Statamic

Blueprints and fieldsets define collections, taxonomies, globals, assets and users with dozens of first-party fieldtypes (Bard, Replicator, Grid, Group, Dictionary, Entries, Terms, Link, Code, Color, Info and more), conditional fields and reusable fieldset imports. Blueprints are YAML files kept in Git, so schema is genuinely versioned and deployable as code, and custom fieldtypes are Vue plus PHP. Not higher because there is no typed schema DSL or true union field outside Replicator sets.

Entries, Terms, Users and Assets fieldtypes create many-to-many references that can span several collections, and taxonomy terms resolve their related entries automatically. Not higher because relationships are stored one way as IDs on the source entry; reverse lookups need a query on the target side or an addon, and there are no declared inverse fields resolvable in one GraphQL selection.

Replicator and Bard sets let editors compose pages from typed blocks, sets can contain any fieldtype including further Replicators and Grids for unlimited nesting, and Statamic 6 added image previews when choosing sets. Bard stores rich text with embedded sets as a ProseMirror JSON document, a portable structured format. Not higher because there is no slot or region model and deep nesting has known Control Panel performance costs that the team is still working on.

Any Laravel validation rule can be set per field in the blueprint UI or YAML (regex, min/max, dates, mimes, size, in), custom Rule classes are supported, cross-field rules work through required_if and the {this} placeholder inside Grid and Replicator rows, and UniqueEntryValue and UniqueTermValue rules ship in core. Not higher because the content APIs are read-only so there is no API-write validation path to speak of, and complex rules need PHP.

With Pro and revisions enabled per collection, published entries get a separate working copy, every publish and unpublish creates a revision with author, timestamp and a note, and the history view previews and restores any revision; flat-file content in Git adds full repository history. Not higher because there is no field-level diff or compare view, no branching or releases, no trash for deleted entries, and revisions are off by default and Pro-only.

Taxonomies are first-class: each has its own blueprint, terms have URLs and fields, any taxonomy can be attached to any collection, terms are localizable and exposed through both the REST and GraphQL APIs, and per-taxonomy permissions control who can create terms. Not higher because taxonomies are flat; hierarchical taxonomies are still in progress on the roadmap, and there are no synonyms or bulk reclassification tools.

Live Preview renders unsaved changes in the real templates beside the publish form with device sizes, multiple preview targets per collection and hot-reload in Statamic 6; for headless frontends a token is appended so GraphQL or REST returns the draft, and postMessage events allow live updates without refresh. Not higher because there is no click-to-edit overlay on the frontend and no official preview SDK for Next.js or Nuxt, so headless preview is hand wired.

Bard is a Tiptap and ProseMirror editor with configurable buttons, links to entries and assets, embedded sets of any fields inline in the text, custom Tiptap extensions and marks, and output stored as a ProseMirror JSON document that can be rendered to HTML or processed elsewhere; a Markdown fieldtype exists for writers who prefer it. Not higher because rendering structured output outside PHP needs your own ProseMirror renderer and paste cleanup from Word is basic.

Asset containers on local disk or S3-compatible storage carry blueprints for alt text and metadata, a focal point and zoom picker, and native image cropping (February 2026); Glide performs on-the-fly resize, crop, fit and format conversion with presets, and hybrid Glide caching shipped September 2026. Not higher because there is no built-in asset usage tracking, asset metadata cannot yet vary per site, and transforms run on your own server.

The free first-party Collaboration addon shows presence avatars when several people open the same entry, locks a field while someone has it focused and syncs field values to everyone in real time over Laravel Reverb or Pusher. Not higher because there is no commenting, mentions or suggestion mode, and it requires running a WebSockets server; cursors, chat and comments are only planned for Collaboration 3.0.

Natively an editor can save a working copy on a published entry and roles can be denied the publish permission, which separates authoring from going live. Not higher because there are no custom workflow states, assignments, review routing, notifications or approval audit trail; Workflows remain a planned roadmap item after Statamic 6.

Dated collections can treat future dates as private, so an entry publishes at its date and time, entries get computed scheduled and expired statuses, and Statamic 6 adds a collection calendar view with better timezone support. Not higher because expiry is a collection-wide past-date behavior rather than a per-entry unpublish date, there are no release bundles or scheduled changes to a live entry, and cache refresh at publish time needs the Laravel scheduler running.

Multi-site (Pro) defines sites per locale on domains, subdomains or paths, managed in the Control Panel since Statamic 5; each field is marked localizable or not, and a localized entry inherits every field it does not override from its origin entry, giving field-level localization with fallback. Per-site permissions, locale-aware text direction, per-site Live Preview and site-filtered API queries are included. Not higher because fallback follows the origin entry rather than a configurable locale chain and asset metadata is not yet localizable.

Pro adds custom roles and user groups with permissions per collection (view, edit, create, publish, delete, others' entries), per taxonomy, asset container, global set, navigation and site, plus impersonation for testing; Statamic 6 added core two-factor authentication, passkeys and elevated sessions, and OAuth login comes through Laravel Socialite. Not higher because there are no role-based field permissions, SAML SSO needs a third-party package and there is no SCIM provisioning.

Both a REST Content API and a first-party GraphQL API cover entries, collections, trees, taxonomies, terms, assets, globals, navs and users, with opt-in filters, multi-field sorting, field selection, pagination, per-site queries, GraphiQL in the Control Panel and REST authentication added in Statamic 6; the REST API became self-describing in September 2026. Not higher because both APIs are read-only for content with no management API or GraphQL mutations, and filtering must be allow-listed per resource.

Statamic has no vendor-run hosting or CDN; delivery speed comes from built-in half and full static caching with invalidation rules, background re-caching in Statamic 6 and Glide image caching, which can sit behind any CDN the team configures. Not higher because CDN setup and purge integration are the buyer's job with no first-party edge or purge service.

Core dispatches a broad set of Laravel events (EntrySaving, EntrySaved, EntryDeleted, TermSaved, AssetUploaded, BlueprintSaved and more) that developers can listen to and queue, and Marketplace addons add configurable outbound webhooks with retries and auth headers. Not higher because there is no native webhook UI, no signed payloads in core and no dedicated publish event, so every integration is PHP code or a third-party addon.

Statamic can run headless or hybrid through REST and GraphQL, and rich text is stored as ProseMirror JSON, so non-web channels are not forced to parse HTML. Not higher because it is a coupled Laravel CMS first, with no official client SDKs in any language and API output shaped around the web templating model.

Statamic has no segment builder, visitor profiles or CDP connector; the only audience concept is front-end user accounts with groups and roles, which developers can branch on in Antlers or Blade. No Segment, mParticle or Tealium addon turned up on the Marketplace. Not higher because any behavioral segmentation means building it in Laravel or running an external engine end to end.

There are no content variants per audience and no audience preview in the Control Panel; personalization is template conditionals on the authenticated user, group or request data, or an external decision engine wired in by developers. Not higher because nothing ships or is sold as a personalization feature.

