README

A security-first, plugin-based open-source CMS.

Website · Documentation · Changelog · 日本語

Dixlase is an open-source CMS developed by exc-D inc.

Defense hardened in the core, expression free through plugins and themes
Security, tamper detection, permissions, and signature verification are the core's responsibility, leaving content creation and editing maximally free. Because the core handles security, operators and creators can focus on producing, editing, and running content — across corporate sites, internal deployments, client projects, and personal sites alike.
A minimal core, maximal extensibility through plugins
The core sticks to security, front-page editing, user and permission management, and the plugin API; everything else ships as a plugin — and Dixlase's own built-in features run on the same API third-party plugins use.
Built to last, and ready for AI
Rather than optimizing for a quick first setup, Dixlase favors a design built to last — stable data structures, backward compatibility, and explicit deprecation — and keeps room for AI, so structured logs and new integration protocols like MCP work without rebuilding the CMS itself.

🚀 Features

Multi-layered Security
Two-factor auth via passkeys / email codes, IP restrictions, login notifications, and role-based permissions out of the box.
Plugin-based Architecture
A minimal core; features are added as plugins, and much of the core itself runs on the same plugin API.
Self-Hosted
Your server, your data: shared hosting, a VPS, a dedicated server, or your own on-premise hardware — wherever you like.
Detailed Audit Logs
Every admin action recorded in a structured form for operational transparency and accountability.
Site Health Check
Periodic diagnosis of security settings, configuration, and operational state, output in a machine-readable form.
Reliable Setup
An install wizard guides environment config, database connection, admin registration, and initial security.
CSP Support
A Content Security Policy header is sent by default, protecting visitors from XSS and content tampering.
Plugin Safety
Permission declarations, static analysis, signature verification, and a health score catch risky or tampered plugins at install time.

🕹️ Live Demo

No installation required — try Dixlase's admin panel and operational experience right in your browser.
A disposable instance is generated for each visitor from a SQLite template and auto-discarded after a set period, so you can reset and try as many times as you like.
Admin panel, content editing, plugin installation — everything feels exactly like production.

See the official site for the live demo.

📦 Setup

Dixlase runs on PHP 8.3 or newer and is built on Laravel 13.

Pick the method that matches your environment:

Manual install (ZIP)

Download the latest release ZIP from GitHub Releases, then:

unzip dixlase-*.zip
cd dixlase
composer install

After this, open the site URL in a browser — the installation wizard will guide you through database setup, the admin account, and initial settings.

Quick install script

For fresh VPS / bare-metal hosts with PHP 8.3+ and Composer, install with a single command:

curl -sS https://install.dixlase.net | php

The script checks PHP version and required extensions, downloads the latest release, runs composer install, generates an application key, sets directory permissions, and prints the URL to the Web-based installation wizard.

Docker installer

For Docker-equipped hosts, use the Docker installer, which brings up Dixlase via docker compose. See the installer repository's README for prerequisites and step-by-step instructions.

Composer create-project

For hosts with PHP 8.3+, Composer and Node.js, install from Packagist:

composer create-project dixlase/dixlase-core dixlase
cd dixlase
php scripts/serve.php

create-project builds the core's front-end assets and exposes the bundled theme's shipped build (never rebuilding it, since its signature covers it), then php scripts/serve.php starts the local server for the Web-based installation wizard. See the Composer installation guide.

To work on the Core itself, clone this repository; using the development Docker stack provided by the Docker installer is recommended. Dedicated developer documentation is in preparation.

🧩 Official Plugins

Dixlase ships a minimal core, and the following official plugins are maintained alongside it. Install only the features your site needs — directly from the plugin list in the admin panel, with no command-line steps or manual file placement.

Plugin	What it does
Dixlase Pages	Static pages and the essential content-creation features.
Dixlase Blog	A blog: posts with revisions, a trash and featured images, hierarchical categories and tags, moderated comments with notification mail and CAPTCHA, search and date archives, related posts, breadcrumbs and an RSS feed.
Dixlase Inquiry	Contact form with auto-reply email, spam protection, and admin-side message management.
Dixlase Menus	Visually edit header / footer / sidebar menu structures by drag and drop.
Dixlase SEO	Manage meta tags, sitemaps, OGP, and structured data per page or site-wide.
Dixlase Cookie	Cookie-consent display and recording, category-based consent, and conditional script firing.

More official plugins are on the way. The full lineup is also viewable on GitHub.

🎨 Official Themes

Themes shape a site's look and structure, and you can swap between them as needed.

Dixlase OnePage — the default theme, optimized for single-page layouts (hero, content builder, contact form, footer). Well suited to corporate sites and landing pages.

More themes are planned for future releases.

