) and LLMify (381 installs) auto-generate llms.txt by reusing existing SEO meta descriptions rather than duplicating fields. Sits in the 40–60 partial-automation band because AI generation of title tags, OG tags and schema markup is still absent — SEOmatic and SEOMate remain entirely non-AI — and none of this is native.

The two gaps flagged at the last scoring — auto-tagging and bulk enrichment — have both been filled. Lens auto-tags and writes alt text, titles and focal points across an entire existing asset library on demand, Autofill (v1.0.7, Jul 2026) turns messy pasted input into fully populated entries, and CoPilot plus Craft Editor MCP perform bulk cross-site content operations (fix links site-wide after a rebrand, rewrite CTAs to a new strategy, bulk-update hundreds of product descriptions). Happy Cog's craft-skill exposes entries, sections, fields, drafts, assets, users and Commerce as JSON-returning CLI commands so an agent can drive bulk ops without modifying the site. Scores in the 35–50 band for several real assists, not higher because AI smart scheduling, content routing, duplicate detection and lifecycle automation remain entirely absent.

Agentic tooling moved from experimental to a working third-party ecosystem in 2026. CoPilot (GA v1.1.0, 66 installs) is a named in-CP agent that reads, creates, edits, translates and publishes across all sites and languages with per-section permissions, brand voice enforcement, custom slash commands registered via events, web search, and a full field-diff audit log. Craft CMS MCP (2,529 installs) lands every agent write as a draft with a review queue; Craft Editor MCP is explicitly pitched for agentic pipelines; MCP Field Agent gates destructive content-model paths; Agents (v0.29.1) supplies scoped machine accounts, Target Sets and approval routing. Scores at the top of the 30–50 early band rather than into 55–75 because Pixel & Tonic ships no first-party agent, there is no agent marketplace or multi-step pipeline orchestrator, and the Craft 6 roadmap has nothing agentic on it.

No longer at the floor, but still thin. RedPen Pro ships a site-wide audit with a report and a dashboard widget scoring every entry against a house style profile; Sanka logs and audits which AI engines crawled the site, what they were served, and whether pages are quotable; Chatagent (v1.3.0, 17 installs) dashboards conversation stats, charts, training metrics and per-response confidence scores; Order Lifecycle adds AI insights over Commerce order timelines. Sits at the top of the 20–30 band because the core content-intelligence primitives the rubric asks for — topic clustering, portfolio content gap analysis, stale content detection, ROI attribution and editorial priority recommendations — do not exist anywhere in the Craft ecosystem, native or plugin.

RedPen (v5.0.1, Aug 26 2026, Free–$99) is the first real editorial-QA product in the ecosystem: twelve rules across terminology (banned and preferred terms, brand capitalisation), grammar, accessibility (missing or useless alt text, meaningless link text, empty and dead links), structure (skipped or repeated headings), typography and inclusivity — with Pro adding per-section style profiles, save-time warn-or-block validation, a site-wide audit and report, a CI console command and editorial sign-off. Lens contributes NSFW, watermark and image-quality flagging at scale. Scores below the 45–60 band on two counts: most RedPen rules are deterministic pattern checks rather than AI, with the LLM (or self-hosted LanguageTool) grammar backend only an optional Pro add-on, and the plugin is one month old at 2 installs.

Semantic search is now packaged rather than purely bespoke, but barely. Smart Search (ghoststreet/craft-smart-search v0.7.3, Sept 10 2026) blends OpenAI embeddings on PostgreSQL pgvector with keyword ranking and emits a cited AI Answer — genuine hybrid RAG, but pre-1.0, absent from the plugin store, and at 34 total Packagist downloads. Spectacles stores a similarity vector per image across OpenAI/Anthropic/Gemini/Voyage multimodal/Ollama for visual search; Chatagent does RAG Q&A over entries with confidence scores; Dexter manages Algolia and Meilisearch indexes for hybrid search; LLM Ready and LLMify make published content RAG-ready. Held near the 15–30 custom-integration band because Craft core search remains plain database full-text with no vector indexing and none on the roadmap, and every semantic option requires external infrastructure the user provisions themselves.

