# Concrete CMS — DXP Scorecard

> Open-source PHP CMS with best-in-class in-context editing; popular for government sites and intranets.

**Category:** Traditional CMS · **Suite Capability:** 45/100 (ranked #44 of 46)

Source: https://www.dxpscorecard.com/platform/concrete-cms
Last reviewed: 2026-10-10

## Summary

Concrete CMS is a free, MIT-licensed PHP content management system whose defining feature is editing directly on the live page: editors click a block, change it in place, and approve a version. It pairs that with granular permissions, page versioning, multisite and a managed hosting option from PortlandLabs that is audited for SOC 2 Type 2, ISO 27001, HIPAA and FedRAMP Moderate controls, which is why it shows up on US government and intranet sites. It is not a digital experience platform: there is no personalization engine, no experimentation, no marketing automation and almost no AI, and the REST-only API with no SDKs makes it a weak choice for headless builds. Buyers get a cheap, approachable website CMS for non-technical editors, and should look elsewhere if they need marketing technology or a modern JavaScript front end.

## Composite Scores

- Suite Capability: 45/100
- Cost Efficiency: 66/100
- Build Simplicity: 48/100
- Operational Ease: 48/100
- Platform Velocity: 53/100
- Compliance & Trust: 51/100
- AI Enablement: 20/100

## Use-Case Fit

- Marketing: 46/100
- Commerce: 32/100
- Intranet: 39/100
- Multi-Brand: 47/100

## Category Scores

- 1. Core Content Management: 55/100
- 2. Additional Platform Capabilities (DXP Features): 44/100
- 3. Technical Architecture: 55/100
- 4. Platform Velocity & Health: 53/100
- 5. Total Cost of Ownership: 66/100
- 6. Build Simplicity: 48/100
- 7. Operational Ease: 48/100
- 8. Use-Case Fit: 41/100
- 9. Regulatory Readiness & Trust: 51/100
- 10. AI Enablement: 20/100

## Strengths

- **Editing happens on the live page, not in a back office** (69/100) — Editors enter edit mode on the page visitors see, drag blocks into areas, build column layouts, reuse stacks and global areas, and preview unapproved versions in place. Page types with locked areas give new pages a consistent starting point, and the Dashboard bulk editor changes templates, themes and SEO fields across many pages at once. For marketing teams without developers on call this is the shortest path from idea to published page among the traditional CMS products we score.
- **Free software, cheap hosting and an easy exit** (69.6/100) — The full product is MIT licensed with no paywalled features, and it runs on commodity PHP and MySQL hosting from a few dollars a month. Managed plans from PortlandLabs are flat-fee and public, starting at $4.99 a month for Starter and $19 a month for Business, with no API metering or bandwidth overages. Content lives in a standard MySQL database and a plain filesystem, so moving hosts or leaving the platform is a routine migration rather than a contract negotiation.
- **Granular permissions and audited hosting for regulated sites** (69.2/100) — Advanced permissions reach down to page, area, block, file folder and attribute level, with group sets, time-limited access and workflow approvals attached to those rights. The vendor's managed hosting is audited against SOC 2 Type 2, ISO 27001, HIPAA with HITECH and PCI-DSS, meets FedRAMP Moderate controls at DoD Impact Level 2, and will sign a Business Associate Agreement for customers handling health data. That combination is unusual for a low-cost open-source CMS and explains its track record with US Army and enterprise intranet deployments.
- **Solid versioning, scheduling and SEO basics in core** (65/100) — Every page edit creates an attributed version with HTML comparison, one-click rollback and a trash with restore, and files keep their own version history. Versions can be scheduled to go live and to expire, and hierarchical Topics give a permission-controlled taxonomy across pages, files and users. Per-page metadata, a Bulk SEO Updater, additional page paths that redirect and an automatic multilingual sitemap cover everyday search engine optimization without add-ons.
- **Many sites on one install without per-site fees** (60.6/100) — Core multisite runs several sites from a single installation with shared users, a shared file manager, site types with skeleton templates and per-site themes and permissions. The IMCOM case study runs hundreds of garrison websites this way under central compliance controls. Because there is no license, adding a site costs only infrastructure, which makes it one of the cheapest ways to run a portfolio of brochure sites.
- **Mature PHP extensibility and a steady release cadence** (68.7/100) — Developers extend the platform with custom block types, packages, attribute types, single pages and themes, and hook into a broad application event system. Version 9.5 added optional Twig templating for block views, page templates and single pages alongside PHP 8.5 support. Releases ship roughly monthly with sectioned notes and contributor credits, and local development works on any standard PHP stack with a Composer-managed repository and a CLI.

