October 12, 2026

Why I built Justflows

I wasn't happy with WordPress's data structure or with PHP. So I asked: if you built a CMS from scratch today, which stack would you pick, and what would the data look like?

Why I built Justflows
WordPress earned its place. It made publishing possible for millions of people, and its install-in-the-browser, upload-a-plugin simplicity is something every CMS should learn from. But every time I looked under the hood, two things bothered me: how the data is stored, and the language it is written in.
So I asked myself a simple question: if you built a CMS from scratch today, which stack would you choose, and what would the data model look like? Justflows is my answer.

The data model I wanted

In WordPress almost everything is a row in wp_posts. Anything that doesn't fit goes into wp_postmeta as a key and a text value. The block editor saves a page as HTML with the block structure hidden inside HTML comments, and parses it back out every time you edit. It works, but it is a structure that grew over twenty years rather than one that was designed.
Justflows starts from the other end:
  • Content types with declared fields. A post, a page or your own type says up front which fields it has.
  • Content is a block document, not HTML. A page body is versioned JSON, and every block is validated against the block registry before it is saved. Nothing has to be parsed back out of markup.
  • Revisions that respect what is live. Editing a published page creates a working revision. The live page stays exactly as it is until you publish.
  • Taxonomies, menus, headers and footers are structured data you can read and write through the same API as content.
  • Multisite from day one. Every record belongs to a site, so one installation can run many websites and workspaces.
{
  "version": 1,
  "blocks": [
    { "type": "core.heading", "props": { "text": "Hello", "level": 2 } },
    { "type": "core.paragraph", "props": { "text": "Content is data, not HTML soup." } },
    { "type": "core.image", "props": { "src": "/uploads/cover.jpg", "alt": "Cover" } }
  ]
}
Because content is structured data, the same page can be rendered by a theme, exported as static HTML, served through an API, or edited by an AI agent, all without scraping HTML.

A modern stack, end to end

Justflows is TypeScript from the database layer to the admin. It runs on Node.js 22 and works with PostgreSQL, MySQL 8 or MariaDB 10.6, so you can use whatever your host already gives you. Plugin and theme developers get a stable, typed SDK instead of a global function soup.
What WordPress got right, I kept: you can still upload Justflows to shared hosting, open your domain, and install it in the browser. No terminal, no npm, no build step for site owners.

Security first, not bolted on

A CMS runs other people's code on your server. That deserves more than a checkbox, so security is part of the design:
  • Plugin and theme packages are refused unless they carry a valid marketplace signature or you pin their exact SHA-256 digest.
  • Core updates are signed with a separate release key that is pinned in Justflows itself.
  • Plugins declare the permissions they need in their manifest, like private file storage or background jobs.
  • Sites ship with a strict Content-Security-Policy, and webhooks and other outbound requests refuse private network addresses.
  • A fresh install asks for a one-time setup key, so nobody can claim your site before you do.

Caching first, so your site stays fast

Speed shouldn't depend on finding the right caching plugin. Justflows has an object cache and page caching built in, and works with a single server and no Redis. You can set Cache-Control per content type or even per post, purge a CDN such as Bunny.net when content changes, or export the whole site to static HTML on S3-compatible storage.
Inside the codebase, performance is a rule, not an afterthought: lists load shared data once and batch their database queries instead of running one query per item.

No dependence on third-party plugins

A typical site shouldn't need a stack of plugins from different vendors just to be found, collect a form or ask for cookie consent. Every one of them is another update to track, another security risk, and another thing slowing your pages down.
In Justflows the essentials are first-party: SEO with meta tags, sitemaps and feeds, forms, comments, galleries, analytics and cookie consent. They are built and released by the same team as the core. Plugins are still very welcome, but they should add something, not patch the basics.

Where it is today

Justflows is open source, with an MIT-licensed core, and it ships often: version 0.3.5 just added widget areas, per-post caching and static exports to object storage. This blog runs on it, too. If the question "what would a CMS look like if we built it today?" interests you, have a look at the code, try it, and tell us what you think.
Download Justflows Contribute
✌️

Thanks for reading!
Find more posts on the blog or star Justflows on GitHub.