Best Headless CMS 2026: Stack, Hosting, and Budget

After moving this site from Payload to Astro and Markdown, I wanted to revisit a question I have answered differently on different projects: which CMS should you choose when the frontend might be separate?

Payload was not the wrong CMS. It was simply more application than a small, mostly static article archive needed. A global marketing team, a product catalog, and a personal blog can all use a headless CMS, but they should not use the same selection criteria.

The first version of this comparison was too narrow. It covered products marketed as headless but left out conventional CMSs that can expose content through mature delivery APIs. That would exclude Umbraco CMS, WordPress, Drupal, Optimizely CMS, Magnolia, and Wagtail before asking whether one of them is actually the cheaper and safer fit for the team.

This expanded comparison covers 16 products using the same decision fields. It includes managed headless SaaS, self-hostable application CMSs, and hybrid CMS/DXPs:

Contentful, DatoCMS, Hygraph, Prismic, Sanity, Storyblok, and Umbraco Heartcore as managed headless services;
Directus, Payload, and Strapi as self-hostable headless-first or application-oriented platforms;
Optimizely CMS, Umbraco CMS, WordPress, Magnolia, Drupal, and Wagtail as hybrid CMSs.

An API is a delivery capability, not proof that every CMS has the same architecture, operating cost, preview behavior, extension model, or ecosystem.

Pricing review: 27 August 2026. Plans, allowances, and product terms change. Treat every amount as a dated snapshot and confirm the linked first-party pricing before making a decision.

What is a headless CMS?

A headless CMS is a content management system that stores and manages content without requiring one built-in presentation layer. Editors work in the CMS, while websites, apps, shops, kiosks, and other channels request published content through REST, GraphQL, or another API and render it independently.

The simplest headless CMS definition is “a CMS without a mandatory frontend.” That is also the practical headless CMS meaning used throughout this comparison: the content backend and presentation layer can be deployed, changed, and scaled separately. It does not mean the product lacks an editor, preview, asset library, workflow, or optional coupled renderer.

What is headless CMS architecture in practice?

A typical headless CMS architecture has five parts: an authoring interface, a structured content repository, an asset store, delivery and management APIs, and one or more separately deployed frontends. Webhooks or event streams tell those frontends when to rebuild or invalidate cached content.

A headless CMS platform may bundle all of those services or provide only the content application. A headless CMS cloud service is the SaaS version of that model: the vendor operates the content backend while the customer operates the frontend. With a self-hosted product, the customer also owns the CMS runtime, database, storage, scaling, backups, upgrades, and security response.

Headless CMS vs traditional CMS

In a headless CMS vs traditional CMS comparison, the main difference is who owns presentation. A traditional CMS normally joins content, templates, routing, preview, and page delivery in one application. A headless product makes the API the primary delivery boundary and leaves rendering to another application.

A hybrid headless CMS supports both approaches. It can render conventional pages for one site while exposing the same or related content to external frontends. Hybrid is often the practical choice when editors need visual page management, the organization already has backend expertise, or only part of an existing estate should be decoupled.

Headless CMS SEO

Headless CMS SEO is not inherently better or worse than SEO from a coupled CMS. The frontend must generate crawlable HTML, titles, descriptions, canonical URLs, redirects, structured data, hreflang links, XML sitemaps, and fast pages. The CMS must model those fields, preserve preview and publication states, and trigger reliable cache invalidation. A fast API cannot compensate for a client-only page that omits metadata or renders important content too late for users and crawlers.

Enterprise and open-source headless CMS options

An enterprise headless CMS typically adds SSO, SCIM, audit history, approval workflows, localization governance, regional hosting, contractual support, and an SLA. An open source headless CMS replaces some vendor dependency with code and infrastructure ownership; it removes or reduces license fees but makes upgrade planning, extension health, backups, monitoring, and incident response part of the buyer’s responsibility.

Best headless CMS 2026: the short answer

Best headless CMS 2026: the short answer
Project or team constraint	Budget profile	Start with	Why
Personal site, blog, or proof of concept	No or very low software spend	WordPress, Prismic, or Sanity	Choose editor familiarity, a large ecosystem, or managed convenience rather than headless purity
Small visual marketing website	Low to mid self-service budget	Prismic, Storyblok, DatoCMS, or Umbraco CMS	Strong page composition or preview; Umbraco adds a free self-host route and Cloud from €45/month
Product or application content	Developer-led, usage-sensitive budget	Sanity, Hygraph, Payload, or Directus	Strong structured APIs; the self-hosted choices also become part of the application platform
Self-hosted Node.js or TypeScript application	No CMS license budget, engineering budget available	Payload, Strapi, or Directus	The team owns the runtime, database, upgrades, backups, and extension code
Conventional .NET website	Free self-hosted software or managed PaaS	Umbraco CMS	Core REST Delivery API, familiar page editing, deep .NET extension points, and an affordable Cloud path
Enterprise .NET DXP	Commercial license and implementation budget	Optimizely CMS	Mature page editing, approvals, localization, self-hosting, and vendor-operated DXP options
Enterprise Java or sovereignty-sensitive program	Commercial enterprise budget	Magnolia	Self-hosted or PaaS Java platform with visual SPA authoring; edition and module entitlements must be priced
Complex multilingual PHP content platform	Free software, medium-to-high implementation budget	Drupal	Core JSON:API, content moderation, localization, Layout Builder, and a large module ecosystem
Existing WordPress publishing estate	Low migration budget through enterprise	WordPress	Core REST and optional WPGraphQL can be cheaper than replatforming, after auditing plugin API coverage
Python/Django organization	Free software, engineering-led budget	Wagtail	Strong editorial workflow and native read-only REST inside an owned Django application
No CMS backend operations	SaaS subscription and possible usage overages	Contentful, DatoCMS, Hygraph, Prismic, Sanity, Storyblok, or Heartcore	The vendor operates the content service; pricing, governance tiers, and vendor constraints dominate

These are starting points, not automatic winners. The people editing the content, the team operating the platform, and the features hidden behind an enterprise contract can change the answer.

Best headless CMS for ecommerce

Choosing a headless CMS for ecommerce starts by separating content from commerce. The CMS should own editorial pages, campaigns, buying guides, reusable product storytelling, and localization. A dedicated commerce platform should remain the source of truth for price, inventory, promotions, carts, checkout, orders, and payments unless the selected product explicitly supplies those capabilities.

Best headless CMS for ecommerce
Ecommerce situation	Start with	Why
Small, marketing-led storefront	Prismic or Storyblok beside a dedicated commerce backend	Visual page composition and managed SaaS reduce editorial and operational work
GraphQL-first catalog or composable application	Hygraph or Sanity	Structured models and flexible queries suit product-related content and multiple channels
Enterprise composable commerce program	Contentful or Optimizely CMS, with commerce services scoped separately	Mature governance, partner ecosystems, integrations, and enterprise support matter more than entry price
Existing WordPress and WooCommerce estate	WordPress	Decoupling may cost less than migration, provided product, cart, preview, SEO, and plugin APIs are audited
Owned TypeScript commerce application	Payload beside a dedicated commerce backend	The CMS, custom content APIs, and application logic can live in one TypeScript codebase

There is no universal best headless CMS for ecommerce. A visually rich campaign site, a large product catalog, and a regulated global checkout have different content models, traffic patterns, editor needs, and systems of record. Prototype the connection between CMS content and real product data before choosing either platform.

Adobe headless CMS: where Experience Manager fits

When people refer to an Adobe headless CMS, they normally mean Adobe Experience Manager Sites. Adobe documents AEM headless around Content Fragment Models, Content Fragments, and GraphQL delivery, while its Universal Editor supports visual editing for headless and headful experiences. AEM can therefore operate as a headless or hybrid enterprise CMS rather than only as a traditional page renderer. AEM headless introduction · Universal Editor

I have not added AEM as a seventeenth scored row because “Adobe” still needs a product-boundary decision: AEM Sites content delivery and Adobe Commerce’s headless GraphQL architecture are separate concerns and commercial products. Shortlist AEM when Adobe is already strategic, enterprise governance and visual authoring justify the implementation budget, and the exact Sites, Assets, Commerce, hosting, API, and support entitlements can be compared contractually.

