Why CPalius?
When choosing a technology, the most valuable information is what it is not good at. This page lists good reasons to choose CPalius and valid reasons not to.
Good reasons to choose CPalius
1. You are writing an application, not a site
If you have business logic next to your content (bookings, catalogue, membership, application flows, directory) and want to write it as a clean module instead of squeezing it into a CMS plugin system, CPalius's two-class data model is made for this: Node for content and Resource, with real SQL columns, for business records.
2. Security should be a "default", not a "setting"
In CPalius the following work without installing extra plugins:
- A WAF that scans the URL, headers and body of every request (it ships in detection mode by default; blocking mode can be switched on)
- CSP with nonces (report mode by default) and security headers
- Capability-based access control; an undefined capability is denied
- XSS cleaning of rich text at save time
- MIME validation on uploads (the content is checked, not the file extension)
- A malware scanner and an audit log
- Two-factor authentication, login defense (attempt limit, CAPTCHA), password policy and leaked-password checks
- SSRF-protected outgoing webhooks
3. Third-party code must not bring the system down
On every platform with a plugin system, the problem is that a plugin can break the platform. In CPalius a module is checked in an isolated process before it is activated, quarantined if it fails at runtime, and the admin panel comes up independently of the modules. Details: Overview.
4. Updates must be safe
On a live site the "update" button should not be scary. A CPalius update is signed, locked, takes a backup and rolls back files and database if something goes wrong. Details: Update system.
5. Configuration should be able to live in Git
Roles, settings, workflows and path patterns live as YAML under cp-content/config/sync/. You move a change made in development to production with Git.
6. Modern technology, no Node.js requirement
PHP 8.4, Symfony 7.4 LTS, Doctrine ORM, Twig. The core and admin interface are built with Symfony AssetMapper and the standalone Tailwind binary; Node.js is not needed for installation or running.
Valid reasons not to choose CPalius
1. If you are looking for a ready-made plugin marketplace
CPalius's module store does not compete with WordPress's tens of thousands of plugins and themes. If you say "I want a ready-made WooCommerce, Elementor and Yoast", you are in the wrong place. The CPalius ecosystem is growing but small.
2. If your hosting environment is limited
PHP 8.4 is required, and MySQL 8 / MariaDB 10.6 are supported. Installation with PostgreSQL and SQLite is currently not supported: the migration files in the repository contain MySQL-specific DDL. The ORM layer is portable, but the installation path is not yet.
3. If you want a drag-and-drop page builder
CPalius's page manager is field-based, not a visual design tool. The theme developer writes the template, the content editor fills in the fields.
4. If nobody on your team knows PHP/Symfony
You do not need to know code to set up the site and enter content. But writing a new module requires knowledge of PHP, Symfony and Doctrine.
Comparison
| Topic | WordPress | Drupal | Plain Symfony/Laravel | CPalius |
|---|---|---|---|---|
| Ready-made admin panel | Yes | Yes | No | Yes (two panels) |
| Permission model | Role-based | Capability-based | You write it | Capability-based, query scoping |
| Multilingual support | With plugins | In core | You write it | In core |
| Field system | With plugins (ACF etc.) | In core | You write it | In core (Field API) |
| Protection from plugin crashes | None | Limited | None | Quarantine, pre-checks |
| Signed updates | Partial | No | None | Yes (Ed25519) |
| Plugin ecosystem | Very large | Large | Package registry | Small, growing |
| Learning curve | Low | High | Medium | Medium |
The table describes the out-of-the-box behaviour of the core; every plus is not a "best" claim. For example, Drupal's capability and field systems are very mature; CPalius's difference is that it offers them in a lighter core with an isolated module contract.
Decision guide
- A content site, you need many ready-made plugins, no developer → WordPress.
- A large enterprise content platform, you have an experienced Drupal team → Drupal.
- A fully custom product, you want to write the panel and permissions yourself → Symfony or Laravel.
- You want a custom application but do not want to rewrite the panel, permissions, media, multilingual support, security and update system → CPalius.