# Craft CMS — DXP Scorecard

> Developer-first PHP CMS for bespoke content modeling and multi-site builds, with perpetual licensing.

**Category:** Traditional CMS · **Suite Capability:** 55/100 (ranked #32 of 46)

Source: https://www.dxpscorecard.com/platform/craft-cms
Last reviewed: 2026-10-10

## Summary

Craft CMS is a developer-first PHP content management system from Pixel & Tonic, sold as a perpetual per-project license (Solo free, Team $279, Pro $399) or bundled into Craft Cloud managed hosting at $130 to $260 a month. Its strengths are precise content modeling, a built-in GraphQL API, one installation running any number of sites, and a Plugin Store of roughly 1,300 extensions that now includes a widely adopted MCP server for AI agents. It ships no personalization, experimentation, analytics, approval workflow or audit log, and Pixel & Tonic holds no SOC 2 or ISO 27001 certification and prohibits healthcare data outright. Buyers get an excellent bespoke website and multi-site engine run by a small vendor, not a digital experience suite.

## Composite Scores

- Suite Capability: 55/100
- Cost Efficiency: 70/100
- Build Simplicity: 68/100
- Operational Ease: 59/100
- Platform Velocity: 66/100
- Compliance & Trust: 47/100
- AI Enablement: 42/100

## Use-Case Fit

- Marketing: 42/100
- Commerce: 45/100
- Intranet: 25/100
- Multi-Brand: 40/100

## Category Scores

- 1. Core Content Management: 66/100
- 2. Additional Platform Capabilities (DXP Features): 47/100
- 3. Technical Architecture: 64/100
- 4. Platform Velocity & Health: 66/100
- 5. Total Cost of Ownership: 70/100
- 6. Build Simplicity: 68/100
- 7. Operational Ease: 59/100
- 8. Use-Case Fit: 38/100
- 9. Regulatory Readiness & Trust: 47/100
- 10. AI Enablement: 42/100

## Strengths

- **Precise, deeply nestable content modeling** (79.3/100) — Craft 5 ships about 26 native field types, conditional field layouts and Matrix blocks that are full nested entries with unlimited depth, plus Content Block fields for reusable fixed structures. Relation fields link any element types in both directions, and the whole schema is serialized to version-controlled YAML through Project Config. For a buyer this means the content model matches the business exactly instead of bending to a theme, and schema changes move between environments as code.
- **Developer workflow built around the modern stack** (77.4/100) — GraphQL with a bundled GraphiQL editor is included in every edition, including the free one, with scoped tokens and mutations. Official starters exist for Twig, Next.js, Nuxt and Astro, DDEV is the documented local environment, and Craft Cloud binds a git branch to each environment with its own database and preview domain. Versioned documentation for three major lines plus a separate Cloud doc set keeps onboarding predictable.
- **Perpetual licensing with no metering and a real free tier** (74.8/100) — Every paid tier is a one-time price per project with an optional $99 a year renewal, and a lapsed renewal leaves the site running on its last licensed version with no back-billing. Solo is free forever with unlimited entries, sites, locales and GraphQL, limited only to one user account. Craft also publishes the add-on rates most vendors hide (asset storage, bandwidth overage, a 15% nonprofit discount), and content exports natively to CSV, JSON, XML, XLSX or YAML from any element index.
- **Large plugin ecosystem and an early lead in AI agent access** (73.8/100) — The Plugin Store, built into the control panel, lists roughly 1,300 plugins from nearly 480 developers with one-click install and licensing, and Pixel & Tonic maintains the critical ones itself: Commerce, CKEditor, Feed Me, Webhooks, Shopify, Stripe and Element API. The third-party Craft CMS MCP server has passed 2,500 active installs, exposes 55 tools over stdio and HTTP, and lands every agent write as a reviewable draft under Craft's own permission system. Few CMSs in this price range give AI assistants a governed, production-ready way in.
- **Long support windows and a transparent roadmap** (73.8/100) — Craft 5 is designated a long-term support release with active support through 2030 and security fixes through 2031, so the Craft 6 move to Laravel is a choice rather than a forced migration, and a Yii 2 adapter is meant to keep Craft 5 plugins running on Craft 6. The public roadmap gives quarter-level targets, a structured changelog calls out breaking changes, and monthly newsletters report concrete progress. Buyers can plan upgrades years ahead instead of reacting to vendor deadlines.
- **Many sites and languages from one installation at no extra license cost** (67/100) — Craft Pro runs any number of sites in site groups with per-site domains, languages, templates and permissions, and sections control whether an entry exists in all sites, a group or a chosen subset. Each field carries its own translation rule, and the license is per installation, so adding a brand or market adds hosting and plugin cost but no CMS fee. This makes Craft one of the cheapest ways to run a small portfolio of related sites.