First decide what kind of CMS you are buying

“Can return JSON” is too weak a definition of headless to guide a purchase. The products fall into three useful architectural families:

First decide what kind of CMS you are buying
Family	Products in this comparison	What the choice implies
Managed headless SaaS	Contentful, DatoCMS, Hygraph, Prismic, Sanity, Storyblok, Heartcore	No CMS backend runtime to operate; subscription, usage, regions, governance tiers, and exit path matter most
Self-hostable headless-first or application CMS	Directus, Payload, Strapi	Modern APIs and deep ownership; the team operates the application, database, storage, upgrades, and security
Hybrid CMS or DXP	Optimizely CMS, Umbraco CMS, WordPress, Magnolia, Drupal, Wagtail	Coupled and decoupled rendering coexist; the existing backend stack, editor features, and ecosystem can outweigh architectural purity

Umbraco CMS and Umbraco Heartcore are separate products. Umbraco CMS is an MIT-licensed .NET application with a core Delivery API and optional Cloud PaaS. Umbraco Heartcore is a proprietary managed headless service without server-side application customization.

How this comparison works

Every CMS is compared using these fields:

Product category and required backend stack
Supported frontend and API boundary
SaaS, PaaS, or self-hosted deployment
License model and free route
Public price or quote-only status
Editorial functionality, localization, workflow, and preview
Ecosystem health: extensions, maintainers, partners, hosting, support, available skills, and upgrade compatibility
Code, schema, and admin customizability
Product stewardship, release activity, roadmap transparency, and support horizon
Governance, operational burden, project fit, and main caveat

Feature cells distinguish core/free, core/commercial, first-party package, paid add-on, community plugin, custom implementation, and not publicly documented. An API is also identified as read-only or read/write where that boundary affects the decision.

A platform does not meaningfully “have workflow” for a small team when it requires an enterprise contract. Magnolia Community Edition is not scored as if it includes every DX Core module, WordPress core is not credited with every premium plugin, and Optimizely’s self-hosted REST API is not treated as the same product as its hosted Graph service.

Use the hard constraints in this order

Necessary technology: Can the team safely own .NET, PHP, Java, Python, Node.js, or Astro, or should the CMS backend be entirely vendor-operated?
Operating model: Choose multi-tenant SaaS, extensible vendor PaaS, or a self-hosted application.
License and procurement: Decide whether proprietary SaaS, commercial deployable software, permissive open source, or copyleft open source is acceptable.
Ecosystem and stewardship: Check extension maintenance, security response, implementation partners, available expertise, release activity, roadmap visibility, and supported upgrade paths.
Editorial model: Test structured content, page building, publications, workflow, localization, and preview with real editors.
Delivery boundary: Confirm REST or GraphQL, read versus write, core versus add-on, authentication, preview, webhooks, and cache invalidation.
Total cost: Add software, hosting, traffic, seats, environments, add-ons, implementation, upgrades, backups, and operational staffing.

Treat the ecosystem as part of the product

A strong API is not enough if the organization cannot hire maintainers, find a reliable implementation partner, replace an abandoned extension, or upgrade without breaking the frontend. Evaluate the official organization and the surrounding ecosystem separately:

who controls the product, license, hosted service, and roadmap;
whether releases, security fixes, and supported upgrade paths are visible and current;
how many critical capabilities come from first-party, community, or single-vendor extensions;
whether experienced developers, agencies, managed hosts, and enterprise support are realistically available; and
whether the ecosystem reduces delivery risk or merely creates a larger dependency surface.

Free SaaS is not the same as free software

A free SaaS plan usually includes hosting but imposes limits on users, content, traffic, API calls, environments, or commercial use. Free self-hosted software removes the license invoice while leaving the project responsible for infrastructure, backups, monitoring, upgrades, security, and incident response.

The useful question is not “Is it free?” It is “Which costs and responsibilities move to us?”

Do not compare only the starting price

Headless CMS pricing units are inconsistent. Vendors charge by combinations of seats, repositories, projects, locales, environments, records, API operations, bandwidth, storage, and support. Before choosing a plan, estimate at least:

editors, developers, guests, and service accounts;
production and non-production environments;
locales and translation workflow;
records, assets, traffic, and API usage;
SSO, audit, approval, region, and SLA requirements;
migration work and the cost of leaving later;
hosting and operations for self-managed products.

Stack, hosting, license, and entry-cost comparison

“Required stack” means the backend technology the buying team must operate or extend. A SaaS vendor may use a particular runtime internally, but that is not a required skill for the customer.

Stack, hosting, license, and entry-cost comparison
CMS	Category	Required backend stack	Deployment	License	Free route or first public price
Contentful	Managed headless SaaS	None; frontend team only	SaaS	Proprietary	Free learning/testing space; Lite $300/month
DatoCMS	Managed headless SaaS	None; frontend team only	SaaS	Proprietary	Small Free project; Professional from €149/month annually
Directus	Data/API platform	Node.js and a supported SQL database when self-hosted	Self-host or optional Cloud	Source-available MSCL-1.0-GPL	Constrained Core $0; Team from $499/month; Cloud separate
Hygraph	Managed headless SaaS	None; frontend team only	SaaS	Proprietary	Hobby free; Growth from $199/month
Payload	Application CMS	TypeScript, Next.js/Node.js, PostgreSQL or MongoDB	Self-host; Enterprise hosting by quote	MIT core; commercial Enterprise	Core $0; Enterprise quote; public self-service Cloud paused for new projects
Prismic	Managed page-oriented SaaS	None; frontend team only	SaaS	Proprietary	One-user Free repository; Starter from $10/month annually
Sanity	Managed content service	React/TypeScript for the customizable Studio; no data-service runtime	SaaS Content Lake; Studio deployed by buyer	Proprietary service; MIT Studio	Free; Growth $15 per seat/month plus possible usage
Storyblok	Managed visual headless SaaS	None; frontend team only	SaaS	Proprietary	Starter free; Growth $99/month on monthly billing
Strapi	Headless CMS	Node.js and a supported SQL database	Self-host or Strapi Cloud	MIT Community; commercial features	Community $0; Cloud from $35/month and Growth CMS from $45/month
Umbraco Heartcore	Managed headless SaaS	None; frontend team only	SaaS	Proprietary	Trial; Starter €60/month
Optimizely CMS	Hybrid enterprise CMS/DXP	C#, ASP.NET Core, SQL Server or Azure SQL	Self-host, DXP PaaS; separate CMS SaaS exists	Proprietary commercial	Local development/evaluation; production quote only
Umbraco CMS	Hybrid CMS	C#, current .NET, SQL Server or SQLite	Self-host or Umbraco Cloud PaaS	MIT core; commercial Cloud/add-ons	Core $0; Cloud €45/€280/€730 per month; Enterprise custom
WordPress	Hybrid publishing CMS	PHP, MySQL or MariaDB	Self-host, WordPress.com, or VIP	GPLv2-or-later core	Core $0; WordPress.com free or Personal from $4/month annually; VIP quote
Magnolia	Hybrid enterprise CMS/DXP	Java, Maven, servlet container, JCR and SQL	Self-host or DX Cloud PaaS	GPLv3 Community; commercial DX Core/Cloud	Community $0; commercial offering from $3,500/month and otherwise quote based
Drupal	Hybrid CMS	PHP, Composer, MariaDB/MySQL, PostgreSQL, or SQLite	Self-host or third-party managed host	GPLv2-or-later	Core $0; hosting and support separate
Wagtail	Hybrid Django CMS	Python, Django, supported SQL database	Self-host or third-party specialist host	BSD-3-Clause	Core $0; no first-party managed tier

Functionality, API, ecosystem, and customizability

This table applies one compact feature contract to all 16 products. “High” customizability means the team can change substantial server or admin behavior; it does not mean the work is cheap or available in every hosted edition.

