Run the two lines
Over SSH, in the folder you want the CMS in. No shell? Upload install.php to the web root and
open it in the browser instead.
A ready-made admin for your SPA
Describe the schema. Get REST, OpenAPI, CRUD, live preview, backups, and an SDK. Your SPA stays the frontend.
curl -fsSL -o install.php 'https://2js.ru/download?source=curl'
php install.php
The second line boots the wizard on port 8080 and prints a one-time link: PHP check, latest release, DB and admin — all in the browser.
MIT
PHP 8.3+
Zero runtime deps
MySQL / MariaDB
OAuth
Roles
Feature flags
i18n API
Backups
SDK
Open the printed link
php install.php serves the wizard on port 8080 behind a one-time key. It checks PHP 8.3+,
downloads the latest release and verifies sha256.
Fill DB and admin
The wizard writes the config, runs migrations and creates the owner. Then /admin and /api are live for your SPA.
What's new
Shipped in 0.62 — preview to backups
Product cut for a modern headless CMS on PHP: live preview, content features, ISR webhooks, fine-grained ACL, data backups, and an official SDK.
0.62.11
Live Preview & cache headers
Draft-safe preview tokens for the SPA, Cache-Control + Surrogate-Key on public GET — ready for CDN/ISR.
0.62.11
M2M, blocks, workflows, locales
manyToMany / oneToOne, typed blocks field, entry status workflow, and content locale columns with ?locale= fallback.
0.62.11
@hcms/sdk + typegen
Thin TypeScript client and hcms-types CLI from OpenAPI — ship typed SPA calls without a second
schema DSL.
0.62.12
Event Bus & ISR presets
Internal Event Bus; webhook templates for Vercel, Netlify, Cloudflare, and Fastly revalidation.
0.62.12–15
Field/row ACL & admin sections
Per-grant fieldAcl and ownEntriesOnly. Owner hides admin sections and picks the post-login home.
0.62.0 / .13
Uptime + data backups
URL/self health probes with soft cron. DB + media snapshots, restore, and push to Google / Yandex / Dropbox / SFTP.
Why HCMS
You shipped the SPA. Then you rebuilt the CMS.
CRUD, migrations, admin UI, OpenAPI — again. HCMS closes that gap on any PHP host.
The usual path
- Hand-rolled admin nobody wants to maintain
- SQL and validation drift from the API
- Swagger written by hand — or skipped
- Editors poked into the SPA repo
With HCMS
- Schema → SQL, REST, admin, OpenAPI
- Publish runs the migration
- Editors work at /admin — SPA stays yours
- install.php on shared hosting or Docker
Compare
Built for PHP hosts, not another Node stack
When shared hosting and a two-line install matter more than a cloud dashboard.
| Capability | HCMS | Custom CRUD | Node headless |
|---|---|---|---|
| Shared hosting / public_html | ✓ | ~ | — |
| Zero Node runtime | ✓ | ✓ | — |
| install.php → latest zip | ✓ | — | — |
| Schema → OpenAPI + admin | ✓ | — | ~ |
| MIT, self-host, no cloud upsell | ✓ | ✓ | ~ |
For your SPA
Plug in an admin. Keep the frontend.
HCMS is the backend your SPA is missing: visual schema, REST, feature flags, translates, and a real /admin — no custom CRUD.
Drop-in /admin
Ship a full admin UI with your PHP host. Editors never touch the SPA repo.
REST for React / Vue / Next
Public /api/{slug} with pagination, search, sort, and filter. Bearer tokens, CORS included.
OpenAPI / Swagger
Spec at /api/openapi.json, UI at /api/docs — generated from the schema you publish.
SPA runtime
Flags, A/B, and translates — without another SaaS
Ship kill-switches and copy from the same PHP host as your content API.
Feature flags
Boolean, integer, string, object. Admin CRUD plus public GET /api/features with ETag for the SPA.