Two Marketplace addons add server-side testing: Thoughtco's AB Tester (paid) runs experiments on entries, and Frank Lambregts' Statamic A/B Testing (1.0 stable August 2026) adds sticky weighted variants, conversion tracking and a results view under Tools in the Control Panel. Not higher because nothing comes from Statamic itself and neither addon offers significance reporting comparable to a dedicated tool.

No recommendation engine exists in core or as a first-party addon; related content is curated by editors with the Entries fieldtype or queried by taxonomy in templates. Scored in the manual-curation band.

Core ships a search system with multiple configurable indexes, field selection and a search results tag, using the local Comb driver (JSON indexes) or the bundled Algolia driver with index sync on save; Rad Pack drivers add Meilisearch and Typesense. Not higher because the local driver has no faceting, merchandising or search analytics, and richer relevance tuning lives in the external service.

Statamic has no commerce in core; carts, checkout, orders, discounts and payment gateways come from Duncan McClean's Cargo addon, which replaced Simple Commerce (Simple Commerce 8 supports Statamic 6 but will not be updated for Statamic 7). Scored as an integration because it is a separately sold Marketplace addon rather than part of the product, and it suits small to mid-size stores.

The Rad Pack Shopify addon (v7.12.1, September 2026) imports products, variants and images into Statamic entries and keeps stock and products in sync through Shopify webhooks, with Antlers tags for the storefront. Not higher because there are no maintained connectors for commercetools, BigCommerce, Salesforce Commerce Cloud or SAP Commerce.

Core has no content or page performance analytics; the Control Panel dashboard shows widgets such as recent entries and form submissions, and SEO Pro adds SEO report scores and recent 404s. Engagement data only appears through third-party GA4 widget addons, so built-in analytics sits in the operational band.

Analytics tags are added in templates, and third-party addons such as ISAPP's GA4 widgets and the GA Dashboard Widget pull GA4 data into the Control Panel. Not higher because Statamic maintains no analytics integration of its own and there are no event helpers for Segment, Adobe Analytics or Amplitude.

Statamic Pro's multi-site runs several sites on domains, subdomains or subdirectories from one install, with localized entries that inherit from an origin entry and per-site collections and permissions. Not higher because the vendor positions it for variations of one site and says it is not intended for multi-tenant setups, so truly independent sites usually mean separate installs.

Editors translate inside the Control Panel by localizing entries side by side with the origin, and Marketplace addons add machine translation: Magic Translator (October 2026, LLMs and DeepL, bulk and staleness detection) and Apps with love's DeepL and Google one-click translation. Not higher because there are no Phrase, Smartling, Lokalise or Crowdin connectors and no translation memory or batch export to a TMS.

Beyond per-site permissions inside one multi-site install there is no brand-level governance: no shared component library with brand overrides, cross-brand approvals or policy enforcement. Multiple brands typically run as separate installs sharing a code base built by the agency.

Asset containers on local disk or S3 carry blueprint-defined metadata, folders, focal points and permissions, but there are no rights or expiry fields, approvals, usage tracking or versioning. Enterprise DAM comes only through Marketplace or community addons such as Fairu and 21st Digital's Cloudinary addon, and no Bynder or Aprimo connector was found.

Video files can be uploaded as assets and the core Video fieldtype embeds YouTube or Vimeo URLs, but there is no transcoding, adaptive streaming, captions or player. Cloudinary delivery via a community addon is the closest thing to processing, so video is effectively embedded from external hosts.

Developers build page builders from Replicator and Bard sets with set previews and fly-out pickers, and editors see the result in Live Preview, so marketers assemble pages from an approved block palette. Statamic 6 ships no visual or drag-on-canvas editing; click-to-edit and on-page editing come only from third-party addons such as Fine Builder. Scored in the structured block editor band.

Statamic renders the full site with Antlers or Blade templates, routing and static caching or full static generation, but the vendor runs no hosting; the customer deploys to Laravel Forge, Vapor, Ploi or any PHP host following the deployment docs. Scored in the renders natively, customer hosts band.

Core forms are defined by blueprints with validation rules, conditional fields, file uploads, honeypot spam protection, stored submissions with CSV and JSON export, email notifications and a Control Panel area for reports. Not higher because there is no multi-step builder, progressive profiling or lead routing, and push to other systems needs events or addons.

The Rad Pack Mailchimp addon subscribes users on form submission or registration with interests and marketing permissions, and other Marketplace addons connect forms to Mailchimp and similar services. Not higher because there is no content push or triggered sends from CMS events and no HubSpot, Marketo or Salesforce Marketing Cloud connector from Statamic.

There is no marketing automation in Statamic; a third-party addon suite for Statamic 6 adds CRM, campaigns and automations, but it is a small independent offering. Most sites hand leads to an external automation tool through form addons or custom code.

SEO Pro, Statamic's own paid addon, covers cascading meta and Open Graph, live Google and social previews, JSON-LD structured data with custom types, sitemaps with hreflang across multi-site, a redirects manager with wildcards and automatic redirects on slug changes, 404 tracking, robots controls, GraphQL fields and graded site reports. Close to the add-on ceiling; not higher only because it is a separate purchase rather than core.

Mity Digital's llms.txt for Statamic addon generates a curated llms.txt, SEO Pro handles robots controls and JSON-LD, and Statamic adopted llms.txt and AI crawler rules for its own documentation in August 2026. Not higher because there are no per-page Markdown endpoints, per-bot crawler controls or AI citation reporting in the product.

The Statamic Marketplace lists around 500 addons plus starter kits from the core team, the Rad Pack and third parties, installed with one Composer command and licensed per site, and every Laravel package is also available. Not higher because many addons are small single-developer projects and first-party integrations with enterprise systems are few.

Core supports front-end users with login, registration and password reset tags, content protection per page, collection or site using auth or password schemes, user groups and roles, and OAuth login through Laravel Socialite with 100+ community providers. Not higher because built-in protection checks only login rather than role, there is no portal or consent layer, and CIAM federation such as Auth0 or Azure AD B2C is custom Socialite wiring.

Statamic ships a first-party read-only Content REST API and a read-only GraphQL API with GraphiQL inside the Control Panel, with opt-in per-resource filters (field:condition syntax), multi-field and nested sorting, and paginated responses with links and meta. Recent releases added self-describing ping and sites endpoints, collection and taxonomy metadata, a fields parameter and slug resolution. Not higher because both APIs are read-only (no write or mutation API), filtering must be allow-listed per resource, and both are Pro-licence features.

API responses are cached by default with automatic invalidation on content change and a pluggable cacher class, and full-measure static caching serves pre-rendered HTML straight from Nginx or Apache. Not higher because there is no vendor CDN or managed edge, no published throughput figures or rate limits, and real delivery performance depends entirely on how the customer hosts and caches the Laravel app.

Statamic is itself a PHP/Laravel package, so server-side development uses its PHP facades and Laravel directly, but there are no official delivery SDKs for JavaScript, Python, .NET or mobile. Headless front ends consume the REST or GraphQL endpoints with generic clients or community packages. Not lower because the PHP API surface is rich and first-party; not higher because no official TypeScript client exists.