Functionality, API, ecosystem, and customizability
CMS	Main editorial functionality	Delivery API boundary	Ecosystem, partners, and add-ons	Customizability and important limit
Contentful	Structured content, assets, Live Preview; workflow is plan-gated	Core managed REST and GraphQL delivery; separate write management API	Mature App Framework, marketplace, SDKs, solution partners, and enterprise support	High model/app customization; no customer server runtime
DatoCMS	Structured/page content, assets, Visual Editing, drafts and scheduling; custom workflow on Enterprise	Core GraphQL delivery; REST management; Asset API	Focused plugin SDK, marketplace, framework integrations, and partner network	High model/plugin customization inside the hosted platform
Directus	Database-oriented content/data admin, versions, visual preview, localization patterns, Flows	Generated core REST and GraphQL, read/write subject to permissions	Open extension ecosystem, marketplace, community, and commercial support	Very high server/admin extension; not a page-first editor and license needs review
Hygraph	Structured GraphQL content, assets, federation, Live Preview; custom workflow on Enterprise	Core GraphQL delivery; Management SDK; remote REST/GraphQL sources	App Framework, integrations, implementation partners, and enterprise support	High model/app customization; backend runtime remains vendor-controlled
Payload	Code-first collections, blocks, assets, drafts, versions, scheduling and Live Preview	Core REST, GraphQL, and in-process Local API; read/write	Growing TypeScript/Next.js community, plugins, adapters, and commercial support	Very high TypeScript/server/admin control; buyer owns operations
Prismic	Slice-based Visual Page Builder, assets, preview, releases and scheduling	Core read-oriented Document/GraphQL APIs; Migration and Asset APIs	Framework SDKs, integrations, Slice tooling, agencies, and hosted support	Moderate-to-high page/model customization; multiple environments are high-tier
Sanity	Schema-built Studio, structured content, assets, visual editing; Growth adds tasks/comments/scheduling	Core managed GROQ and GraphQL delivery; mutations through client APIs	Broad Studio/plugin ecosystem, framework tooling, partners, and enterprise support	Very high editor/schema customization; Content Lake is not self-hosted
Storyblok	Component page composition, Visual Editor, assets and standard workflow	Core REST delivery and read-only GraphQL	SDKs, field plugins, app extensions, agency partners, and enterprise support	High component/editor extension; custom workflow, SSO and regions require higher tiers
Strapi	Content types, components, Dynamic Zones, media and draft/publish; preview/releases/history are paid	Core REST; GraphQL through first-party plugin; read/write and customizable services	Large Node.js community, plugin marketplace, solution partners, Cloud, and commercial support	Very high Node/admin/API control; hosting and paid CMS features can be separate bills
Umbraco Heartcore	Managed Umbraco tree, media, permissions, localization, preview and environments	Core REST delivery/management/preview; read-only GraphQL on eligible plans	Client libraries plus the wider Umbraco community and partner network; server packages do not run in Heartcore	Content-model customization, but no server-side custom code in Heartcore
Optimizely CMS	Pages, blocks, assets, projects, on-page editing, scheduling, localization and multi-step approvals	REST delivery through first-party CMS package; Graph is hosted and edition-dependent	Mature .NET partner network, NuGet modules, App Directory, training, and enterprise support	Very high .NET control when self-hosted or on DXP; CMS SaaS has a different extension model
Umbraco CMS	Page tree, block editors, media, versions, scheduling, localization and preview; Workflow is paid	Core opt-in REST Delivery API; core management endpoints; GraphQL requires package/custom work	Large .NET community, Marketplace, certified partners, Cloud, and official commercial products	Very high .NET, schema and backoffice control; price official add-ons separately
WordPress	Block editor, posts/pages, media, revisions and scheduling; advanced localization/workflow usually plugins	Core read/write REST; GraphQL through free WPGraphQL plugin	Very large global ecosystem of plugins, themes, hosts, agencies, contributors, and enterprise providers	Very high PHP/admin control, but API coverage and lifecycle are fragmented across plugins
Magnolia	Pages, content apps, DAM, visual SPA editing, multi-site and publishing; advanced workflow/localization are edition-dependent	REST in Community/core; GraphQL and webhooks in commercial DX Core	Enterprise Java partner network, Magnolia modules, Marketplace, training, and support; licenses vary	Very high Java/JCR/admin control; never infer DX Core features from Community Edition
Drupal	Structured entities/fields, media, Views, Layout Builder, localization and Content Moderation	Core read/write JSON:API and REST; GraphQL contributed, not core	Large global community, Composer module/theme ecosystem, agencies, specialist hosts, and security process	Very high PHP/admin/API control; module count and upgrade governance drive cost
Wagtail	Page tree, StreamField blocks, media, revisions, scheduling, localization and ordered approval workflows	Core stable REST v2 is read-only; GraphQL is third-party; writes need custom Django API	Wagtail packages, the larger Django/Python ecosystem, core contributors, and specialist agencies/hosts	Very high Django/admin/model control; advanced translation and headless preview require extra work

Organization, update activity, and roadmap

Update frequency is useful only in context. A continuously deployed SaaS, a fast-moving npm package, and an LTS CMS solve different lifecycle problems. The table records the observable update model and support signal rather than awarding a raw score for shipping more often. A public roadmap shows transparency, not a binding promise.

Organization, update activity, and roadmap
CMS	Organization and governance	Observable update model	Roadmap and support signal	What to account for
Contentful	Proprietary platform led by Contentful	Continuous managed changes in the developer changelog	Retrospective changelog and plan-based support/SLA; no durable public delivery roadmap identified in this review	Large vendor and ecosystem reduce continuity risk, but roadmap, deprecations, pricing, and runtime remain vendor-controlled
DatoCMS	Proprietary service led by DatoCMS	Continuous managed product updates	Unusually transparent public roadmap; plan support rather than LTS	Focus and communication are strengths; organizational and marketplace scale are smaller than the largest vendors
Directus	Directus, Inc.-led source-available project and Cloud	Tagged software releases plus managed Cloud changes	Public discussions, but no committed schedule or LTS train identified	Review license eligibility, breaking changes, and every critical extension’s maintenance status
Hygraph	Proprietary service led by Hygraph	Continuous managed changelog	Retrospective visibility is stronger than public forward commitments; commercial support/SLA replaces LTS	Focused GraphQL ecosystem, but platform direction and availability depend on one SaaS vendor
Payload	Company-led MIT project whose team joined Figma	High observable activity through tagged repository releases	Public issues/discussions, but no fixed delivery schedule or formal LTS identified	Rapid evolution, plugin compatibility, and post-acquisition direction belong in the upgrade plan
Prismic	Proprietary service led by Prismic	Continuous platform, SDK, and Slice Machine product news	Product announcements and community requests provide partial direction; plan support rather than LTS	The mature but opinionated Slice ecosystem can increase coupling to Prismic tooling and supported frameworks
Sanity	Company-led combination of an MIT Studio and proprietary Content Lake	Continuous cloud updates plus tagged Studio/package releases	Changelog and date-versioned APIs; no durable public roadmap or Studio LTS train identified	Strong open editor ecosystem, but the datastore and query service remain a proprietary dependency
Storyblok	Proprietary service led by Storyblok GmbH	Continuous managed changelog	Public roadmap and plan-based support/SLA	Strong app and partner ecosystem; roadmap execution, hosting, and commercial terms remain vendor-controlled
Strapi	Company-led MIT Community product plus commercial products	Tagged software releases plus Cloud changes	Public feedback and roadmap with version-specific maintenance guidance; no perpetual LTS line	Major-version upgrades can arrive before every marketplace plugin is compatible
Umbraco Heartcore	Proprietary managed product operated by Umbraco A/S	Continuous managed-service updates	Direction through the Umbraco product portal and plan support/SLA; Umbraco CMS LTS does not automatically apply	Confirm that roadmap items and integrations explicitly support Heartcore rather than Umbraco CMS
Optimizely CMS	Commercial enterprise product led by Optimizely	Packaged .NET CMS releases and a separate continuously updated CMS SaaS stream	Formal commercial lifecycle; detailed direction is strongest through customer and partner channels	CMS SaaS, DXP/PaaS, and self-hosted CMS have different extension, release, and migration models
Umbraco CMS	MIT product stewarded by Umbraco A/S with community contribution	Tagged releases under a published schedule	Public product portal, RFC process, and explicit LTS/EOL policy	Frequent majors can create package lag; audit Marketplace compatibility and keep Cloud/add-ons separate from core
WordPress	Community open-source project led through core leadership and committers; the Foundation protects the marks	Public major release cycles plus maintenance and security releases	Public roadmap; only the latest release is officially supported	Exceptional ecosystem depth, but extension maintenance, security, API coverage, and compatibility vary widely
Magnolia	Company-led Community and commercial DX products from Magnolia	Versioned product and maintenance releases	Formal commercial lifecycle; public forward roadmap visibility is limited	Mature enterprise Java partner ecosystem, but specialist skills and commercial module packaging narrow the pool
Drupal	Community-governed project supported by the Drupal Association	Formal core release and security schedule	Public strategic initiatives, supported versions, and EOL policy	Core health does not guarantee the health of each chosen contributed module; audit them independently
Wagtail	Project led by a community core team with substantial Torchbox backing	Published feature-release and LTS process	Public roadmap, RFCs, core-team governance, and compatibility matrix	Mature Django foundations and specialist agencies, but a smaller CMS-specific extension market