📚 Documentation

Project Site — dixlase.org — overview, live demo, and news
Documentation — installation, operations, and developer guides (in preparation)
Development Guide — architecture, API references, and coding conventions (in preparation)

Developer Guides

Plugin API — the plugin / theme API boundary definition (in preparation)
Source Comment Localization — comment locale switching with convert-comments.sh (in preparation)

🤝 Contributing

Currently: Dixlase is in early development and does not yet accept external code contributions. Code Pull Requests will open once we have assessed core API stability and how the project operates after the initial release, and prepared a Contributor License Agreement (CLA) that has passed legal review (no date is set).

Bug reports and feature proposals via GitHub Issues are welcome in the meantime; questions can be sent to the contact address. See CONTRIBUTING.md for the current contribution scope.

Once the CLA is finalized, contributions will open under the Dixlase Copyright Policy and the Dixlase CLA (the full text will be published in CLA.md). At that point, CONTRIBUTING.md will be replaced with the full PR-based contribution guide.

📖 Governance & Policies

Pillars Guidelines — What each pillar promises, and what it does not (draft)
Contributing Guide — How to contribute
Copyright Policy — Dual-license stance and CLA model overview
Contributor License Agreement — In preparation; the full text will be published when external contributions reopen
Security Policy — Reporting vulnerabilities

📜 License

Dixlase is distributed under a dual license:

Open Source License: GNU Affero General Public License v3 with the Dixlase Plugin and Theme Exception (see LICENSE-EXCEPTIONS).
Commercial License: A separate commercial license is planned for use cases where AGPL v3 compliance is not feasible (e.g., distributing modified versions in closed-source SaaS). It is not yet available — only a draft of the eventual terms is present in LICENSE-COMMERCIAL. For availability timing or other questions, contact info@dixlase.org.

A short overview of how these files fit together is in NOTICE (日本語).

Plugins and Themes

The documentation is also available under CC BY 4.0 (code examples under CC0 1.0), and the AI assistant instruction files (CLAUDE.md and similar) under CC0 1.0 — see Part 2 of LICENSE-EXCEPTIONS.

Plugins and themes that interact with Dixlase exclusively through the Plugin API are not considered derivative works and may be distributed under any license of your choice, including proprietary licenses. See LICENSE-EXCEPTIONS for the full terms.

Source Code Availability (AGPL §13)

If you run Dixlase on a server and make it accessible to users over a network, AGPL §13 requires that users be able to obtain the source code of your running version. Ensure that the "Source" link in your admin footer (or equivalent) is accessible to users. The URL advertised there is configurable via the DIXLASE_SOURCE_URL environment variable.

🙏 Acknowledgments

Dixlase stands on the foundation of excellent open source and services. As a project sustained by open-source developers and communities, we introduce them here with gratitude.

Framework & Core

Project	What it gives Dixlase
Laravel	A modern PHP web framework — the application core of Dixlase.
Symfony	Reusable PHP components. Laravel builds on many of them, such as HttpFoundation, Console and Routing.
Alpine.js	A lightweight, declarative JavaScript framework, powering front-end responsiveness.
Tailwind CSS	A utility-first CSS framework — the foundation for a consistent UI.

Auth & Security

Project	What it gives Dixlase
Laravel Fortify	Laravel's official authentication scaffolding: login, registration and two-factor.
Laravel Passkeys	Laravel's official passkey (WebAuthn) package, powering passwordless sign-in.
Cloudflare Turnstile	A privacy-conscious, non-interactive CAPTCHA — a built-in driver.
Google reCAPTCHA	Another CAPTCHA option, switchable between v2 / v3 / Enterprise.

UI & Content

Project	What it gives Dixlase
Font Awesome	The icon set used across the admin panel and the official themes.
Bunny Fonts	Privacy-conscious font delivery, used to load Figtree.
marked	A fast, lightweight Markdown parser, for rendering Markdown content.
highlight.js	Syntax highlighting for code blocks.
SortableJS	Drag-and-drop reordering, wherever order is edited by hand.

Build & Toolchain

Project	What it gives Dixlase
Composer	PHP package manager.
Node.js	JavaScript runtime.
npm	JavaScript package manager.
Vite	Front-end build tool.
Docker	Container runtime.

Beyond these, Dixlase is supported by countless libraries and tools. To every contributor — our deepest thanks.

Company, product and service names and logos mentioned here are trademarks or registered trademarks of their respective owners. They appear as an acknowledgment of each project and do not imply any affiliation or endorsement.

🛡️ Vision

With Safety, Fairness, Transparency, Extensibility, and Sustainability as the foundation,
true freedom blooms on top of them all.
Dixlase aims to be a CMS everyone can use freely and with confidence.

dixlase / dixlase-core

Package info

Security

Statistics