The Statamic Marketplace lists roughly 500 addons and starter kits from the core team, the Rad Pack and third parties, browsable inside the Control Panel, with paid licensing and checkout handled by Statamic. Any Composer package in the Laravel ecosystem can also be used. Not higher because most integrations are small third-party addons of varying maintenance, and there are few vendor-certified connectors for enterprise DAM, translation or commerce systems.

Addons can register custom fieldtypes with Vue components, Control Panel navigation items, pages and dashboard widgets, bulk actions, Antlers tags and modifiers, event listeners, custom routes and controllers, and replace repositories (for example the Eloquent driver). Because Statamic runs inside a full Laravel app, server-side extension has no sandbox limits. Not higher because the extension surface requires PHP and Vue development and Statamic 6 forced addon authors to update for its redesigned Control Panel.

Statamic 6 made two-factor authentication, passkeys and elevated sessions for sensitive actions core features for Control Panel and front-end users, and OAuth login is built in via Laravel Socialite with over 100 community providers. Not higher because there is no native SAML 2.0; enterprise SSO needs a Socialite provider or community addon, and API token management for the REST API is left to Laravel middleware.

Roles are named sets of granular permissions assigned to users or user groups, scoped per collection, taxonomy, navigation, global set, asset container and site, including permissions to edit or publish other authors' entries. Not higher because there are no field-level permissions and no arbitrary per-entry access rules without custom policies; super users bypass everything.

Statamic is licensed self-hosted software with no vendor-run cloud, so there is no SOC 2, ISO 27001 or HIPAA attestation from the vendor; compliance is inherited from whatever host and processes the customer chooses. Not lower because data residency is fully under customer control.

Statamic publishes GitHub security advisories and CVEs promptly with patched releases and has a clear SECURITY.md with scope, but 2025 and 2026 brought a steady run of issues: stored XSS leading to privilege escalation, path traversal, Antlers config disclosure, and a high-impact flaw allowing loss of content, assets and users via API query manipulation. Not higher because there is no paid bug bounty and the advisory volume is notable for a project this size.

Statamic runs anywhere Laravel runs (Forge, Vapor, Laravel Cloud, Ploi, any PHP host), with flat-file or database storage and full static site generation as further options, so private and regulated hosting is straightforward. Not higher because there is no vendor-managed hosting option at all, so every buyer must run their own infrastructure.

As self-hosted software there is no vendor uptime SLA or product status page; availability is whatever the customer's host provides. Not lower because static caching or static site generation make high availability achievable with commodity hosting.

Full-measure static caching and Redis-backed Stache handle high read traffic well, and the Eloquent driver moves content to a database for large entry counts and multi-server setups. Not higher because flat-file content complicates load-balanced deployments (files must be synchronised or edited on a single CMS server), large flat-file sites slow the Stache rebuild, and there are no documented scale limits or enterprise benchmarks.

Because content, blueprints and config are files in Git by default, and Pro's Git automation commits and pushes every Control Panel change, a full versioned off-site copy of the site exists as a side effect, and the Stache can be rebuilt from files at any time. Not higher because there is no vendor backup service, RTO/RPO, or failover; assets and database-driver installs need customer-run backups.

The full CMS runs locally as a normal Laravel app (Herd, Valet, Sail, Docker), installed with the Statamic CLI and managed with php please commands, and with flat-file storage the local site carries real content without a database dump. Not higher only because headless JavaScript teams still need a PHP environment.

Blueprints, fieldsets, collections and config are YAML files versioned with the code, so schema changes flow through normal Git branches, pull requests and Laravel deploy pipelines (Forge, Envoyer, GitHub Actions), and Git automation can commit editor changes back to the repo. Not higher because there is no environment management or content sync tooling between staging and production, and mixing editor commits with developer branches needs care.

statamic.dev is versioned (v5 and v6 sites), well written, searchable and full of copyable examples covering templating, the REST and GraphQL APIs, caching, extending and deployment, and the docs were redesigned alongside Statamic 6. Not higher because there is no interactive API playground outside the in-CP GraphiQL, and headless framework guides (Next.js, Nuxt, Astro) are thin.

There is no official TypeScript SDK and no type generation from blueprints; headless teams can run generic GraphQL codegen against the schema. Not lower because the GraphQL schema is introspectable, which gives codegen tools something to work with.

Statamic 6 went stable on January 28, 2026 after 21 alpha releases and a January 12 beta, and patch releases then came almost weekly (6.6.3 by mid-March, 6.12.0 by April 8). Forms 2.0 was previewed as nearly finished in August and Sidecar was announced on August 28. Not higher because Sidecar's core PR was still in review when announced, and Forms 2.0 has no confirmed ship date.

statamic.com hosts a paginated Release Notes page for every tagged core version, and each addon has its own release notes. A dedicated upgrade guide comes with each major version: the 5-to-6 guide flags high-impact changes (Vue 3 Control Panel, UTC date handling, PHP 8.3 and Laravel 12 minimums) separately from changes that only affect addons. Not higher because the release notes are raw per-release lists rather than curated summaries, and there are no machine-readable migration manifests.

A public roadmap at statamic.com/roadmap lists in-progress work (Forms 2.0, security hardening, Control Panel performance) and dated items such as Redirects and Error Tracking. The monthly Statamic Dispatch newsletter reports progress openly, including unmerged work like Sidecar. Not higher because we found no community voting portal tied to the roadmap.

Statamic follows semver, finished its v6 breaking changes before the beta, and says most sites upgrade from 5 to 6 by bumping the Composer constraint, in under five minutes. However, majors arrive roughly every 12 to 20 months. Each one raises the PHP and Laravel floor (v6 needs PHP 8.3 and Laravel 12), and the move from Vue 2 to Vue 3 forces addon authors to rework Control Panel code. endoflife.date shows v6 security support ending 2027-12-31, a window much shorter than the five-year LTS some peers offer.

The statamic/cms core repository has about 4.75K GitHub stars and 630 forks, with roughly 3.2M Packagist downloads, and the vendor cites a Discord of about 5,300 developers. That puts it just under the 5K-star band. It is a solid niche community that also benefits from the much larger Laravel ecosystem, but it is small in absolute terms.

Engagement is strong for the community's size. The core team posts in the Discord, which has run since 2018 and has a partners channel. The core repository has shipped about 750 tagged releases, a 21-release public alpha drew community testing for v6, and a steady stream of third-party addons lands on the Marketplace. Not higher because the core is a five-person team supported by contributors, which caps how much community input it can absorb.

A formal paid partner program has freelancer and agency tiers, plus certified levels that require minimum project counts and client references. A public 'Hire a Statamic Expert' directory lists about 88 expert partners. Not higher because the roster is entirely boutique agencies and freelancers, with no global systems integrators and no certification exam for individual developers.

