A lightweight, self-contained CMS built with a focus on simplicity, security and extensibility.

The current version is 3.0-preview. The core architecture is now largely established, while further refinement and development are still expected.

Core features

  • MIT/X11 license. The system does not require copyright notices, referral links or any other mandatory attribution indicating that the CMS is being used.
  • Zero dependency on third-party PHP code. Eleanor CMS does not use third-party PHP libraries or frameworks.
  • No frontend build step. Built-in JavaScript and CSS files do not require compilation through npm or other build tools.
  • Multiple users at the same time. Multiple accounts can be opened simultaneously in separate browser tabs on the same device. The same user can also be signed in on multiple devices.
  • Two-factor authentication and access recovery. TOTP-based two-factor authentication can be enabled through an authenticator app. One-time recovery codes are available for restoring access; with two-factor authentication enabled, access can be confirmed using any two of three factors: password, TOTP or a recovery code.
  • Group-based access control. User permissions are determined by group membership and the roles assigned to those groups. A user can belong to multiple groups.
  • Minimal cookie usage. Authentication uses a single cookie. Together with the explicit “Remember me” option, it falls under authentication cookies that generally do not require separate user consent.
  • XSS protection through CSP. Inline scripts are prohibited by Content Security Policy.
  • CSRF protection. State-changing browser requests are accepted only from the same origin using Fetch Metadata.

Architecture

  • Modular structure. System functionality is organized into units.
  • Extensibility without deep integration. A minimal unit can consist of a single file and does not require registration in the system configuration. Classes, interfaces, traits and enums are autoloaded when placed in the corresponding directories.
  • Clean URLs based on the classic directory-and-file model. URL structure is built without a centralized router, so addresses directly reflect the organization of system sections and resources.
  • Asynchronous events. Actions that do not require immediate execution can be processed separately from the main request.
  • Command-line support. Eleanor CMS provides a common CLI interface that allows units to expose their own commands.

Installation and development

  • The system can be installed either through a browser or from the command line. The CLI installer supports configuration validation and dry-run mode.
  • The source code is documented: the project structure, directories, files and major code elements include explanations describing their purpose.
  • The author keeps synthetic website testing in mind during development. The high scores of this small site in PageSpeed Insights and PR-CY (among others) are one example 😎.

Inspired by https://thebestmotherfucking.website/

Pet project by Sunvas