An open-source headless CMS is one whose source code you can run on your own servers, change, and use without paying a licence fee. In October 2026 the practical shortlist is Payload and Strapi for Node.js teams, Drupal, Wagtail and TYPO3 for PHP and Python teams with complex content, Ghost for publishing, and KeystoneJS for GraphQL on Node. Directus is popular but source available, not open source in the strict sense, and we say so below.
This page compares nine platforms checked against their repositories and vendor sites in October 2026. If you want a hosted product instead, see our headless CMS platform index and the headless CMS pillar. Git-based tools such as Decap and TinaCMS are open source too, but they are covered in the Git-based CMS comparison.
What does open source mean for a headless CMS?
Three things matter in practice, and a licence name alone does not tell you all of them.
- Licence terms. MIT, BSD and GPL licences are open source. Some projects add a proprietary tier next to an open core. Strapi, for example, puts code in
ee/directories under a separate licence. Others, like Directus, use a source-available licence with revenue limits. - Self-hosting. You run the app, the database and the media storage. You also own updates and security fixes.
- Exit. If the vendor changes terms, you can fork or move your data. With a standard SQL database behind the CMS, that is realistic. With a hosted proprietary service it often is not.
Open source also does not mean headless. WordPress, Drupal and TYPO3 started as page-rendering systems and gained APIs later. They work headless, and they bring their admin features along.
How we evaluated
We checked licence files and project pages, how the content is exposed (REST, GraphQL or JSON:API), where the content lives, how the platform is hosted, and whether the vendor holds back features behind a paid edition. Where a source was a third-party summary, we say so. Costs are described as drivers, not prices.
Open-source headless CMS compared
| Platform | Licence | API | Hosting | Free tier | Best for |
|---|---|---|---|---|---|
| Strapi | MIT core, proprietary ee/ features | REST, GraphQL | Self-hosted or Strapi Cloud | Yes, Community Edition | Node.js teams with custom content models |
| Payload | MIT | REST, GraphQL, Local API | Self-hosted, inside Next.js | Yes | Next.js teams that want code ownership |
| Directus | Source available (MSCL) | REST, GraphQL | Self-hosted or Directus Cloud | Yes, under revenue and size limits | Wrapping an existing SQL database |
| Drupal | GPL | JSON:API in core | Self-hosted or managed hosts | Yes | Large, structured, multilingual sites |
| WordPress | GPL | REST, WPGraphQL plugin | Self-hosted or managed hosts | Yes | Teams with WordPress editors and content |
| Wagtail | BSD | Wagtail API, Django REST | Self-hosted | Yes | Python and Django teams |
| Ghost | MIT | Content API, Admin API | Self-hosted or Ghost(Pro) | Yes, self-hosted | Publications and newsletters |
| KeystoneJS | MIT | GraphQL | Self-hosted | Yes | Node teams that want schema as code |
| TYPO3 | GPL | EXT:headless JSON API | Self-hosted or managed hosts | Yes | DACH region enterprise sites |
The platforms, one by one
Strapi
Strapi’s core is MIT licensed and you can self-host it anywhere. Code in ee/ directories falls under a separate Enterprise licence, and current plans are Community, Growth and Enterprise, set by a licence key. Single Sign-On, Review Workflows and Audit Logs sit in Enterprise, and Releases start at Growth. It is a good fit when editors need a ready admin panel and developers want a REST or GraphQL API. See our Strapi page and the comparison Strapi vs Payload.
Best for: custom content models with a mature admin. Skip if: you need review workflows without paying.
Payload
Payload is MIT licensed and version 3 installs directly inside a Next.js app, admin and backend included. Supported databases are MongoDB, Postgres and SQLite, through separate adapters. Hosting is your choice; the vendor offers Payload Cloud as an optional paid service. We used it for a B2B SaaS marketing site. See Payload.
Best for: TypeScript teams on Next.js. Skip if: your frontend is not JavaScript and you want the CMS fully apart from it.
Directus
Directus wraps an SQL database with REST and GraphQL APIs and an admin app. Per the official docs, it is licensed under the Monospace Sustainable Core License, a source-available licence derived from the Fair Core License. The Open Innovation Grant covers free self-hosted use under 5 million dollars in annual revenue and fewer than 50 employees. The core tier without a licence is limited to 3 seats and 25 collections, with no SSO. Older copies of the repository still say Business Source License, which is outdated. See Directus.
Best for: adding an admin and API to an existing database. Skip if: your company is above the grant limits and wants a pure open-source licence.
Drupal
Drupal is GPL software, and JSON:API ships in core, so a decoupled site needs no extra module for the base API. The docs also mention security caution: exposing every entity through JSON:API enlarges the attack surface, so limit what is exposed. Drupal’s strengths are structured content, roles, workflows and multilingual support at large scale. See Drupal. Moving off it? Our Drupal migration service covers that.
Best for: large organisations with complex editorial rules. Skip if: you want a lightweight setup for a small site.
WordPress
WordPress is GPL and exposes a built-in REST API. WPGraphQL, a GPL-3 plugin, adds GraphQL. Many teams keep WordPress as the editing tool and replace the theme layer with a modern frontend. Plugins that render on the server will not work headless, so audit which ones you depend on. See headless WordPress and our guide on WordPress vs headless CMS.
Best for: keeping familiar editing while modernising the frontend. Skip if: your content model is highly relational and you are fighting plugin limits.
Wagtail
Wagtail is a BSD licensed CMS on Django. It ships a v2 API built on Django REST Framework, and its current docs describe a new API built on Django Ninja that can also handle authenticated CMS operations, including StreamField editing. StreamField content is exposed through the API. See Wagtail.
Best for: Python teams with editorial requirements. Skip if: nobody on the team knows Django.
Ghost
Ghost’s core repository is MIT licensed. Its Content API is a read-only, key-authenticated REST API for posts, pages, authors and tags, and the project documents a decoupled setup that builds a frontend from the API. Ghost(Pro) is the paid hosted version. It is built for publishing, memberships and newsletters, not for arbitrary content models. See Ghost.
Best for: blogs, media and newsletters. Skip if: you need custom content types beyond posts and pages.
KeystoneJS
KeystoneJS 6 is MIT licensed and builds a GraphQL API and an admin UI from a schema defined in code. It runs on Node and is published under the @keystone-6 packages. We found an active repository but no current official Next.js guide, only an archived example from 2022. See KeystoneJS.
Best for: Node teams that like schema as code and GraphQL. Skip if: you want a large plugin ecosystem.
TYPO3
TYPO3 is GPL software. The EXT:headless extension, also GPL-2.0, provides a JSON API for content elements, page and meta data, navigation and language handling, and its companion frontend is nuxt-typo3. The current 5.x line targets TYPO3 14, while the 4.x line covers TYPO3 12 and 13 and receives only bug and security fixes. See TYPO3.
Best for: existing TYPO3 estates, common in the German speaking market. Skip if: you are starting fresh and have no TYPO3 skills.
How to choose
- Your team writes TypeScript: Payload or Strapi.
- You already have a database to expose: Directus, with the licence caveat.
- Complex roles, workflows and languages: Drupal.
- Python shop: Wagtail.
- Publishing and newsletters: Ghost.
- Editors refuse to leave WordPress: headless WordPress.
The cost of open source is mostly operations. Budget for hosting, backups, upgrades, security reviews and a person who owns them. If you want a managed alternative with a free plan, see the free headless CMS comparison. Our headless CMS agency team builds on Payload, Strapi and Directus, and migrates content from WordPress and Drupal.