Laracasts carries a Statamic video course and Laravel News covers every major release (v6 beta, v6 GA, Sidecar), giving Statamic reach across the Laravel audience. Laravel Daily and independent instructors add tutorials, and the vendor runs a YouTube channel. Not higher because we found no recent dated third-party courses, and independent content is thin outside the Laravel media ecosystem.

Statamic-specific job listings are sparse: a handful of aggregator results, two open roles on a German developer board, and a few Djinni and remote postings. Toptal and the partner directory offer freelance supply. Not lower because Statamic is a Laravel package, so any Laravel developer can become productive quickly, which makes the real talent pool far larger than the Statamic job count suggests.

Momentum signals are positive: the v6 launch drew coverage across the Laravel press, the monthly newsletter reports high-profile Laravel ecosystem sites moving to Statamic, and the vendor raised Pro pricing to $349 per site from May 2026, a sign that it has pricing power. Not higher because Statamic publishes no customer counts, licence growth figures or revenue figures, and the independent review footprint is barely growing.

Statamic is bootstrapped and independent, funded by Pro licences and renewals with no venture capital. The founder reported over $1.5M in revenue as early as 2021, and the company has shipped continuously since 2012. Not higher because the core team is about five people maintaining the CMS, its first-party addons and the Marketplace, a significant key-person and capacity risk for enterprise buyers. Not lower because there are no layoffs or distress signals.

Statamic's positioning is clear and defensible: it is the Laravel-native CMS with flat-file Git storage by default and an optional database driver. Sidecar extends that to teams running static-site generators. Not higher because it has no Gartner or Forrester recognition, and Craft CMS porting to Laravel puts a well-known competitor directly into Statamic's niche.

G2 shows 4.8 out of 5, but from only 3 reviews with no recent additions, and TrustRadius shows 7.3 out of 10 from 7 ratings. The reviews praise ease of use and predictable licensing compared with WordPress, but the volume is far below the 100-review threshold, so these ratings do not support a confident score. Developer sentiment in Laravel channels is warm, which keeps it from falling lower.

Statamic publishes dollar figures for almost every way to buy it: Core free, Pro $349 per site with $99 a year for updates after the first year, a $1,500 Master License for five Pro sites plus 25% off further licences for a year, and a Platform plan at $12 per site per month with a published volume curve. The FAQ also states the 20% nonprofit and education discount and PPP pricing on request. Not higher because Enterprise, which carries SSO, audit logging and the support SLA, is contact-only with no indicative price.

A Pro licence is a one-time, per-production-site purchase with unlimited development sites, no metering of API calls, users, entries or bandwidth, and only an update fee after year one; the vendor's own Platform page says buyers 'still own those licenses in perpetuity'. Agencies and SaaS builders who run many sites get a usage-based alternative ($12 per site per month falling to $3.50) with no renewal fees, so the model scales both ways. Not higher because the licence is per site, so a portfolio multiplies the cost, and paid Marketplace addons are a separate line on top.

Core keeps the whole content model (all 40+ fieldtypes, unlimited collections and taxonomies, assets, Live Preview), and Statamic 6 made two-factor authentication and passkeys part of the product rather than a paid extra. Against that, the REST and GraphQL APIs, roles and permissions, revisions and drafts, and multi-site all require Pro, so any headless or multi-editor build is a paid build, though Pro is inexpensive. Not higher because SSO and audit logging sit only in the sales-gated Enterprise tier, the gating the rubric flags as problematic.

There is no subscription to escape on the standard path: Pro is bought per site and kept, it can be run free in Trial Mode for as long as a site stays on a non-public domain, purchases carry a 14-day refund, and licences can be transferred from an agency to the client from the statamic.com account. Verified nonprofits, schools and universities get 20% off first-party products including renewals, PPP discounts are offered, and the Platform plan bills monthly for multi-site operators. Not higher because there is no startup programme and Enterprise terms are negotiated privately.

Statamic Core is free forever and permitted for commercial and client work, not a trial, with unlimited collections and taxonomies, every fieldtype, asset management, Live Preview and the full front-end feature set. The hard limits are tight for anything beyond one person: a single admin account, a single form, and no API, revisions or multi-site. Not higher because the one-admin cap and the missing headless API push most team or client projects onto Pro.

`statamic new` from the CLI installer, Laravel Herd on macOS and Windows, or a one-click install on Forge or Ploi gets a running Control Panel in minutes, and the default flat-file storage means no database has to be provisioned first. The official quick-start guide builds a complete small site from a blank install in about 20 to 30 minutes, and Marketplace starter kits skip ahead further. Not higher because it is a developer-installed PHP application: a working Composer and PHP 8.3+ environment is a prerequisite, and there is no hosted sandbox to click into.

Statamic's sweet spot is the small to mid-size marketing site built by a Laravel shop, where a templated build from a starter kit or static HTML typically lands within the rubric's two to six week band, and its flat-file content and Blueprint modelling remove the schema and migration work a database CMS adds. As with Craft, there is no theme ecosystem, so every site is a bespoke build, and larger multi-site or integration-heavy projects scale with Laravel development effort. Confidence is INFERRED because no independent timeline data could be retrieved for this run.

Statamic is a Composer package on Laravel, so any Laravel developer can work on it, and templates can be written in Laravel's own Blade instead of Statamic's Antlers; the Control Panel extends with Vue 3, Inertia and Tailwind, all mainstream tools. That points to a small premium over generalist PHP rates rather than a specialist one. Not higher because Statamic-specific experience is a much smaller pool than WordPress or plain Laravel, and this run could not retrieve rate data to confirm the premium.

There is no vendor cloud, so hosting is always a separate line from the licence, run on Forge, Ploi, Laravel Cloud, Fortrabbit, Kinsta or a plain VPS. The bill sits at the cheap end of self-hosting: flat-file storage needs no database server, static caching can serve pages without booting PHP, and the static site generator can publish to Netlify or Vercel. Not higher because a server, backups and a CDN are still the buyer's to buy and run on every path.

A typical Statamic site needs part of one developer's time rather than a dedicated ops role, and Git-based content (with Pro's Git automation) makes backup and rollback simple. The buyer still owns PHP, Laravel and Statamic patching on a fast cadence (v6.0.0 in January 2026 to v6.38.0 in October), plus major upgrades: Statamic 6 raised the floor to PHP 8.3 and Laravel 12 and moved custom Control Panel code from Vue 2 to Vue 3. Not higher because nothing is managed by the vendor; not lower because the stack is small and conventional.

By default every entry, Blueprint and setting is a Markdown or YAML file in the buyer's own Git repository, about the most portable storage any CMS offers, and sites on the Eloquent driver sit in a standard Laravel database with first-party commands to export each repository back to flat files. The code runs on the buyer's infrastructure with no SaaS dependency beyond hourly licence validation, and offline validation is available on Enterprise. Not higher because Antlers templates and Bard or Replicator field structures do not carry over to another CMS, so leaving still means rebuilding the front end.