## Weaknesses

- **No approval workflow, audit log or co-editing** (39/100) — Craft 5 offers drafts and per-section publish permissions but no review states, task assignment, notifications, approval trail or admin activity log. Multi-step approvals require the paid Verbb Workflow plugin, there is no presence indicator or entry locking for simultaneous editors, and the mature Audit plugin stopped at Craft 4. Approval workflows, element commenting and activity logging are all Craft 6 roadmap items that have not shipped, so editorial teams with governance needs must buy or build it today.
- **No personalization, segmentation, recommendations or analytics** (18.7/100) — Craft has no segment builder, visitor profiles, content variants per audience, recommendation engine or performance dashboard, and nothing of the kind is on the Craft 6 roadmap. Personalization means wiring an external decision engine such as Croct into templates, experimentation relies on small community plugins such as ABTestCraft, and all engagement data lives in GA4 or similar tools. Marketing teams expecting a digital experience platform will be assembling one from third parties.
- **No compliance certifications and healthcare data is contractually barred** (32/100) — Pixel & Tonic holds no SOC 2, ISO 27001, HIPAA or PCI DSS attestation. Its December 2025 year-in-review said it is pursuing SOC 2 and ISO 27001, but no report or trust center exists yet, and the Craft Cloud security page borrows its SOC 2 posture from AWS and Cloudflare. The Acceptable Use Policy prohibits protected health information and cardholder data, there is no Business Associate Agreement, and the privacy statement was last updated in January 2020. Regulated procurement teams have little they can file.
- **A sustained run of critical security vulnerabilities on self-managed installs** (45.5/100) — Craft runs a funded disclosure program and patches fast (the 2025 remote code execution flaw rated 10.0 was fixed three days after notification), but the volume is high: 2026 alone brought several remote code execution, privilege escalation and injection CVEs, and the 2025 flaw left roughly 13,000 instances exposed and about 300 compromised. Craft never auto-updates, so every self-hosted operator owns the patch window. Buyers should budget for monitoring the critical-releases feed and applying point releases promptly, or move to Craft Cloud.
- **No official SDKs or type generation for headless front ends** (48/100) — Pixel & Tonic publishes no JavaScript, TypeScript, Python, mobile or other client library and no npm package; the official Next.js and Nuxt starters query GraphQL directly. Type safety comes from the community graphql-codegen pattern, which Craft's own discussions report producing roughly 22 MB of generated output on Craft 5 projects, and rich text is delivered as HTML rather than a portable structured format. Headless teams get a capable API but more hand-rolled plumbing than headless-native platforms provide.
- **Nothing for intranets, portals or employee experiences** (19.6/100) — Craft has no news feed, people directory, org chart, targeted internal announcements, read receipts, federated search or connectors to Microsoft 365, Teams, Slack or Google Workspace. Craft is absent from 2026 intranet CMS comparisons, and the Plugin Store has no HR, LMS or workplace tool integrations. An intranet on Craft is a full custom build on top of the user system and GraphQL API.