Nothing has changed here. A full review of the 57 plugins in the Craft plugin store's AI category found no ML personalization engine — no audience scoring, no predictive segment assignment, no next-best-content recommendation, no cold-start handling. The Craft CMS roadmap for 6.0 and 6.x contains no personalization item of any kind, AI or rule-based, and the Craft 5 changelog has no AI entries at all. The only adjacent listings are outbound marketing-OS connectors (Deon AI Connect, Launchmind Blog) that publish into Craft rather than personalizing delivery from it; genuine personalization still means bolting on an external CDP through the headless layer.

The single biggest change in Craft's AI posture this year. Craft CMS MCP (Stimmt Digital, v1.4.0, Aug 28 2026) has grown from 299 to 2,529 active installs and now ships 55 tools, 10 guided prompts and 13 URI resources over both stdio and HTTP, with per-user bearer tokens scoped readonly/content/full that are minted and revoked in the control panel and checked live against Craft's own permission system rather than approximated. Writes land as drafts with a review queue, Matrix blocks are individually addressable, multi-site writes report which sites they reached, and plugins can register their own tools via event hooks. Pixel & Tonic put it on the official Dot One 2026 programme with core team member Tim Kelty co-presenting. Held just under the 75+ official tier: capability-wise it clears that bar, but Pixel & Tonic ships no MCP server itself and the free Lite edition excludes all eight write tools.

BYOK is structurally guaranteed — Craft operates no hosted AI service, so every plugin takes user-supplied keys — and provider breadth has widened materially. Spectacles configures vision and embedding providers independently across OpenAI, Anthropic, Gemini, Voyage AI and Ollama, the last giving fully self-hosted local inference with no data leaving the server; AI Image Editor ships Gemini, OpenAI, FLUX and Grok drivers; CoPilot covers Anthropic, OpenAI and Gemini; Loki covers OpenAI, Anthropic and DeepL; RedPen accepts either a BYO LLM key or a self-hosted LanguageTool server. Local-model support amounts to real data-residency control. Kept below 75 because there is no platform-level key vault or central model configuration — each plugin stores and bills its own keys independently, which the ecosystem's own commentators flag as the practical failure mode.

A genuine strength and the best-evidenced part of Craft's AI story. Craft CMS MCP exposes 55 typed tools, 13 URI-addressable resources and 10 guided prompts, with event hooks letting any plugin register its own tools and require its own edition — MCP Field Agent does exactly that for content modelling. Happy Cog's craft-skill is an MIT, sub-1MB standalone PHAR that bootstraps any Craft install and returns JSON from CLI commands across entries, sections, entry types, fields, drafts, assets, users and Commerce, packaged as a Claude Skill and requiring no Composer change to the target project. LLM Ready (395 installs) and LLMify (381) serve Markdown via .md URLs, Accept: text/markdown content negotiation and user-agent detection plus llms.txt/llms-full.txt. Native GraphQL and Project Config make agent-driven structural changes reviewable in git. Below 70 only because there is no first-party AI SDK and no official LangChain/LlamaIndex integration guide.

Governance improved sharply in 2026, though it is assembled from paid plugins rather than the platform. Craft CMS MCP scopes per-user bearer tokens to readonly/content/full, validates them live against Craft's permission system, and lands every write as a draft in a review queue with full revision history behind it. Craft Editor MCP authenticates through the user's own Craft login so the assistant inherits exactly their permissions, prompts before publishing or deleting, and ships a tokens manager plus an audit log of every connected client and action. CoPilot logs every read, create and update with field-level diffs and enforces glossary and forbidden-word lists; Agents adds approval routing, Target Sets, rate limits and IP allowlists. Capped at the top of the 25–45 band because Craft core has no AI audit trail — plain Activity logging is only 'In Progress' for 6.0 — there is no hallucination detection or IP indemnification, and Craft CMS MCP's Tinker tool runs arbitrary PHP inside the live application.

Action-level visibility now exists in several places — Craft Editor MCP's audit log records every connected client and every action taken, Craft CMS MCP's control-panel token manager shows which scoped tokens exist per user, CoPilot traces every agent operation with diffs, Chatagent dashboards conversation stats, training metrics and per-response confidence with thumbs up/down, RedPen Pro has a report and dashboard widget, and OpenAI Content Writer offers a token/request usage widget. What is entirely missing is the cost side: no per-user or per-team AI spend, no credit or quota management, no cross-plugin aggregation, nothing in core. The ecosystem's own 2026 survey names this exactly — five AI plugins means five API keys, five bills, and no idea what is costing money.