Headless-first feature detail

The next three tables expand the managed and headless-first cohort. A plan name identifies where a feature becomes available. Enterprise means it requires a custom or enterprise agreement; not publicly documented means the reviewed official sources did not support a reliable answer.

Editorial features

Editorial features
CMS	Users and roles	Locales	Environments	Preview and page building	Workflow and approvals
Contentful	Free: 10 users and two roles; Lite: 20 and three	Free: two; Lite: three	Free: two; Lite: four	Live Preview; visual assembly depends on frontend and apps	No workflow on Starter; paid and Enterprise plans add workflow and governance
DatoCMS	Free: one collaborator; Professional: ten	Five on Free and Professional	Three sandboxes	Visual Editing across plans	Drafts and scheduling; configurable workflows on Enterprise
Directus	Core: three seats; Team: ten SSO seats	Model-based; no public locale quota	Buyer-defined when self-hosted	Visual preview; no first-party page canvas documented	Draft/publish and Flows; approval workflow not documented as current
Hygraph	Hobby: three seats and two roles; Growth: ten and four	Hobby: two; Growth: three	Two on Hobby and Growth	Live Preview; no turnkey page canvas documented	Commenting and assignment; custom workflow on Enterprise
Payload	No documented core seat cap; code-defined access	Field-level; no documented locale cap	Buyer-defined	Core Live Preview and blocks; inline Visual Editor positioned for Enterprise	Core drafts, versions, and scheduling; approval workflow on Enterprise
Prismic	Free: one user; Starter: three; higher tiers increase this	Free: two; Starter: three; higher tiers increase this	None through Medium; high-tier option or Enterprise	Visual Page Builder, slices, live editing, and preview	Releases, scheduling, and revisions; multi-stage approval not publicly documented
Sanity	Free: 20 seats and two roles; Growth: 50 and five	Unlimited listed on Free and Growth	Two datasets on Free and Growth	Live Preview and visual editing; page building is schema-defined	Basic drafts on Free; Growth adds comments, tasks, and scheduling
Storyblok	Starter: one included user; Growth: five	Two on Starter and Growth; paid additions on Growth	One space on self-service plans; dedicated environments on higher tiers	Visual Editor and component-based page composition	Standard workflow across plans; custom workflows on Premium and Elite
Strapi	Community lists unlimited admin users; paid CMS tiers use seats	Unlimited listed	Buyer-defined self-hosted; one or two on public Cloud plans	Components and Dynamic Zones; Live Preview from Growth	Draft/publish on Community; releases and history on Growth; review workflow on Enterprise
Umbraco Heartcore	Users, groups, and permissions; exact plan counts not public	Multilingual editing; exact quotas not public	Starter: Live; higher plans add Development and Staging	Preview API; no first-party visual page canvas documented	Environment promotion; human approval workflow not publicly documented

Developer and delivery features

Developer and delivery features
CMS	Content APIs	Webhooks and automation	Extension model	Asset handling
Contentful	REST delivery, preview, management, and images; GraphQL content	Configurable webhooks	App Framework, marketplace, and SDKs	Managed assets and CDN
DatoCMS	GraphQL delivery; REST management; Asset API; real-time updates	Webhooks	Plugin SDK and marketplace	Managed asset library and image/file CDN
Directus	Generated REST and GraphQL APIs; SDK	Flows and request operations	Extensions SDK and marketplace	File library with configurable storage adapters
Hygraph	GraphQL Content API and Management SDK; remote REST/GraphQL sources	Environment webhooks	App Framework, SDKs, and integrations	Managed asset storage and global delivery
Payload	REST, GraphQL, and in-process Local API	Lifecycle hooks, custom endpoints, and plugins rather than a hosted webhook control plane	Code configuration, plugins, and React admin customization	Upload management with storage adapters; buyer-operated CDN
Prismic	Document and GraphQL read APIs; Migration and Asset APIs	Webhooks	Framework SDKs, integrations, and slice tooling	Managed media and CDN
Sanity	GROQ and GraphQL	Plan-limited webhooks	React Studio, plugins, and custom tools	Managed assets and CDN
Storyblok	REST delivery and read-only GraphQL	Plan-limited webhooks	SDKs, field plugins, and extension tooling	Managed asset library and CDN
Strapi	REST and GraphQL with customizable controllers and services	Webhooks	Plugin architecture and marketplace	Media library; self-hosted or Cloud storage/CDN
Umbraco Heartcore	REST delivery, management, and preview; read-only GraphQL on eligible plans	Content webhooks	Client libraries; no server-side custom code in Heartcore	Managed media and Cloudflare-backed CDN

Governance and portability features

Governance and portability features
CMS	SSO and provisioning	Audit capability	Data region	Backup and export	Support and SLA
Contentful	SAML SSO and SCIM on Enterprise	Plan-gated audit logs	US default; EU option for eligible customers	CLI import/export with limitations; platform disaster recovery is not a customer restore	Enterprise 24/7 support and SLA up to 99.99%
DatoCMS	SSO and SCIM on Enterprise	Enterprise	Core service data documented in AWS Ireland	API/CLI export; fuller site export and backup on Enterprise	Professional weekday support; guaranteed SLA on Enterprise
Directus	Team includes SSO seats; Enterprise lists SAML/OIDC; SCIM not public	Activity retention varies by tier	Buyer-controlled self-hosted; Cloud region not public	Buyer-controlled database backup and schema tooling	Community/basic support; premium Enterprise support; public SLA percentage not documented
Hygraph	SSO on Enterprise; SCIM not public	Enterprise	Nine shared AWS regions; dedicated eligible regions on Enterprise	Migration APIs; backup and recovery on Enterprise	Dedicated Enterprise support and SLA up to 99.95%
Payload	SAML/OAuth SSO on Enterprise; SCIM not public	Version history, but no separate compliance audit service documented	Buyer-controlled self-hosted	Buyer-controlled backups, database migrations, and import/export plugin	Community support; dedicated Enterprise support; public SLA not documented
Prismic	SSO on Enterprise; SCIM not public	Dedicated audit logs not publicly documented	AWS Northern Virginia documented	API migration; backups on Enterprise; universal self-service restore not documented	Enterprise support and SLA; public percentage not documented
Sanity	SAML SSO on Enterprise; SCIM not public	Enterprise	Not publicly documented	CLI dataset import/export; custom backup on Enterprise	Tiered support; dedicated Enterprise support and SLA
Storyblok	SSO and SCIM on Premium and Elite	Plan-dependent activity-log retention	EU, US, Canada, and Australia; selection on higher tiers	CLI/API export; managed backup not on self-service tiers	Standard support; SLAs rise from Growth through Elite
Strapi	SSO is a Growth add-on and included on Enterprise; SCIM not public	Enterprise	Buyer-controlled self-hosted; Cloud region not public	Import/export; Cloud backups vary by hosting plan	Cloud Business includes 99.9% SLA; lower plans do not
Umbraco Heartcore	Not publicly documented	Not publicly documented	Azure hosting documented; customer-selectable region not public	Customer export, restore, and migration terms not documented clearly enough	Stronger higher-tier support; exact public SLA percentages not documented

