Four open source headless CMS platforms dominate the shortlist in 2026: Strapi, Directus, Payload and Decap. They are not interchangeable, and picking on popularity alone is how teams end up rebuilding eighteen months later. The right choice comes down to three things — how your data is stored, which frontend framework you're committed to, and what your licence actually permits at your revenue.
This guide is written from an agency's perspective: we build and maintain production sites on these platforms, so the focus is on the trade-offs that surface after launch, not the feature lists on the vendors' homepages. One correction up front, because it changes real decisions: not all four are open source in the strict sense any more. Strapi and Payload are MIT-licensed. Directus moved to a source-available licence in recent years, and Decap — while still MIT — is barely maintained. Both of those facts matter, and we cover them below.
The short version:
Strapi — the safest all-rounder. Mature, genuinely open source (MIT), framework-agnostic. Pick it when you want a proven CMS and a large plugin ecosystem.
Directus — pick it when you already have a SQL database. It sits on top of Postgres or MySQL and your data stays in your own tables. Note the source-available licence.
Payload — the best fit for a Next.js/TypeScript team. Since v3 it installs inside your Next.js app, so CMS and frontend share one codebase.
Decap — historically the go-to for simple static sites, but effectively unmaintained in 2026. For new builds, look at Sveltia CMS or Keystatic instead.
What is an open source headless CMS?
A headless CMS manages content but does not render the front end. Instead of coupling content, templates and page rendering in one system, it exposes content through an API and lets you build the front end in whatever framework you like — React, Next.js, Nuxt, Vue, Astro or something else. "Open source" adds a second property: the source code is published, so you can read it, modify it and self-host it rather than renting a closed SaaS.
That second property is where 2026 gets nuanced. "Open source" is often used loosely to mean "free to self-host," but licences differ in ways that affect commercial use:
- MIT / true open source — no restrictions on commercial use. Strapi and Payload sit here.
- Source-available — the code is public and usually free below a revenue threshold, but the licence isn't OSI-approved and larger companies may owe a commercial fee. Directus sits here.
- Open source but unmaintained — the licence is permissive, but nobody is shipping fixes. Decap is the cautionary example.
If avoiding vendor lock-in is the reason you're going open source in the first place, the licence is not a footnote — it's part of the decision.
Strapi 5
Strapi is the most widely adopted open source headless CMS, with a large plugin ecosystem and production use at organisations including Cisco, JPMorgan Chase, Tesco and Airbus. It's built on Node.js, MIT-licensed, and can run on SQLite, PostgreSQL or MySQL.
The current major version is Strapi 5. If you're reading older tutorials, note the break: v4 reached end of life on 30 April 2026, so any new project should start on v5. The v5 architecture introduced a Document Service API (replacing the old Entity Service), draft-and-publish with content history, live preview, and — more recently — a built-in MCP server and an AI assistant for scaffolding content types. Through 2026 the team publicly shifted its focus from new features toward stability and bug-fixing, which is a reassuring signal for anyone putting it into production.
Best for: teams that want a mature, fully open-source CMS with a broad plugin ecosystem and no framework lock-in. Watch for: it's a decoupled API service, so you run and host it separately from your front end.
[Rubik: one or two sentences on a real Strapi build — what you shipped, one thing that went well, one thing to watch. A screenshot of an admin panel you configured beats the stock vendor screenshot for originality.]
Directus
Directus takes a fundamentally different approach: instead of owning its own content store, it sits on top of an existing SQL database and generates REST and GraphQL APIs directly from your schema. The practical consequence is data ownership in the literal sense — your content lives in your Postgres or MySQL tables, and if you removed Directus tomorrow, the data would still be there in a format you own. It also ships a native MCP server and AI assistant.