## Ideal For

- Digital agencies building bespoke brand and marketing sites for mid-market clients (fit 86/100) — Content modeling is exact, Twig and GraphQL give full control of the front end, Live Preview and shareable draft links keep clients in the loop, and a perpetual $399 Pro license with optional renewals is easy to pass through. Craft Cloud or a managed PHP host removes most operations.
- PHP and Laravel development teams who want to own their CMS stack (fit 82/100) — Craft runs on a conventional PHP, MySQL or PostgreSQL stack with Composer, DDEV and Project Config as schema-as-code, and Craft 6 is being ported onto Laravel with a compatibility adapter for existing plugins. The extensibility model (plugins, modules, custom fields and element types, event hooks) is among the most complete in the traditional CMS space.
- Organizations running a small portfolio of related sites or languages from one team (fit 78/100) — One Craft Pro installation powers any number of sites with per-site domains, languages, templates and permissions, with per-field translation rules and configurable propagation, and the license does not grow with site count. Translation vendors connect through plugins from Acclaro, Lilt and machine translation tools.
- Content-led stores that want editorial and commerce in one control panel (fit 72/100) — Craft Commerce is a first-party add-on with products and variants, multiple stores, catalog pricing rules, multi-location inventory and Stripe subscriptions, and products are native elements that editorial entries can reference directly. The first-party Shopify plugin offers the same editorial enrichment for stores that keep checkout on Shopify.
- Developers who want a self-hostable headless CMS with early, governed AI agent access (fit 70/100) — GraphQL is included in the free edition, official starters cover Next.js, Nuxt and Astro, and the Craft CMS MCP server gives AI assistants permission-scoped, draft-first access to content with a review queue. Every AI plugin takes the customer's own keys, including self-hosted models through Ollama.

## Look Elsewhere If

- Healthcare, finance or public-sector buyers that require SOC 2, ISO 27001, HIPAA or PCI attestation (fit 18/100) — Pixel & Tonic holds none of these certifications, the Acceptable Use Policy bars protected health information and cardholder data, no Business Associate Agreement exists, and Craft Cloud assets cannot be pinned to a single region.
- Marketing organizations expecting built-in personalization, experimentation, a customer data platform and analytics (fit 20/100) — None of these exist in Craft or on its roadmap. Each must be bolted on from a separate vendor or small community plugin, with no shared audience model or in-editor variant authoring.
- Companies building an intranet, employee portal or knowledge hub (fit 14/100) — Craft has no directory, internal communications, workplace tool integrations, federated search or learning connectors, and does not appear in intranet CMS comparisons. Everything would be custom development.
- Large editorial teams that need multi-step approvals, audit trails and simultaneous editing (fit 34/100) — Approval workflows, activity logging and commenting are unshipped Craft 6 features, there is no presence or locking for concurrent editors, and the only audit plugin with real adoption stopped at Craft 4. Paid third-party plugins fill part of the gap.

## Alternatives

Looking for alternatives to Craft CMS? The DXP Scorecard analyst team rates 8 replacement platforms in "Best Craft CMS Alternatives in 2026" (https://www.dxpscorecard.com/editorials/craft-cms-alternatives), with a recommendation on who should move and who should stay. Ratings updated 2026-10-29.

## Implementation Partners

Agencies, development shops and systems integrators listed on The DXP Scorecard as implementation partners for Craft CMS: Solspace. The partner network is sponsored: Premier and Featured placements are paid, Listed placements are free. Partner listings are never read by scoring and do not affect Craft CMS's scores or rank. Listing: https://www.dxpscorecard.com/platform/craft-cms#partners

- **Solspace** (Implementation Partner, free listing) · https://solspace.com/services/craft-cms · Website: https://solspace.com/

---
Scored by The DXP Scorecard — an independent site; scorecards and platform inclusion are unsponsored, while the implementation partner network is sponsored and never read by scoring. Reproduce with attribution (CC BY 4.0). https://www.dxpscorecard.com