Managed and headless-first profiles

Contentful

Hosting and ownership: The Contentful headless CMS is a proprietary managed service organized around organizations, spaces, and environments. It does not offer a self-hosted edition. See Contentful pricing and its developer documentation.
Entry budget: The Free plan includes one Starter Space, ten users, two roles, and two locales, but the current usage-limit policy positions it for learning and testing and says it may not support commercial use. Lite starts at $300 per month.
Editorial experience: Live Preview is available, while workflow, locale, user, role, and environment allowances depend on the plan. Visual page assembly normally depends on the chosen frontend and apps rather than one universal page-building canvas.
Developer platform: Contentful supplies REST delivery, preview, management, and image APIs, plus a GraphQL content API, webhooks, SDKs, and an App Framework. The API overview documents the different API roles.
Assets and delivery: Assets are managed and delivered through Contentful’s CDN. API calls and asset bandwidth are metered, with published allowances and overage prices on Lite.
Enterprise and governance: Enterprise plans add combinations of SAML SSO, SCIM, audit logs, EU hosting options, 24/7 support, and an uptime SLA. Confirm the exact contract rather than assuming every enterprise feature is bundled.
Portability: CLI import and export tools exist, but they have documented limitations. Platform disaster-recovery backups are not the same promise as a customer-controlled point-in-time restore.
Best fit and main caveat: Contentful is easiest to defend for established teams that value its ecosystem and enterprise governance. It is difficult to recommend as the budget default for a small new commercial website.

DatoCMS

Hosting and ownership: DatoCMS is a proprietary managed service without a self-hosted edition. Its documentation covers the hosted platform and client tooling.
Entry budget: The Free plan is limited to one collaborator and 300 records. Professional starts at €149 per month with annual billing or €199 with monthly billing. Check the current DatoCMS pricing for included calls, traffic, projects, and collaborators.
Editorial experience: Visual Editing is available across plans. Drafts and scheduling are available, while configurable workflows require Enterprise. Free and Professional list five locales and three sandboxes.
Developer platform: DatoCMS offers a GraphQL Content Delivery API, REST Content Management API, Asset API, real-time updates, webhooks, plugins, and a plugin marketplace. Its API overview separates delivery, management, and asset responsibilities.
Assets and delivery: The managed asset library includes image and file delivery through a CDN. Storage, delivery calls, and traffic allowances rise sharply between Free and Professional.
Enterprise and governance: SSO, SCIM, audit logs, guaranteed SLA, and advanced assistance are Enterprise features. Core service data is documented in AWS in Ireland, while content and assets use global delivery.
Portability: API and CLI export routes are available. More complete site export and backup capabilities are positioned as Enterprise features; review the export documentation before treating it as an exit plan.
Best fit and main caveat: DatoCMS is a polished option for content websites and agencies that can justify the Professional tier. Its free limits are better suited to a demonstration than a growing editorial site.

Directus

Hosting and ownership: Directus can be self-hosted, with optional Directus Cloud hosting. Its current MSCL-1.0-GPL license is source-available, restricts competing use, and schedules releases to move to GPL later. Read the Directus license rather than describing it as permissively open source.
Entry budget: Core is a constrained $0 software tier. Team starts at $499 per month with annual billing, and optional Cloud hosting is priced separately. The current Directus pricing also describes an Open Innovation Grant for qualifying smaller organizations.
Editorial experience: Directus supports drafts, visual preview, content versions, localization patterns, and Flows for automation. Flows are not automatically an editorial approval system; Directus’s own product roadmap still distinguishes scheduled releases and approval workflows from current functionality.
Developer platform: Directus generates REST and GraphQL APIs over the configured data model and provides SDKs, automation, extensions, and a marketplace. This database-oriented approach is different from a page-first CMS.
Assets and delivery: A file library and configurable storage adapters are included. Self-hosters choose and operate the storage and CDN; current public Cloud infrastructure quotas are not clearly documented in the pricing table.
Enterprise and governance: Team includes SSO seats, while Enterprise explicitly adds SAML/OIDC and configurable activity retention. Self-hosting gives the buyer control over region and network design. SCIM and a public SLA percentage are not clearly documented.
Portability: The database remains central to a self-hosted deployment, and schema synchronization tools are documented. The team is responsible for backups and restore testing; do not infer managed Cloud recovery terms from the existence of schema export.
Best fit and main caveat: Directus fits data-centric portals, internal tools, and omnichannel content backed by relational data. The license and the large Core-to-Team price jump deserve explicit legal and budget review.

Hygraph

Hosting and ownership: Hygraph is a proprietary managed service with shared and dedicated infrastructure options. It does not offer a self-hosted product. See Hygraph pricing and its platform FAQ.
Entry budget: Hobby is free for a small project with limited seats, roles, locales, entries, and API operations. Growth starts at $199 per month and introduces usage charges beyond its included API and traffic allowances.
Editorial experience: Live Preview is included. Hobby and Growth have two environments, while custom workflows require Enterprise. The product is structured-content and API oriented rather than a turnkey visual page canvas.
Developer platform: Hygraph is GraphQL-first. It supplies a GraphQL Content API, Management SDK, webhooks, remote source integration, an App Framework, and supporting SDKs. The API reference is the durable starting point.
Assets and delivery: Managed asset storage and global delivery are included. Traffic and API operations are separate metered dimensions.
Enterprise and governance: Enterprise adds SSO, audit logs, backup and recovery options, dedicated infrastructure, custom workflows, and an SLA up to 99.95%. Hygraph documents several shared AWS regions and eligible dedicated-region choices.
Portability: Migration guidance and APIs exist, but backup and recovery are Enterprise capabilities. A one-click full-project export for self-service plans is not documented; test the actual migration path for your schema and content.
Best fit and main caveat: Hygraph is strongest for GraphQL-first product catalogs, application content, and content federation. The jump to Growth makes it a less obvious choice for a small brochure website.

Payload

Hosting and ownership: Payload is an MIT-licensed application framework and CMS that can be self-hosted wherever its Next.js and Node.js requirements are supported. Following its acquisition by Figma, new deployments to the former Payload Cloud are currently paused. See the announcement and deployment documentation.
Entry budget: The core software is free, but the project pays for and operates its database, object storage, email, CDN, monitoring, backups, and hosting. There is no current public self-service managed tier for a new project; Enterprise is quote-based.
Editorial experience: Core supports versions, drafts, scheduling, block fields, and configurable Live Preview. Human approval workflows and a separate inline visual editor are positioned as Enterprise capabilities.
Developer platform: Payload generates REST and GraphQL APIs and also provides an in-process Local API. Its code-first configuration, hooks, custom endpoints, plugins, and React admin extensibility make it closer to an application backend than a closed content service.
Assets and delivery: Upload and media management are part of core. Storage adapters support common object stores, while the deployment owns CDN design and delivery costs.
Enterprise and governance: Enterprise positions SAML/OAuth SSO, publishing workflows, dedicated support, and hosting as paid capabilities. Core document history can record actors, but that should not be assumed equivalent to a dedicated compliance audit service.
Portability: The buyer controls database and storage backups. Payload documents database migrations and an import/export plugin, making portability possible but still dependent on the surrounding application architecture.
Best fit and main caveat: Payload is an excellent fit for TypeScript teams that want their CMS and application backend in one owned codebase. The tradeoff is operational responsibility, especially while the former managed Cloud is closed to new projects.