The licence is the thing to understand before you commit. Directus is source-available, not OSI-approved open source (BSL 1.1, moving to a Monospace source-available licence). In plain terms: it's free to self-host for organisations under roughly $5M annual revenue and fewer than 50 employees; above that, self-hosting requires a commercial licence. Managed Directus Cloud starts around $99/month. That's fine for most teams, but it's a genuine difference from Strapi and Payload, and it should be a conscious choice rather than a surprise at renewal.
Best for: projects built around an existing relational database, internal tools, and data-heavy applications. Watch for: the revenue/employee licence threshold, and usage-based API costs if you use Cloud on a high-traffic static site.
[Rubik: if you've connected Directus to a client's existing database, that's a strong, hard-to-fake detail to include here.]
Payload 3.0
Payload is a TypeScript-first, MIT-licensed CMS that was rebuilt from the ground up in version 3.0. The defining change: Payload is now Next.js native. It installs directly into your Next.js /app folder, so the admin panel, the backend and your front end share one codebase, one set of TypeScript types and one deployment. Its Local API lets you query the database directly inside a server component with no HTTP round-trip, which is both a performance win and a genuinely different developer experience from the decoupled-API model everything else on this list uses.
Under the hood it uses the Lexical rich-text editor and pluggable database adapters (MongoDB, PostgreSQL, SQLite, Vercel Postgres). A signal worth knowing: Figma acquired Payload in June 2025 to power the CMS layer of Figma Sites, and the project has stayed MIT-licensed and actively maintained since. The dependency footprint was also cut dramatically in the rewrite, which helps long-term maintainability.
Best for: teams already building on Next.js and TypeScript who want their CMS and front end to be one project. Watch for: it's the steepest learning curve of the four, and it's happiest inside a Next.js/React world — less natural if your front end is on a different stack.
[Rubik: a note on a Next.js + Payload project, or your take on the single-codebase model in practice, would land well here.]
Decap CMS (and why to check Sveltia first)
Decap CMS, formerly Netlify CMS, is a lightweight Git-based CMS: content is stored as Markdown files in your Git repository and edited through a simple admin UI, which pairs neatly with static site generators. On paper it's still the obvious choice for small content sites, and it's MIT-licensed.
In practice, we can't recommend it for new projects in 2026 without a warning. Decap is poorly maintained — hundreds of open issues, a dated interface, and, more seriously, a track record of slow or absent responses to security reports, including unpatched vulnerabilities. For a Git-based static-site workflow, the actively-maintained successor Sveltia CMS is a near drop-in replacement (often a one-line config change) with modern UX and first-class internationalisation. Keystatic is another strong option if you want structured content defined in code.
Best for: the Git-based, static-site use case — but reach for Sveltia or Keystatic rather than Decap itself on anything new. Watch for: Decap's maintenance and security status; don't put it on a site you can't afford to patch yourself.
Open source headless CMS comparison
The clearest way to choose is by architecture and licence, not feature count. Here's how the four compare on the things that actually drive the decision:
| CMS | Licence | Built on | Where content lives | Free to self-host? | Best for |
|---|---|---|---|---|---|
| Strapi 5 | MIT (true open source) | Node.js | Its own DB (SQLite / Postgres / MySQL) | Yes, no restrictions | Mature all-rounder, framework-agnostic |
| Directus | Source-available (BSL 1.1 / MSCL) | Node.js | Your existing SQL database | Free under ~$5M revenue & <50 staff | Projects on an existing SQL database |
| Payload 3.0 | MIT (true open source) | Next.js / TypeScript | MongoDB / Postgres / SQLite | Yes, no restrictions | Next.js + TypeScript teams |
| Decap | MIT (but unmaintained) | Git-based (React) | Markdown in your Git repo | Yes | Simple static sites — but see Sveltia |
Strapi vs Directus vs Payload: how to decide
These three are the serious contenders for most application and website builds. The decision usually resolves on one question:
- Do you already have a SQL database you need to keep? Choose Directus. It's the only one of the three that connects to an existing database natively instead of asking you to restructure around the CMS.