A/B percentage rollout
Sticky buckets on boolean flags: abTest + rolloutPercent, subject via query or X-Flag-Subject.
Translates API
Locales and keys in admin. Public GET /api/translates for SPA dictionaries — import/export JSON.
Built for teams
Sign-in, roles, and forms that ship
OAuth, clear roles for editors and viewers, spam-safe public forms, and email out of the box.
Sign-in that fits teams
Google and Telegram login plus TOTP 2FA. Owners stay on password; editors can connect social accounts.
Roles people understand
Invite a content manager to edit entries — or give view-only access to the admin. Owner keeps schema, users, and system. Field/row ACL and per-resource grants on top.
Forms & email ready
Anti-spam on public create: honeypot, timing, captcha, blocklist. Send via Resend, Postmark, or Mailgun.
Build APIs fast
From content type to live /api/{slug}
Schema is the source of truth for SQL, validation, REST, Admin UI, and OpenAPI.
Field types that cover real apps
String, richtext, relation (M2M / oneToOne), blocks, media, slug, enum, json, dates — publish and get a migration.
Query the way you expect
Per-resource pagination, search, sort, and filter. Custom resource APIs for read and write projections.
Swagger the moment you publish
No hand-written spec. Open /api/docs after you hit publish on a content type.
Content tools
Editors get a real admin, not a JSON dump
Media, rich text, relations, revisions, dashboard analytics — the usual CMS jobs, wired to your API.
Media + variants
Library, crop, optimize (WebP/JPEG/PNG), variants. Pretty /media/{id}/{file} with static warm-cache after the first hit.
Rich text & tables
Markdown for editors. Typed column filters, bulk delete, and relation labels in the list view.
Relations & revisions
manyToOne / manyToMany / oneToOne, entry revisions, workflow status, locale siblings, package export/import.
Deploy anywhere
One file. Any PHP host.
No Cloud upsell. Self-host, update in-app, roll back if a swap dies mid-flight.
install.php → GitHub zip
Wizard downloads the latest release, verifies sha256, unzip. If src/ is already there, skip.
Shared hosting or Docker
public_html layout done right — or docker compose up with MySQL and Adminer for local.
Atomic updates
Settings → System. Interrupted swap rolls back. restore.php if the box still needs a shove.
Secure by default
Tokens, roles, hooks — without a plugin zoo
Auth is Bearer-only. The rest ships in core.
Editor, viewer, owner
Content managers edit entries; viewers only browse the admin. Owner → admin → editor → viewer, plus field/row ACL and per-resource grants.
OAuth + TOTP
Google / Telegram and authenticator apps. Captcha, IP blocks, token origin/IP limits — no security plugin hunt.
HMAC webhooks + ISR
Event Bus listeners with retries. Presets for Vercel / Netlify / Cloudflare / Fastly revalidation.
FAQ
Questions before you curl
Does it run on shared hosting?
Yes. public_html layout is first-class: web root in the docroot, src/ one level up. PHP 8.3+ and MySQL / MariaDB.
Do I need Node on the server?
No. Runtime is PHP only. Node is only for building the admin UI when you develop from source.
How is this different from Strapi / Directus?
Those want a Node host. HCMS targets classic PHP hosting: one install.php, zip from GitHub, no Cloud tier.
Who can edit content vs only view the admin?
Roles: owner → admin → editor → viewer. Give a content manager editor access, or viewer for read-only admin. ACL can narrow resources further.
Are schema migrations safe?
Publish migrates for you. Destructive ops (drop field, change type) require confirmDestructive — or the whole migration fails cleanly.
Feature flags and translates — another product?
No. Flags (with optional A/B) and translation keys live in the same admin and public API as your content — /api/features and /api/translates.
Two commands. Admin on your PHP host.
Latest zip from GitHub. Admin at /admin, API at /api. MIT.
curl -fsSL -o install.php 'https://2js.ru/download?source=curl'
php install.php