The core vocabulary (Collections, Blueprints, Fieldsets, Taxonomies, Globals, Navigation, Asset Containers) maps to ordinary content-model thinking, every definition is a readable YAML file, and the platform sits on standard Laravel routing, config and views. The vendor's own high-level build approach is 'static HTML, then views, then collections and routes, then blueprints', which is a mainstream web-dev mental model. Not 75+ because a developer still has to learn the Stache (the flat-file index and cache), the flat-file versus Eloquent storage split, and Antlers' tag semantics, which the docs describe as combining the roles of Blade templates and controllers.

Statamic ships a narrative Quick Start Guide that builds a complete small site from scratch in an estimated 20 to 30 minutes, an install hub with per-environment paths (Laravel Herd recommended, CLI, existing Laravel app, Sail/Docker, Forge and Ploi one-click), and points newcomers to a Laracasts video series. The `statamic new` CLI wizard walks starter-kit choice, first super user and git init. Not higher because there is no in-app interactive tour, no structured certification path and no framework-specific headless tutorials of the kind headless vendors publish.

Statamic is a Laravel package, so Laravel developers use Composer, Artisan, Eloquent-style queries and Blade templates they already know, and Statamic 6 rebuilt the Control Panel on Vue 3, Inertia and Tailwind 4. Headless teams get a first-party GraphQL API (with GraphiQL in the Control Panel) and a REST Content API. Held in the mid-60s because the default and documented-first templating path is the proprietary Antlers language, and there is no first-class React or Next.js support, so JavaScript-only teams work against generic APIs with no vendor SDK.

Starter Kits are a first-class install path (`statamic new site vendor/kit`) and can carry their own content model, example content and design; the vendor maintains several free Antlers and Tailwind kits, and the widely used Peak kit adds a page builder, deploy scripts for Forge and Ploi, a production .env example, Nginx caching config and an optional GitHub workflow for dependency-update PRs. The Marketplace also lists many paid vertical kits. Capped at 60 because the vendor-built kits are small blog and portfolio demos, the most complete kit is third-party, and there are no official Next.js, Nuxt or Astro headless starters.

With Laravel Herd supplying PHP, Composer and a local server, `statamic new` produces a running site and Control Panel with no database to provision, because content is flat files and the default database connection is SQLite. Enabling GraphQL is one env var plus switching on resources, and Pro features can be enabled for development with a single config flag. Not 70+ because self-hosting still means owning a PHP 8.3+ runtime, extensions, Composer and a production server, and headless setups add per-resource API config that is disabled by default.

Blueprints and fieldsets are YAML files versioned in Git alongside the code, there are no field-count caps, and on flat-file storage adding or renaming fields needs no database migration. Moving content into a database is a single `php please install:eloquent-driver` command that can move repositories selectively, and documented export commands move each one back to flat files. Not higher because there is no schema-migration tooling to transform existing content when a field changes type or handle, flat-file storage pushes very large content sets toward the database driver, and blueprint changes made in production on a Git-backed site must be reconciled with the repository.

On the templated front end Live Preview is plug-and-play: it renders unsaved content with the current template, switches devices and templates, uses Alpine or Livewire morphing to update without reloads, and collections can define several preview targets in YAML. Headless preview is documented but needs frontend work: a preview target points at the external app, Statamic appends a token that the app must pass back on GraphQL or REST calls, and live updates require a postMessage listener. Held to the mid-60s because there is no vendor SDK or reference Next.js/Nuxt implementation for the headless path.

There is no certification and no partner-gated skill set: a Laravel or general PHP developer is productive quickly, Blade is a supported alternative to Antlers, and headless consumers need only GraphQL or REST. Moderate platform knowledge is still needed for Antlers, Stache behaviour, blueprint conventions and the addon API, and the Statamic-specific talent pool is small compared with WordPress or the JavaScript headless platforms, so buyers usually hire Laravel developers and train them.

Statamic is built for small teams: one Laravel-capable developer can install, model, template and ship a production site, and the docs list one-click installs on Forge and Ploi that remove most server setup. Flat-file content in Git means no separate database administration for typical sites, and there is no mandatory partner or solution-architect model. Crosses 75 because the minimum viable team is genuinely one person, though that person owns hosting, updates and backups since there is no vendor-run cloud.

After launch, editors create and edit entries, pages, navigation and assets, use Live Preview, and assemble pages from developer-defined Replicator and Bard sets, which is how Peak and Marketplace page-builder kits give marketers block-based layouts without tickets; Statamic 6 added a command palette, keyboard set reordering and select-all bulk actions. Capped below 70 because new blueprints, fields, templates and block types need a developer and a Git deploy, the vendor explicitly says it is not trying to become a page builder, and on Git-backed sites editor changes flow through the repository.

Statamic upgrades are Composer constraint bumps (^5.0 to ^6.0, then `composer update statamic/cms --with-dependencies`) with a published per-major upgrade guide, and flat-file installs have no database schema migrations to run. Majors still carry real breaking changes: Statamic 6 (released 28 January 2026) raised the floor to PHP 8.3 and Laravel 12, moved the Control Panel from Vue 2 to Vue 3 (forcing rework of custom fieldtypes and addons with Vue components), and changed date handling so API dates return in UTC. Not higher because each annual major drags a Laravel/PHP bump and addon compatibility checks with it; not lower because majors are not rewrites and vendor and community reports describe v3 to v5 as smooth.

Statamic publishes GitHub security advisories with CVEs and back-ports fixes to both supported lines in ordinary patch releases (CVE-2026-28425 authenticated Antlers RCE fixed in 5.73.11 and 6.4.0; CVE-2026-41175 query-parameter data loss fixed in 5.73.20 and 6.13.0; CVE-2026-64663 fixed in 5.74.1 and 6.24.0), and applying a patch is a routine `composer update`. But 2026 has carried a heavy advisory cadence (Packagist lists 31 advisories for statamic/cms, including stored XSS enabling super-admin creation, config exposure, missing authorization on revisions and terms), and CVE-2026-41175's fix was incomplete, requiring the follow-up CVE-2026-49287. Not higher because there is no auto-update and the self-hosting team owns every patch rollout; not lower because most issues require an authenticated Control Panel user and fixes ship quickly to both lines.

Statamic ships one major a year (around Q1) and supports each for only one year of bug fixes and 18 months of security fixes, so Statamic 5 stopped receiving bug fixes in March 2026 and loses security fixes in December 2026, under a year after Statamic 6 shipped. Every major is also coupled to Laravel's own support window, so teams effectively follow an annual upgrade treadmill. Not higher because that window is short against the 12+ month deprecation benchmark and there is no LTS line; not lower because the content format (Markdown/YAML) and APIs are stable across majors and the vendor has avoided platform rewrites.

The default flat-file install needs only PHP, Composer and a web server: no database, no separate search service (the built-in local search driver works out of the box) and no mandatory cache server, which is a much shorter dependency list than most self-hosted CMSs. The trade-off is the Laravel framework's full Composer graph plus a Vue 3 Control Panel, and teams that move to the Eloquent driver, Redis queues or Algolia add those services back. Not higher because Laravel and PHP version floors move every year and transitive Composer packages must be audited by the operator; not lower because the graph is conventional, legible and patchable with standard tooling.