- Is your front end committed to Next.js and TypeScript? Choose Payload. The single-codebase, no-API-round-trip model is a real advantage when you're already in that world.
- Do you want the safest, most flexible, unambiguously open-source option? Choose Strapi. Biggest community, largest plugin ecosystem, MIT licence, and it doesn't tie you to any one front end.
| Feature | Strapi 5 | Directus | Payload 3.0 |
|---|---|---|---|
| Licence | MIT | Source-available | MIT |
| Data model | Own database | Your existing SQL DB | Own database |
| Frontend coupling | Framework-agnostic | Framework-agnostic | Next.js native |
| TypeScript support | Good | Good | Excellent (TS-first) |
| APIs | REST, GraphQL | REST, GraphQL (auto-generated) | REST, GraphQL, Local API |
| Learning curve | Moderate | Moderate | Higher |
| Community size | Very large | Large | Growing fast |
Fastest, most lightweight, and simplest to self-host
These come up constantly, so here are direct answers rather than a shrug.
Fastest for content delivery: it depends on architecture, not branding. A Git-based CMS (Decap/Sveltia) serves pre-built static files, which is about as fast as delivery gets. For dynamic apps, Payload's Local API is the standout because it skips the HTTP round-trip entirely inside a Next.js app. Directus is efficient because it queries your database directly. Strapi is perfectly fast in practice, but it's a conventional decoupled API.
Most lightweight: the Git-based options (Sveltia, then Decap) are the lightest — no database, no separate server, just files in a repo. Among the database-backed platforms, Payload's v3 rewrite cut its dependency footprint sharply, which helps.
Simplest to self-host: Strapi has the smoothest "spin it up and go" path with the most documentation and community answers when you hit a snag. Git-based tools are simplest of all if your content genuinely fits a static-site model. Directus is straightforward too, provided you're comfortable running a database.
How much does an open source headless CMS cost?
"Free to download" is not "free to run." The licence is usually the smallest line item; the real costs are development, hosting and maintenance.
| Cost area | What to budget for |
|---|---|
| Licence | Free for Strapi and Payload (MIT). Directus is free to self-host below ~$5M revenue/50 staff, otherwise a commercial licence. Managed clouds are paid (e.g. Directus Cloud from ~$99/mo). |
| Development | Usually the largest cost — the custom front end and content modelling. |
| Hosting | Self-hosting means infrastructure, monitoring and scaling. Payload can deploy serverless on Vercel alongside a Next.js app. |
| Maintenance | Updates and security patches. This is exactly where an unmaintained option like Decap becomes a hidden cost. |
| Integrations | CRM, ecommerce, search, analytics and marketing tooling add complexity. |
How to choose the right platform
Before shortlisting, get clear answers to these:
- What content types and relationships do you need to model?
- What frontend framework are you committed to? (This alone often decides Payload vs the rest.)
- Do you have an existing database that has to stay? (This points to Directus.)
- What's your organisation's revenue and headcount, and does the licence matter at that size?
- Do you have the in-house resources to self-host and patch, or do you need managed hosting?
- How technical are your content editors, and how much do they need a polished editing UI?
- Will this need to scale to multiple sites, brands or locales?
Choosing on popularity instead of fit is the most common and most expensive mistake — it leads to technical debt and, eventually, a migration. If you're weighing headless against a traditional CMS more broadly, our guide to headless CMS vs traditional CMS covers that trade-off in full, and whether your CMS is holding your business back is a useful gut-check.
The verdict
There's no universal "best." For most teams, Strapi is the safest starting point — mature, flexible and unambiguously open source. Choose Directus when you're building on an existing SQL database, Payload when you're all-in on Next.js and TypeScript, and a modern Git-based tool like Sveltia (not Decap) for lightweight static sites. Get the architecture and licence right at the start and you avoid the costly rebuild later.
Planning a new site or platform and want a second opinion on the CMS decision? Speak to our team — we'll help you match the architecture to your stack, budget and growth plans.