Prismic

Hosting and ownership: Prismic is a proprietary managed service priced per content repository. It does not offer a self-hosted CMS. See Prismic pricing and its developer documentation.
Entry budget: Free supports one user and two locales. Starter begins at $10 per month per repository with annual billing, making it the lowest public managed entry price in this shortlist.
Editorial experience: The Visual Page Builder, reusable slices, live editing, preview, releases, scheduling, and revision history make Prismic strongly page-oriented. Configurable multi-stage approval is not documented on the public plan table, and development environments are reserved for much higher tiers.
Developer platform: Prismic provides read-oriented Document and GraphQL APIs, Migration and Asset APIs, webhooks, framework SDKs, integrations, and page-building tooling.
Assets and delivery: Media is managed and delivered through a CDN. Plans publish traffic allowances, maximums, and overage prices.
Enterprise and governance: SSO, backups, custom roles, multiple development environments, SLA, and enterprise support require Enterprise. SCIM and dedicated audit logs are not publicly documented. Service data is documented in AWS Northern Virginia.
Portability: The Migration API supports ingestion, and repository data is accessible through APIs. A universal self-service full backup and restore tool is not documented; Enterprise is the explicit backup tier.
Best fit and main caveat: Prismic is the strongest low-budget default for a component-based marketing site when editors want visual page composition. It is less natural for a general application backend or a team needing several isolated environments.

Sanity

Hosting and ownership: Sanity combines a managed Content Lake with a customizable, MIT-licensed Studio. The Studio can be deployed by the project; the managed data service is not a self-hosted database. See Sanity pricing and the Studio repository.
Entry budget: Free currently includes up to 20 seats, two roles, and two public datasets. Growth starts at $15 per seat per month and permits paid usage overages.
Editorial experience: Live preview and visual editing are available, while Growth adds comments, tasks, and scheduled drafts. Localization is schema-driven, and the current plan table lists unlimited locales. Page-building behavior depends on the Studio schema and frontend rather than a fixed canvas.
Developer platform: Sanity uses GROQ as its primary query language and also offers GraphQL, webhooks, SDKs, a React-based Studio, plugins, and custom tooling.
Assets and delivery: Managed assets and CDN delivery are included, with storage, bandwidth, API, and CDN-request allowances measured by plan.
Enterprise and governance: SAML SSO, audit history, dedicated support, custom backup, and contractual SLA are Enterprise capabilities. SCIM and public data-region choices are not documented clearly enough to claim.
Portability: The CLI supports dataset export and import. Enterprise adds custom backup options; an export should still be tested with the project’s assets and references.
Best fit and main caveat: Sanity is the strongest flexible managed default for structured content, from personal projects through product-content teams. Its flexibility asks developers to design the editor experience, and usage economics still need modelling.

Storyblok

Hosting and ownership: Storyblok is a proprietary managed service built around spaces and a hosted Visual Editor. It does not offer a self-hosted CMS. See Storyblok pricing and its documentation.
Entry budget: Starter is free for one included user, with a maximum of two. Growth starts at $99 per month on monthly billing, with a lower monthly equivalent on annual billing.
Editorial experience: Visual page composition is a core capability. Standard workflow is available across plans, while custom workflows require Premium or Elite. Self-service plans constrain users, locales, and environment options.
Developer platform: Storyblok provides a REST Content Delivery API, a read-only GraphQL API, webhooks, SDKs, field plugins, and extension tooling. Its own documentation describes REST as the more feature-complete API route.
Assets and delivery: The managed asset library uses CDN delivery. API requests, traffic, and webhook counts have plan-specific allowances.
Enterprise and governance: SSO, SCIM, custom workflow, hosted-region selection, longer log retention, higher support, and stronger SLAs belong to Premium or Elite tiers.
Portability: CLI and API export routes exist. Managed backups are a separate capability and are not included on the ordinary self-service tiers.
Best fit and main caveat: Storyblok is the strongest visual-editor recommendation for a growing marketing team. A small project can start free, but governance and region requirements move it into enterprise procurement.

Strapi

Hosting and ownership: Strapi Community is MIT-licensed software that can be self-hosted. Strapi Cloud is an optional hosting product, while paid CMS functionality is a separate subscription. The official explanation of Cloud versus CMS plans is important to the cost model.
Entry budget: Community software is free to operate yourself. Strapi Cloud no longer has an ongoing free hosting plan; Cloud Starter begins at $35 per month. Growth CMS features begin at $45 per month, so a hosted project may pay for both dimensions. See Cloud pricing and CMS pricing.
Editorial experience: Community includes draft/publish and localization. Growth adds Live Preview, releases, and content history. Configurable review workflows are Enterprise only. Self-hosted environments are buyer-defined; Cloud environment counts depend on the hosting plan.
Developer platform: Strapi provides REST and GraphQL APIs, customizable controllers and services, webhooks, plugins, and a broad marketplace.
Assets and delivery: The media library is included. Self-hosters choose storage and CDN providers; Strapi Cloud bundles plan-specific storage and bandwidth.
Enterprise and governance: SSO is a paid Growth add-on and part of Enterprise. Audit logs and review workflow are Enterprise features. A Cloud Business plan supplies a 99.9% SLA, while self-hosters own region and availability choices.
Portability: Data transfer and import/export tools are documented. Cloud backup frequency and retention depend on the hosting plan, and database backup does not automatically include every external media object.
Best fit and main caveat: Strapi is the conventional self-hosted Node.js CMS choice for teams that want a recognizable admin and plugin model. Its split hosting and feature prices must be calculated together.

Umbraco Heartcore

Hosting and ownership: Umbraco Heartcore is a proprietary managed headless service hosted on Umbraco Cloud. Heartcore cannot be self-hosted or extended with server-side custom code. The separate Umbraco CMS is MIT-licensed, but that does not make Heartcore itself open source. See the Heartcore FAQ.
Entry budget: There is no ongoing free plan, only a trial. Starter is €60 per month in the current 2026 price schedule, followed by substantial steps for business-critical plans.
Editorial experience: Heartcore retains the Umbraco backoffice, user groups, permissions, multilingual editing, and content environments. Starter has only Live; higher plans add Development and Staging. A configurable human approval workflow and a Storyblok-style page canvas are not publicly documented.
Developer platform: Heartcore offers REST delivery, management, and preview APIs, a read-only GraphQL API on eligible plans, webhooks, and client libraries. Its server-side extension model is intentionally narrower than self-hosted Umbraco CMS.
Assets and delivery: Managed media is delivered through a Cloudflare-backed CDN with image resizing and cropping.
Enterprise and governance: Higher tiers strengthen monitoring, availability, and support, but exact public user allowances, SSO/SCIM, audit-log behavior, region selection, and SLA percentages are not documented clearly enough to compare.
Portability: Public documentation does not describe managed backup, customer export, restore, and migration terms with enough precision. These should become direct procurement questions.
Best fit and main caveat: Heartcore belongs on the shortlist for a .NET or Umbraco-centered organization that wants a familiar managed editor. It is not the choice for a team whose main requirement is self-hosted .NET or server-side Umbraco customization.

Hybrid CMS profiles

The next profiles use the same eight fields. Features are credited to the edition that actually supplies them rather than to the product family as a whole.

Optimizely CMS

Stack and category: Optimizely CMS is a hybrid enterprise CMS/DXP built on C# and ASP.NET Core with SQL Server or Azure SQL. It can render with ASP.NET Core or serve a separate frontend. The system requirements differ between CMS 12 and CMS 13, so the selected version belongs in the architecture decision.
Hosting and license: The extensible CMS can run on customer-controlled infrastructure or on Optimizely DXP PaaS. Optimizely also sells a separate multi-tenant CMS SaaS product with a different extension model. The deployable CMS is proprietary commercial software, not open source. See the official CMS hosting options.
Entry budget: Local development and evaluation have license exceptions or demo routes, but production requires a commercial agreement. The public Optimizely plans page is quote-only, so infrastructure, implementation, SQL, support, and additional Optimizely products must be costed in the proposal.
Functionality: Mature page and block editing, assets, projects, versions, scheduling, on-page editing, localization, multi-site support, and inherited multi-step approval sequences make editorial governance a stronger reason to choose it than API novelty.
API boundary: REST delivery is supplied through the first-party Content Delivery API package. Search endpoints depend on Search & Navigation licensing. Optimizely Graph is a hosted GraphQL service: entitlement differs by CMS edition, and it does not become self-hosted merely because synchronization code runs in the CMS. Check the Graph prerequisites.
Add-ons and customizability: NuGet modules, first-party and partner products, and the App Directory extend the platform. Self-hosted CMS and DXP retain deep .NET content-type, routing, service, event, module, and editor customization; the separate SaaS product should not be assumed to support the same code. The add-on compatibility guidance exposes some of these boundaries.
Governance and operations: Self-hosting means operating the application, SQL, blobs, scaling, licenses, backups, upgrades, and API/search dependencies. DXP moves much of the platform operation to Optimizely while leaving the buyer responsible for application code and usually the external frontend. Identity behavior also varies by on-premises and Opti ID deployment.
Best fit and main caveat: Best for enterprise .NET websites, multi-site programs, regulated self-hosting needs, or organizations already buying Optimizely products. The main caveat is edition ambiguity: “Optimizely headless” can mean self-hosted REST, hosted Graph, DXP, or CMS SaaS, with different licenses and extension limits.