Statamic itself ships no monitoring: no health dashboard, no APM, no status page (there is no vendor cloud to report on), so uptime, queue, error and server monitoring all fall to the operator. The Laravel ecosystem softens this considerably (Pulse, Telescope, Nightwatch, Forge/Ploi server monitoring all apply unchanged), and Marketplace addons such as Healthchecks add application checks. Not higher because none of this is first-party Statamic tooling; not lower because the Laravel monitoring tools drop in with little effort.

Content lives in Git by default, so every change is diffable and recoverable, and Pro adds revisions and Git automation; Statamic also updates asset references across content automatically when an asset is moved or renamed, and dated collections can hide past-dated entries. The automated hygiene layer is addon territory: broken-link checking (Link Checker, Linkwise), orphaned-asset detection (Unused Assets, Clear Assets, Asset Atlas) and content-usage reports are all third-party, several not yet confirmed for v6, and there is no native scheduled-unpublish workflow. Not higher because 60+ requires native automated hygiene tooling; not lower because Git history and reference updating remove a meaningful share of manual cleanup.

Static caching is built in: half measure serves pre-rendered responses through the application, full measure writes static HTML served before PHP runs, with automatic invalidation and `static:warm` warming, and Statamic 5 reworked the flat-file query layer to read only the files it needs (vendor claims 50 to 600 percent gains on large sites). Operators still own CDN setup, cache warming and invalidation strategy, and flat files slow down on sorting and filtering across very large collections, which pushes big sites to the Eloquent driver. Full-measure caching also only invalidates on the instance that handled the change, so multi-server setups need extra configuration. Not higher because none of this is managed for the customer; not lower because a single server with full-measure caching performs very well with little tuning.

Pro licences include Basic Developer Support, so useful vendor help is not locked behind Enterprise, and Capterra reviewers rate customer support 4.7/5. But no response-time commitment attaches below Enterprise: general enquiries are answered 'usually within 2 business days', SLA support and a dedicated chat channel come only with Enterprise, and a two-hour response appears only on Enterprise VIP. Not higher because mid-tier support carries no SLA from a small vendor team; not lower because reviewers consistently report good support quality.

The official Discord is large and busy for a CMS of this size (Statamic cites several thousand developers in live chat) with core team participation, backed by GitHub Discussions, a weekly community newsletter and the wider Laravel community, which answers most framework-level questions. Not higher because the community is far smaller than WordPress's or Drupal's and Stack Overflow coverage is thin; not lower because response quality and team presence are consistently praised.

Release velocity is high: by June 2026 the team reported 38 releases, 630 merged pull requests and 377 closed issues since Statamic 6 shipped in late January, while still back-porting fixes to the 5.x line (5.73.11 on 27 February, 5.73.12 on 4 March, and on through 5.74.1). Security fixes land on both lines in the same release window. Not higher because the incomplete CVE-2026-41175 fix needed a second advisory, and self-hosted teams add their own lag after a fix ships; not lower because bug turnaround from a small core team is visibly fast and transparent.

Marketers can assemble pages from developer-defined Replicator and Bard sets (Page Builder pattern in Peak and most starter kits) and see them in Live Preview, so new pages are possible without a developer once the block library exists. There is no drag-and-drop or visual canvas editor; new layouts and block types still need a developer.

Campaign support is limited to scheduled publishing through collection date behaviours (future entries private until their date) and revisions. No content calendar, campaign object, multi-channel coordination or campaign analytics.

The first-party SEO Pro addon adds meta and social fields with cascade defaults, XML sitemaps, JSON-LD, a redirects manager with automatic redirects, 404 tracking and on-site SEO reports. Clean routes and canonical handling come from the core. It is an addon rather than core, but first-party and bundled with Platform plans.

Native forms with blueprints, honeypot, email notifications, submission storage and CSV export, plus a FormSubmitted event for routing leads. No CTA management, conversion tracking or UTM handling; those come from tag managers and addons.

No personalization engine or audience segmentation. Targeting is template conditionals on the logged-in user and user groups, written by developers.

No native experimentation. Small third-party marketplace addons provide weighted variants with conversion counts and a Control Panel dashboard, without statistical significance or auto-winner selection. External tools are the usual route.

Fast authoring once the block library exists: entry duplication, Bard and Replicator sets, Live Preview, bulk actions in listings, the Statamic 6 command palette, and Git-backed flat files that developers can edit in bulk. Revisions add a publish step without approval routing.

Web-first, with structured content exposed through the native REST Content API and first-party GraphQL (Pro), so apps and other channels can consume it. No channel-specific renditions or native email, social or push delivery.

No built-in analytics. GA4 dashboard widgets exist as paid third-party addons; SEO Pro adds SEO report and 404 widgets. Content performance metrics otherwise live in external tools.

Consistency comes from developers defining the only available Replicator sets, Bard buttons and field validation in blueprints, so editors cannot break layouts. No design token management or brand guardrail tooling in the Control Panel.

SEO Pro manages Open Graph and Twitter card fields with images and cascade defaults. No push-to-social or social scheduling.

Asset containers on local or S3 storage with blueprints for metadata, focal points, and on-the-fly Glide image transforms. No tagging taxonomy, rights management or usage tracking at DAM level; Cloudinary and Fairu addons extend it.

Pro multi-site gives per-locale sites with entry localizations that inherit from an origin entry and can override fields, plus per-site permissions. No transcreation workflow or market-level campaign scheduling beyond per-entry dates; translation is via third-party addons.

First-party Rad Pack Mailchimp addon, third-party form-to-CRM connectors and a small CRM and automation addon suite, plus Laravel events and webhooks for anything else. No prebuilt Salesforce, Marketo or CDP connectors of note.

Blueprints with 40+ fieldtypes, Replicator, Grid and taxonomies model products, variants and attributes well as generic content. Cargo (successor to Simple Commerce) adds product and variant types for smaller stores, but there is no purpose-built PIM layer.

No merchandising tooling. Cross-sell and spotlights are manual Entries relationship fields; category ordering uses structured collections.

The Rad Pack Shopify addon imports products and keeps them in sync by webhook, making Shopify products available as entries. No equivalent for commercetools, SFCC or BigCommerce beyond custom Laravel integration.

Bard sets and Entries fields let editors drop product references into editorial pages when products live as entries (Shopify import or Cargo). Shoppable layouts and purchase CTAs are template work rather than a native authoring pattern.

With Cargo, cart and checkout templates are Statamic views so CMS-managed globals can be placed there; with Shopify the checkout stays on Shopify. No injection of CMS content into external commerce flows.

Cargo order emails and confirmation pages can be templated; nothing ties CMS content to order events for external commerce platforms.

Front-end protection schemes (logged in, IP, password, custom drivers) and user groups can gate spec sheets and catalogs, but there is no account-based pricing or quote flow.

Native search indexes with the Comb driver or Algolia, configurable searchables across collections, so content and imported products can be searched together. Faceting, synonyms and search landing pages are built in Algolia or templates.