## Weaknesses

- **Almost no AI in the product** (10.5/100) — Core has no AI features at all. The only options are third-party marketplace add-ons: a free GPT-4 Turbo integration that needs your own OpenAI key, AI auto-tagging in the Brand Central asset add-on, and a community-built Model Context Protocol (MCP) server that wraps the REST API. There is no semantic search, no content intelligence, no AI auditing, no agent workflows and no usage reporting. The roadmap mentions AI integration for site building but nothing has shipped.
- **No personalization, experimentation or marketing automation** (20.7/100) — Targeting is limited to showing or hiding blocks for logged-in user groups. There are no content variants per audience, no behavioral or anonymous visitor segmentation, no recommendations and no A/B testing (the old Experimenter add-on is no longer sold). Marketing automation does not exist in core or as an official connector, so lead nurturing means an external tool wired in through tracking code or custom form handlers.
- **Headless and JavaScript front ends are an afterthought** (37/100) — The REST API covers pages, files, users and blocks with OAuth2, but there is no GraphQL, limited filtering and sorting, and no official SDK for JavaScript, TypeScript, Python or .NET. There are no Next.js, Nuxt or Astro starters, no type generation and no outbound webhooks with signing or retries, only internal PHP events. Rich text is stored as an HTML blob, and preview only works inside Concrete's own rendering. Teams that want a decoupled front end will build most of the plumbing themselves.
- **Self-hosting carries real security and operations work** (42.8/100) — Patching means upgrading the whole installation, there is no downgrade path, and 2026 brought a run of serious vulnerabilities including unauthenticated remote code execution fixed in version 9.5.2 and authenticated remote code execution fixed in version 9.4.8. The vendor fixes fast and runs a HackerOne program, but the burden lands on the site owner. There is no built-in monitoring, CDN or managed caching, and even the paid hosting SLA makes no uptime guarantee and leaves backups as the subscriber's responsibility.
- **A small community and a thin talent pool** (43.3/100) — The main GitHub repository has under a thousand stars, only a handful of job postings mention the platform, and the certified partner list is made up of small regional agencies with no large systems integrators. Third-party training is sparse, with no notable Udemy or Pluralsight courses. PHP generalists can ramp up, but hiring developers who already know Concrete, or finding an agency with capacity, is harder than for WordPress or Drupal.
- **Gaps for European buyers and accessibility procurement** (35.5/100) — Vendor hosting is US-only on AWS with no EU or APAC region, and the public privacy policy still cites the long-invalidated EU-US Privacy Shield rather than Standard Contractual Clauses or the Data Privacy Framework. A Data Privacy Addendum is available on request, but there is no public sub-processor list. No VPAT or Accessibility Conformance Report for the product is published and there is no WCAG conformance statement for the authoring interface, which complicates public-sector procurement outside the United States.

## Ideal For

- US government, military and public-sector web teams (fit 78/100) — FedRAMP Moderate controls at DoD Impact Level 2, SOC 2 Type 2, ISO 27001 and PIV authentication on the vendor's hosting, combined with granular permissions and workflow, match public-sector requirements at a fraction of enterprise DXP cost. The IMCOM and Army Senior Executive Portal deployments show it working at that scale.
- Small and mid-size organizations with non-technical editors and a modest budget (fit 76/100) — Editing directly on the page means staff are productive in minutes, the software is free, and hosting starts under $20 a month. Reviews consistently describe sites going live quickly at low cost.
- Intranets and HR portals that need tight access control (fit 70/100) — Page, area and block permissions by group, time-limited access, SSO through the SAML add-on and HIPAA-ready hosting cover the core of an internal portal. The vendor markets this use case and has enterprise intranet case studies such as BASF.
- Agencies and institutions running many brochure sites from one install (fit 66/100) — Core multisite with site types, shared users and per-site themes keeps dozens of similar sites under one dashboard with no per-site license. It suits garrison, campus or franchise portfolios where sites share a structure but not content.

## Look Elsewhere If

- Teams building headless or composable stacks with React, Next.js or mobile front ends (fit 22/100) — A REST-only API with limited querying, no GraphQL, no official SDKs, no starters, no webhooks and no decoupled preview means most of the integration layer must be written from scratch. Headless-first platforms do this out of the box.
- Marketing teams that need personalization, testing or automation (fit 18/100) — There are no audience segments, content variants, A/B tests, recommendations or marketing automation, and the only email connector is a third-party Mailchimp add-on. Everything beyond group-based show and hide requires external tools.
- Organizations looking to AI to speed up content operations (fit 15/100) — Core ships no AI assistance for writing, translation, tagging, search or auditing. What exists is a bring-your-own-key GPT add-on and a community MCP server, with no vendor roadmap date for anything native.
- EU-based organizations that need EU data residency from the vendor (fit 35/100) — Managed hosting runs only in US AWS regions and the privacy policy relies on an invalidated transfer framework. Self-hosting in the EU is possible but comes without any vendor contractual guarantee.

## Alternatives

Looking for alternatives to Concrete CMS? The DXP Scorecard analyst team rates 8 replacement platforms in "Best Concrete CMS Alternatives in 2026" (https://www.dxpscorecard.com/editorials/concrete-cms-alternatives), with a recommendation on who should move and who should stay. Ratings updated 2026-10-31.

## Implementation Partners

Agencies, development shops and systems integrators listed on The DXP Scorecard as implementation partners for Concrete CMS: Made Simple Media. The partner network is sponsored: Premier and Featured placements are paid, Listed placements are free. Partner listings are never read by scoring and do not affect Concrete CMS's scores or rank. Listing: https://www.dxpscorecard.com/platform/concrete-cms#partners

- **Made Simple Media** (Implementation Partner, free listing) · https://www.madesimplemedia.co.uk

---
Scored by The DXP Scorecard — an independent site; scorecards and platform inclusion are unsponsored, while the implementation partner network is sponsored and never read by scoring. Reproduce with attribution (CC BY 4.0). https://www.dxpscorecard.com