Umbraco CMS

Stack and category: Umbraco CMS is a hybrid C#/.NET CMS using SQL Server or SQLite. It supports conventional Razor rendering and any separate frontend through JSON. Current runtime and build-tool requirements are listed in the official requirements.
Hosting and license: The CMS is MIT licensed and can be self-hosted on compatible infrastructure. Umbraco Cloud is a vendor PaaS for the same customizable application. This is different from the proprietary Heartcore SaaS entry above.
Entry budget: Core software and the Delivery API are free. Current Umbraco pricing lists Cloud Starter at €45/month, Standard at €280, Professional at €730, and Enterprise as custom. Dedicated resources, extra environments, operations, and commercial add-ons can change the real number.
Functionality: Core includes content types, a page tree, block editors, media, versions and rollback, scheduling, multi-site, localization, permissions, and preview. Forms, advanced workflow, deployment synchronization, commerce, Engage, and UI Builder are official commercial products or Cloud-plan benefits rather than silent core features.
API boundary: The Content Delivery API is a core, opt-in REST API for published content, localization, and authenticated draft preview. The backoffice Management API is not the public delivery contract. Umbraco CMS has no first-party core GraphQL delivery API; use a package or custom layer if GraphQL is mandatory.
Add-ons and customizability: NuGet packages and the Umbraco Marketplace cover community and paid extensions. Developers own the ASP.NET project, templates, controllers, services, content models, property editors, Delivery API extensions, and backoffice code, making customizability high for an experienced .NET team.
Governance and operations: Core roles, permissions, external login support, 2FA, version history, and audit trail are available. Self-hosters own hardening, identity, patches, backups, monitoring, and availability. Cloud adds managed SQL, updates, platform backups, CDN/WAF, support, and plan-dependent SLA, but custom application lifecycle work remains.
Best fit and main caveat: Best for small-to-enterprise content websites in .NET organizations and agencies that want free code with a gradual Cloud route. The main caveat is budgeting: the free Delivery API does not make Forms, Deploy, Workflow, or Cloud infrastructure free.

WordPress

Stack and category: WordPress is a hybrid publishing CMS with traditional PHP roots and a core API. It normally uses MySQL or MariaDB and renders through PHP block or classic themes, but any HTTP-capable frontend can consume its JSON. See the current WordPress requirements.
Hosting and license: The WordPress.org core is open source under GPLv2 or later and can run on almost any compatible host. WordPress.com provides managed plans, while WordPress VIP sells a separate enterprise managed platform supporting coupled, hybrid, and headless deployments.
Entry budget: Self-hosted software is $0. WordPress.com has a free plan and currently advertises Personal from $4/month billed annually; VIP pricing is quote-only. Domains, hosting, premium plugins, CDN, maintenance, and development remain separate even when the core license costs nothing.
Functionality: The block editor, posts, pages, custom post types, media, revisions, autosave, scheduling, taxonomies, menus, comments, and reusable patterns are core. Comprehensive multilingual content and configurable multi-stage approvals usually require plugins or a deliberate Multisite architecture.
API boundary: The REST API is core and read/write, with extensibility for custom types and fields. GraphQL is not core; the free WPGraphQL plugin supplies it. Authentication, preview, menus, forms, SEO, commerce, and plugin-defined content must be audited individually for headless use.
Add-ons and customizability: The enormous official plugin and theme directories are WordPress’s largest advantage. PHP plugins, hooks, filters, blocks, admin pages, custom types, fields, and REST routes also make it highly customizable. The cost is inconsistency: license, maintenance, security coverage, API support, and frontend behavior vary by extension.
Governance and operations: Core supplies roles and capabilities, updates, application-password authentication options, and a security release process. SSO, SCIM, audit reporting, approvals, WAF/CDN, backup/restore, and contractual SLA depend on the selected host, VIP, plugins, or custom integration. A plugin-heavy headless estate also has two deployment lifecycles to coordinate.
Best fit and main caveat: Best for blogs, publications, marketing sites, small businesses, and existing WordPress estates where migration would cost more than decoupling. The main caveat is that a core API does not guarantee that every plugin’s data or behavior is exposed through a stable API.

Magnolia

Stack and category: Magnolia is a hybrid enterprise Java CMS/DXP using Maven, a servlet container such as Tomcat, Apache Jackrabbit JCR, and a supported relational database. It supports Java/FreeMarker rendering and separate SPAs with visual editing. Version-specific requirements are documented in the certified stack.
Hosting and license: Community Edition is GPLv3 software that can be self-hosted. Commercial DX Core can also be self-hosted, while DX Cloud is a managed PaaS that retains custom Java code. The official module catalog distinguishes Community, DX Core, extension, and specially licensed modules.
Entry budget: Community Edition costs $0 in software. Magnolia’s pricing page advertises the commercial offering from $3,500/month and otherwise requires a quote. Infrastructure, implementation, DX Cloud, and specially licensed modules or connectors can add cost.
Functionality: Pages, structured content apps, WYSIWYG authoring, DAM, versioning, publishing, templates, components, and search form the base. Multi-site, advanced localization, workflow, SSO, personalization, translation, and other enterprise capabilities depend on DX Core or particular modules. Visual SPA editing is a major differentiator for decoupled sites.
API boundary: REST services and configurable content-delivery endpoints are available in Community/core. GraphQL is a commercial DX Core extension, and webhooks are also a DX Core module. The REST and GraphQL documentation must be read together with the edition catalog.
Add-ons and customizability: Java modules, YAML/JavaScript light modules, the Marketplace, custom apps, fields, dialogs, content types, REST endpoints, renderers, and JCR configuration make Magnolia highly customizable for Java teams. Each module’s Community, DX Core, or special-license label belongs in the bill of materials.
Governance and operations: Roles, groups, JCR-level access, author/public instance separation, and security hardening are documented. DX Core adds enterprise identity, workflow, and transactional capabilities; DX Cloud adds managed environments, pipelines, monitoring, patching, and region options. A self-hosted estate has a high Java/JCR/database/publication operational burden.
Best fit and main caveat: Best for enterprise Java, multi-site, multilingual, on-premises, private-cloud, or sovereignty-sensitive programs needing visual authoring over an SPA. The main caveat is edition ambiguity: Community REST does not imply Community GraphQL, workflow, or SSO.