Promo banners can be scheduled with date behaviours or globals; Cargo adds discounts. No time-windowed activation with end dates or channel targeting out of the box.

Pro multi-site can run regional or brand storefronts from one install with shared entries localized per site and site-specific legal content. The vendor positions it for variations of one site, not independent storefronts.

Asset galleries with Glide transforms and YouTube or Vimeo video embeds. No 360, AR or hotspot support natively; Cloudinary addon helps.

Front-end user registration and forms could collect seller content, but there are no seller profiles, moderation queues or review aggregation.

Product entries localize per site like any content, with origin inheritance. No currency-aware blocks or regulatory content tooling beyond what Cargo or Shopify provide.

No connection between content engagement and revenue inside the CMS; attribution lives in GA4 or the commerce platform.

Control Panel access uses roles, permissions and user groups (Pro) with per-collection and per-site permissions. Front-end protection is per entry or collection by auth, IP or password, and the auth scheme ignores roles, so department-level audience visibility needs a custom driver. SSO via Laravel Socialite or Enterprise plan.

Taxonomies, structured collections, native search and full revision history with notes support a knowledge base. No review dates, expiry or approval routing for knowledge updates.

Members-only areas with front-end login, registration and profile forms can be built, and Laravel makes custom portal features practical. There is no news feed, directory, notifications or social layer; any portal is a custom build.

News can be published to protected collections, but there is no audience targeting, read receipts or acknowledgment tracking.

User blueprints can hold bios and fields, so a basic directory is buildable, but there is no org chart or HR system integration.

Revisions give versioned policy pages with history and restore, and Git storage adds a full audit trail of content files. No acknowledgment tracking or review reminders.

Onboarding pages can be modelled as a protected collection; no role-specific paths, progressive disclosure or HR triggers.

Comb or Algolia search covers Statamic content only. No federation with SharePoint, Confluence or Drive and no search analytics.

Responsive front ends and a responsive Control Panel; no native app, offline support or push notifications.

No LMS integration or learning features; training content would just be pages.

No comments, reactions, forums or polls in core; forms could approximate polls and idea submission.

No Teams, Slack or Google Workspace integrations; notifications would be custom Laravel listeners on Statamic events.

Unpublish with revision history and date-driven visibility exist, but no review dates, stale content flags, ownership reminders or archival workflow.

No internal analytics, failed-search reporting or adoption dashboards.

Multi-site shares one content store, users and blueprints, so it is not tenant isolation. Genuine isolation means a separate install per brand, which Statamic now supports commercially through Platform licensing and its Sites API.

Within one multi-site install, blueprints, fieldsets, partials and globals are shared across all sites. Across separate installs sharing is code-level through Composer packages or starter kits.

Central roles and per-site permissions in one install, plus Enterprise audit logging. No cross-brand content standards or approval workflows.

Multi-site brands share one perpetual Pro licence and one host. For separate installs, Platform pricing starts at $240 a month for 20 sites and drops to $3.50 per site at volume, and a Master License covers volume purchase. Self-hosting keeps infrastructure cost shared.

Each site can carry custom attributes (for example a theme key) used by templates to switch styling, and separate sites can have their own templates. Theming is a developer pattern, not a platform feature.

Per-site permissions control who edits each locale, but translation workflow is shared and addon-driven with no brand-aware approval.

No portfolio or per-brand analytics.

Revisions can be switched on per collection, which allows some variation, but there are no configurable approval chains per brand.

Within multi-site, entries can be localized into other sites from an origin and inherit unchanged fields, so origin edits flow to child sites while overrides stay local. Globals can be shared. Nothing syndicates across separate installs.

No per-brand compliance rules or publishing guardrails; consent and accessibility are template and addon concerns.

Shared partials, components and fieldsets can be versioned in Git or packaged with Composer, but there is no design system management in the platform.

One user base with central super admins and per-site roles in a multi-site install; SSO through Socialite or Enterprise. Separate installs have separate user stores.

Collections can use several blueprints and share fieldsets, so a base model can be extended per brand by composing fieldsets, though blueprints are not per-site.

No executive or portfolio reporting.

Statamic is self-hosted software with no vendor-run cloud, so the vendor never processes a customer's site content and GDPR compliance for the installation sits with the customer; the privacy policy says so directly ('there is nothing we can do to make your Statamic installation 100% compliant'). What the vendor does process (statamic.com accounts and licence validation, which phones home hourly with domain and IP while the Control Panel is in use) is covered only by a 2022 privacy policy: no DPA, no SCCs, no formal sub-processor page, and data subject requests go by email. A named list of third-party services in the policy and the fact that content never leaves the customer's infrastructure keep it above the floor; the missing DPA keeps it below 55.

No BAA, no HIPAA statement and no healthcare guidance exist anywhere in Statamic's documentation or legal pages. Because the software is self-hosted, a buyer could in principle deploy it on HIPAA-eligible infrastructure under their own BAA with a hosting provider, but the default flat-file storage writes content, form submissions and user records as plain YAML files on disk, so every safeguard is the customer's to build. Low end of the 20 to 35 band.

The privacy policy addresses only EU GDPR rights in a generic paragraph. There is no CCPA or California disclosure, no UK GDPR or IDTA addendum, no PIPEDA or LGPD statement, and no FedRAMP, IRAP, C5, PCI DSS or HITRUST coverage. As with every self-hosted CMS, regional compliance is inherited entirely from how the customer deploys and operates it.

Statamic, Inc. holds no SOC 2 attestation of any type, publishes no trust center and announces no plan to pursue one. With no vendor-hosted service there is little for a SOC 2 report to scope beyond the licensing server and marketplace, so buyers carry the whole control environment through their own hosting provider. Low in the no-SOC-2 band, in line with other self-hosted open-source platforms.

No ISO 27001 or ISO 27018 certification is held or claimed for Statamic, Inc. The privacy policy's 'we follow industry standards on information security management' is a statement, not a certificate with a registrar, scope or surveillance cadence. Any ISO coverage a buyer gets comes from their chosen host, not from the product.

There are no additional certifications: no CSA STAR, PCI DSS, Cyber Essentials, ISO 42001 or government authorization. Statamic does run an active, transparent security process (a published SECURITY.md with scope, private reporting through GitHub, and frequent GitHub Security Advisories with affected and patched versions, several published in October 2026 alone), plus a documented security-fix window per major version. That is good practice but none of it is third-party attested, and there is no bug bounty.

Residency is entirely in the customer's hands: Statamic runs wherever Laravel runs, content lives as flat files or in the customer's own database, and the vendor stores no site content, so any region or on-premises location is possible. The one data flow that leaves the customer's infrastructure is licence validation, which sends the licence key, domain, IP address and PHP version to the vendor's US-based Outpost every hour the Control Panel is in use; air-gapped installs require contacting support. Scores just under self-hosted peers for that call-home dependency, and there is no contractual guarantee because there is no hosted service to guarantee.