Drupal

Stack and category: Drupal is a hybrid PHP CMS built and updated with Composer. It normally uses MariaDB/MySQL or PostgreSQL and can render Twig, progressively decouple selected components, or serve a separate frontend through core APIs. See its system requirements.
Hosting and license: Drupal is open source under GPLv2 or later and self-hosted. The Drupal project does not sell a first-party SaaS/PaaS plan; organizations choose their own infrastructure or a separate commercial Drupal host.
Entry budget: Core software is $0 and has no paid feature tiers. Hosting, CDN, cache/search, email, monitoring, backups, security maintenance, support, implementation, and contributed or commercial services determine the total cost.
Functionality: Flexible entities, content types, fields, media, taxonomies, menus, revisions, reusable blocks, Views, forms, search, and Layout Builder are available in core. Core Content Translation, Workflows, and Content Moderation support multilingual, state-based publishing; scheduled publishing usually comes from contributed tooling.
API boundary: JSON:API and configurable REST resources are core and read/write under Drupal permissions. GraphQL is a free contributed module rather than core. External preview, authentication, cache tags, routes, menus, and invalidation still need deliberate frontend integration.
Add-ons and customizability: Drupal.org supplies a large Composer-based module, theme, and distribution ecosystem. Admin-configured models and Views combine with PHP modules, services, plugins, events, entities, Twig, configuration export, and custom APIs for very high flexibility. Maintenance status and security-advisory coverage vary by contributed project.
Governance and operations: Core roles, permissions, revisions, translation-aware moderation, configuration management, and a formal Security Team process are strong foundations. SSO, SCIM, audit reporting, WAF, contractual SLA, region, and restore guarantees depend on modules and the chosen host. Module count and cross-environment configuration raise the lifecycle burden.
Best fit and main caveat: Best for complex structured, multilingual, approval-heavy sites, public institutions, universities, nonprofits, and portals with Drupal/PHP expertise. The main caveat is that $0 licensing can coexist with substantial implementation, module-governance, upgrade, and operations cost.

Wagtail

Stack and category: Wagtail is a hybrid CMS built on Python and Django with PostgreSQL, MySQL/MariaDB, or SQLite. It can render Django templates or serve an independent frontend. Current compatibility is documented in the Wagtail upgrade guide.
Hosting and license: Wagtail uses the permissive BSD 3-Clause license and is self-hosted on a compatible Python platform. Wagtail does not sell a first-party SaaS/PaaS tier; its official services directory lists independent specialist hosts and agencies.
Entry budget: The complete CMS costs $0. Hosting, database, object storage, search, cache, email, CDN, monitoring, backups, support, and Django development are separate. Third-party managed providers set their own prices rather than unlocking Wagtail features.
Functionality: Page trees, snippets, StreamField blocks, rich text, images and renditions, documents, search, forms, redirects, comments, revisions, locks, scheduling, multi-site, permissions, and customizable admin panels are core. Ordered workflows can moderate pages and snippets; advanced translation management normally adds wagtail-localize.
API boundary: Stable core REST API v2 is read-only for configured pages, images, documents, snippets, and fields. GraphQL is third-party, and management writes need a custom Django API today. Do not score development-version API work as a stable released feature.
Add-ons and customizability: Wagtail-specific packages combine with the wider Django/Python ecosystem. Page and snippet models, StreamField blocks, validation, panels, viewsets, hooks, signals, permissions, templates, image models, and APIs are highly customizable, with Django migrations putting schema changes under code review.
Governance and operations: Django auth, groups, granular page-tree and collection permissions, locking, moderation, audit logs, a security policy, and LTS releases provide a strong base. SSO, SCIM, region, WAF, backups, and SLA depend on packages, custom implementation, and the chosen host. The team owns Django/Wagtail upgrades and the full backend lifecycle.
Best fit and main caveat: Best for editorial, institutional, documentation, publishing, and multi-site programs in Python/Django organizations. The main caveat is that native stable delivery is read-only REST; GraphQL, sophisticated translation, external preview, write APIs, and managed operations require extra choices.

How I would choose

Start by removing products whose backend technology the team cannot safely maintain. Then remove products that do not match the operating model. If the organization cannot operate a CMS securely, remove self-host-only options. If data and infrastructure must remain under the organization’s control, remove SaaS-only options. If procurement will not accept a copyleft or source-available license, filter that before anyone becomes attached to the editor demo.

For each survivor, create a short stewardship record: controlling organization or project governance, update channel, currently supported versions, LTS/EOL policy, roadmap source, named support route, implementation-partner availability, and maintainers for every critical extension. A missing public roadmap or LTS branch is not an automatic rejection, but it changes what must be guaranteed contractually or owned internally.

Then test the remaining products with the same small but difficult prototype:

Build a landing page from a reusable hero, rich text, call to action, and related content.
Model an article with author, category, SEO fields, image, and scheduled publication.
Add two locales with fallback and independent publishing.
Preview an unpublished page in the actual Astro, Next.js, or other external frontend.
Send a change through author, reviewer, and publisher roles without giving anyone unnecessary administration access.
Replace an asset and generate the responsive renditions the frontend needs.
Promote a schema and sample content from development to production.
Trigger one webhook or cache invalidation and perform one authenticated management write.
Export the content and assets, then prove they can be restored somewhere useful.
Record the required packages, paid add-ons, infrastructure, editor steps, implementation time, and bill at current and ten-times traffic.
Rehearse one CMS or SDK upgrade and confirm that every critical extension and frontend integration remains supported.

Editor experience should be tested by an editor, not inferred from a developer-led product demonstration. Self-hosters should rehearse patching, backup, restore, and version upgrades. Enterprise buyers should ask vendors to demonstrate SSO provisioning, audit export, approval flow, regional hosting, restore behavior, and SLA reporting rather than accepting a feature-list checkbox.

When should you use each CMS?

Each recommendation combines the likely team, budget, operating model, and reason to choose the product:

Contentful: Use Contentful when you are an established or enterprise team with a substantial SaaS budget and need mature governance, integrations, partners, and vendor support.
DatoCMS: Use DatoCMS when you are a small or mid-sized content team with a mid-range SaaS budget and need polished editing, visual preview, and GraphQL delivery.
Directus: Use Directus when you are a developer-led team with an infrastructure and operations budget and need a self-hostable data platform that generates REST and GraphQL APIs over relational data.
Hygraph: Use Hygraph when you are a product or commerce team with a mid-to-enterprise SaaS budget and need GraphQL-first delivery, content federation, or structured product content.
Payload: Use Payload when you are a TypeScript or Next.js team with a low software-license budget but meaningful engineering capacity and need a self-hosted CMS inside the application codebase.
Prismic: Use Prismic when you are a small team on a low budget and need a managed SaaS CMS with visual editing for a component-based marketing website.
Sanity: Use Sanity when you are a developer-led team with a flexible SaaS budget and need highly structured content plus a deeply customizable editorial Studio.
Storyblok: Use Storyblok when you are a growing marketing team with a mid-range or enterprise SaaS budget and need strong visual page editing without giving up frontend-framework choice.
Strapi: Use Strapi when you are a Node.js team with a low software-license budget and enough operations capacity to run a conventional self-hosted CMS with configurable REST or GraphQL APIs.
Umbraco Heartcore: Use Umbraco Heartcore when you are an Umbraco-centered team with a managed-service budget and need the familiar editor as headless SaaS without CMS backend operations.
Optimizely CMS: Use Optimizely CMS when you are an enterprise .NET organization with a commercial platform and implementation budget and need mature approvals, localization, multi-site governance, and self-hosted or PaaS deployment.
Umbraco CMS: Use Umbraco CMS when you are a .NET team with a low-to-enterprise budget and need a customizable hybrid website CMS that can be self-hosted or run on Umbraco Cloud with a core REST Delivery API.
WordPress: Use WordPress when you are a small publishing team, marketing organization, or existing WordPress estate with a low-to-enterprise budget and need familiar editing, broad hosting choice, and the largest add-on ecosystem.
Magnolia: Use Magnolia when you are an enterprise Java organization with a substantial implementation budget and need self-hosted or PaaS deployment, visual SPA authoring, multi-site support, or infrastructure sovereignty.
Drupal: Use Drupal when you are a PHP-capable organization with a modest license budget but meaningful implementation capacity and need self-hosted, structured, multilingual, and approval-heavy publishing.
Wagtail: Use Wagtail when you are a Python or Django team with a low software-license budget and strong engineering capacity and need an owned, self-hosted editorial platform with flexible workflows.

There is deliberately no overall winner. A product that is excellent for a global content program can be expensive friction for a small website. Free self-hosted software can become the costly choice for a team that does not want to operate it, while a conventional CMS with a core API can be the pragmatic headless choice when its stack, editors, and ecosystem already fit the organization.