Content portability is unusually strong: by default every entry, user, form submission and setting is a Markdown or YAML file on disk, versionable in Git (the Pro Git automation commits changes as they happen), so a complete export is simply a copy of the repository with no proprietary format. Erasure, though, has no tooling: there is no data subject request workflow, no retention policy engine and no anonymisation feature, so deleting a person's data across entries, users, form submissions, revisions and Git history is a manual developer task, and Git history in particular retains deleted content unless rewritten. No vendor retention period applies because the vendor holds no content.

Core Statamic has no audit log. Accountability comes from two Pro features: Revisions, whose history view records publish, unpublish and restore events with author and timestamp, and Git automation, which commits each content change under the authenticated user's name, giving a tamper-evident trail outside the application. Dedicated audit trails require marketplace addons (the paid Logger for Statamic from a Certified Partner, or the free Statamic Logbook), and there is no native SIEM push, configurable log retention or compliance reporting beyond standard Laravel logging channels.

Statamic publishes no accessibility statement or WCAG conformance target for the Control Panel. There is visible, recent remediation work, but it lands on the 6.x branch: in September and October 2026 the core team merged fixes for keyboard reordering of replicator sets, duplicate ARIA ids, heading order, modal focus handling, unlabelled search and table headers, and form-control contrast below 3:1. That demonstrates real attention, but buyers on Statamic 5 do not receive these fixes and there is no audited baseline to measure against, so it sits at the top of the no-documented-commitment band.

There is no VPAT, ACR, Section 508 statement, ATAG assessment or accessibility page for Statamic. Accessibility in the Control Panel is visible only through individual GitHub issues and pull requests, which a procurement office cannot file. The only accessibility-specific tooling is third-party, such as a paid marketplace addon for editor-time WCAG checks on content, which concerns the delivered site rather than the authoring UI.

Statamic ships no native generative AI: the Statamic 6 launch (Jan 28 2026) centred on the redesigned Control Panel, Vue 3/Inertia, passkeys and Laravel Boost guidelines, with no AI writing features. Generation comes from community addons: Statamic AI Writer (muench-dev, v2.0.1 Oct 2026) rewrites, expands, shortens, summarises, translates and titles content inside Bard against OpenAI or OpenAI-compatible providers, with AI Writer for Bard, bold-web AI Assistant and klickmanufaktur AI Tools filling out the field. Slightly above the plugin-only band because several maintained options exist; held well below 55 because none is first-party and none shows brand voice controls or prompt governance.

The asset container offers manual focal point cropping and Glide image manipulation, but no AI image generation, auto alt text or media analysis in core. The klickmanufaktur AI Tools addon (German-language, built as an internal tool) generates asset descriptions, and alt-design's Alt AI is a beta addon; neither is an established, widely adopted option. Scores in the no-native-media-AI band.

No machine translation in core, but the marketplace has several maintained MT addons that work with Statamic Pro multi-site: AI Translator (Option5) bulk-translates whole entries through DeepL, One-click Content Translation (Apps with Love, commercial, Statamic 6 compatible) adds DeepL or Google buttons to fields including alt text, and Magic Translator (el-schneider, Apr 2026) translates Bard, Replicator and Grid fields through DeepL or LLMs via Prism. Top of the no-native band because bulk MT is genuinely available; not higher because there is no quality scoring or brand voice preservation and all of it is third-party.

Statamic's first-party SEO Pro addon handles meta fields, sitemaps and an SEO report but generates nothing with AI. AI SEO suggestions, taxonomy suggestions and asset descriptions exist only in the klickmanufaktur AI Tools addon, which describes itself as an internal tool, and in general-purpose writing addons. No automated on-page AI scoring.

No AI auto-tagging, routing, duplicate detection or bulk enrichment in core; Statamic's workflow tooling (revisions, publish scheduling) is rule-based. Taxonomy suggestions in the AI Tools addon and classification in AI Writer are editor-triggered single-entry assists, not woven into content operations.

Statamic Inc. has no agent product. The closest thing is Statamic Secretary, a third-party v0.1 beta addon (Aug 2026, USD 49 per site) where editors request content changes in natural language from the Control Panel or by email, review a draft and publish only on an explicit command, plus independent starter kits such as statamic-agentic. External agents can also drive content through the community MCP servers. Early, third-party and beta, so it stays in the no-agentic band.

No content intelligence dashboard, gap analysis, topic clustering or stale content detection exists in core or as a recognised addon. SEO Pro's report is a rule-based checklist and analytics come from external tools such as Google Analytics.

No AI quality, brand voice or compliance auditing at scale. Accessibility and SEO checks rely on rule-based addons and external scanners; nothing found applies AI to audit content across a site.

Core search uses a local index or an Algolia driver, with community drivers for Meilisearch, Typesense and Elasticsearch; any semantic or hybrid relevance comes from configuring those external engines, not from Statamic. No embedding generation, vector index or RAG-ready endpoint ships with the platform, so semantic search is a custom integration.

Statamic has no personalization engine, rule-based or ML. Any audience targeting is built by developers in Laravel or delegated to an external personalization service, so there is no AI personalization layer to score.

There is no official Statamic MCP server, but the community one is unusually complete: cboxdk/statamic-mcp is listed on the Statamic Marketplace with 100+ tools covering blueprints, entries, collections, assets and users, read and write, served from a web endpoint authenticated by Control Panel tokens, and was promoted in Statamic's own October 2025 newsletter (then flagged alpha). danielgnh/statamic-mcp is built on Laravel's first-party MCP package with optional OAuth, and statamic-boost adds read-only tools to Laravel Boost. Scored as a well-supported community server; not higher because it is not vendor-maintained and the current cboxdk build requires Statamic 6.6+, so Statamic 5 sites get older releases.

Because every AI feature is an addon, every one is BYOK: AI Writer accepts OpenAI, Opper or any OpenAI-compatible endpoint, Magic Translator reaches OpenAI or Anthropic through Prism, bold-web defaults to the Swiss provider Infomaniak with Groq as an alternative, and self-hosting keeps data under the customer's control. Developers can also use the Laravel AI tooling directly. Held in the partial band because there is no platform-level model configuration shared across features; each addon takes its own key.

Statamic 6 ships Laravel Boost guidelines in core, so AI coding agents get first-party Statamic context, and the platform sits on Laravel's AI stack (Boost, the Laravel MCP package, Prism). Content is exposed through the REST Content API and first-party GraphQL with blueprint-defined schemas, plus Laravel events usable as AI triggers, and flat-file Markdown/YAML content is directly readable by agents in Git. No dedicated AI SDK, RAG endpoint or official LangChain-style guide, so it sits in the good-tooling band.

With no native AI there is no platform governance layer: no AI audit trail, prompt template governance, brand safety or indemnification. The only gates are addon-specific, such as Secretary's review-before-publish step, and Statamic Pro revisions and Git history, which record content changes but not AI involvement. MCP access is scoped by Control Panel tokens and user permissions.

No AI usage, cost or quality reporting exists in the Control Panel. Usage is visible only in each provider's own dashboard for the keys configured in each addon, which leaves administrators without a consolidated view.