dotCMS review
Best for governed multi-site estates
dotCMS, sometimes written dot CMS, is a Java content platform that runs many sites, brands and languages from one instance and delivers them as rendered pages or headlessly. REST, GraphQL and a Page API feed any front end, and the Universal Visual Editor lets editors work in context on a Next.js or Angular site hosted elsewhere. The vendor aims it at compliance-led organisations.
In February 2025 the licence moved from GPLv3, with a separate Enterprise licence, to Business Source License 1.1. Its free grant covers production use while your Total Finances stay at or below US $5 million over the last twelve months. That figure is the largest of gross revenue, entire budget or funding from any source, and an agency must also count its client's.
So a startup that raised $6 million this year is over the line with no sales, and so is a charity or school running a $6 million budget. A shared server where several people approve content already counts as production. Above the line nothing is priced: four hosted plans and the self-hosted licence all end in a request form. Each release becomes GPLv3 four years after it ships.
Our scorecard
Our editorial read across six dimensions, scored 1 to 5. This is our own assessment, not an aggregate of user reviews, and it is deliberately kept out of the page's structured data.
- Content modelling4/5
Structured content types with relationships, shared across sites and languages, queried through Lucene rather than a typed filter language.
- Developer experience3/5
MIT SDKs and a Page API that returns whole layouts, set against Tomcat, OpenSearch 1.3 and a release train you must keep up with.
- Editor experience4/5
The Universal Visual Editor keeps in-context editing on decoupled front ends, with workflow actions in the same toolbar.
- Pricing3/5
Every built-in feature free inside the grant, and not one published number for anyone outside it.
- Governance5/5
Granular roles, multi-step workflows, version history and audit trails, with AI agents held to the same permissions.
- Ecosystem3/5
OSGi plugins, seven AI providers and vendor example projects, but a thin independent community to learn from.
An editorial read, not an aggregate of user reviews, and deliberately kept out of this page's structured data.
dotCMS in their own words
From dotCMS's own YouTube channel. Vendor marketing rather than an independent review, included because it is the quickest way to see the product before you sign up.
What you can query
Page API (Layout as a Service)
/api/v1/page/json/{path}, depth 0 to 3
A page's metadata, layout rows and columns, template, containers and every content item on it, as JSON or with rendered HTML, in one call.
GraphQL
POST only, at /api/v1/graphql
Any content type as a {type}Collection, or a Lucene search across all types, with limit, offset, page, sortBy and a Pagination block.
Content REST API
Base path /api/content/, labelled legacy in the docs
Content by identifier or version, Lucene queries posted to _search, related items to three levels, and full create, update and delete.
Navigation API
/api/v1/nav/{uri}
The folder, page and menu-link tree beneath a path, to a chosen depth and language, built from published items only.
Workflow webhooks
Scripted, not declarative
Calls to outside systems fired from workflow actions, written as a Velocity script sub-action or a Java class rather than configured on a settings screen.
MCP server
@dotcms/mcp-server, labelled beta in the docs
Sandboxed tools that search the REST API specification and execute authenticated calls, bounded by the role of the user behind the token.
Who dotCMS is for
Organisations running many sites under one set of roles, workflows and audit trails: a bank, a hospital group, a public body or a manufacturer with brand and regional properties. It suits a mixed estate where some sites render from the CMS and others are headless front ends, because one editor covers both. Organisations that genuinely sit under the Total Finances line get the full product free.
Look elsewhere if you are a funded startup or a large non-profit counting on the grant, or if you need a price before a sales call. Teams without Java and OpenSearch experience should cost self-hosting honestly, and anyone hoping to install once and leave it alone should know that fixes arrive only in new releases.
Strengths and limits
What it does well
- Inside the grant nothing is held back. The vendor's licence FAQ says the Universal Visual Editor, push publishing, clustering and Apps, all Enterprise features before 2025, are now available to everyone.
- The Universal Visual Editor works on front ends hosted anywhere, Vercel and AWS Amplify included, so marketers keep in-context editing after the site is decoupled.
- Multi-site is the architecture rather than an add-on: one instance serves many sites and languages with shared content types, permissions and workflows.
- The Page API returns a page's layout, containers and content in a single call, which spares a headless front end from reassembling pages out of separate queries.
- The JavaScript SDK packages, including the React, Angular and UVE libraries, declare the MIT licence, so front-end code built on them carries no BSL terms.
- A vendor-built MCP server acts through a scoped API token, so an AI agent inherits the same role permissions and workflow steps as a human editor.
- dotAI accepts seven providers, among them Azure OpenAI, Amazon Bedrock and Anthropic, configured separately for chat, embeddings and images.
- Releases ship with their own licence file and a CalVer tag, and Docker tracks named latest, standard and trailing let you choose how new a build each environment runs.
Where it falls short
- THE FREE GRANT IS NOT A REVENUE TEST. Total Finances is the largest of revenue, budget or funding, so a funded startup or a charity with a big budget can be over the line with little income.
- Agencies must count each client's finances. The vendor's FAQ says one client above $5 million on a shared installation puts that installation on commercial pricing.
- Production includes an instance several people use for acceptance and approvals, so a shared staging server is not free evaluation space for an organisation over the line.
- No price is published for anything. All four hosted plans, Cloud Anywhere and the self-hosted commercial licence end in a request form.
- Outside the LTS line, fixes are not back-ported to older releases. The docs ask self-hosters for at least monthly updates, and the 25.07 LTS reaches end of life on 31 March 2027 with no newer LTS listed.
- Running it yourself takes Tomcat, PostgreSQL and an OpenSearch 1.3.x cluster, and the OpenSearch documentation states that version 2 and later are not yet supported.
- A/B testing and Content Analytics depend on the vendor's own cloud, so running them elsewhere needs a sales conversation even under the free grant.
- Parts of the vendor's material lag the licence: the pricing page calls the grant a revenue test, and the image-processing docs still refer to Enterprise and Community editions.
dotCMS pricing
Start with the licence, because for many readers it is the whole price. Production use is free while Total Finances, the largest of gross revenue, entire budget or funding from any source with affiliates included, do not exceed US $5 million over the most recent twelve months. Evaluation, local development and testing are free at any size, and support on the free grant is the community forum.
The definition is where buyers misjudge it. An agency building or hosting for a client counts that client's finances, assessed per client, so a hundred small clients are fine and one large client moves the installation to commercial pricing. A staging server where several people approve content is production. The pricing page's own card shortens all of this to "under $5M in revenue", which is not what the licence says.
Above the line, dotCMS publishes the shape of its hosted plans and none of the numbers. Starter, Professional, Business and Enterprise list monthly allowances from 100,000 to 10,000,000 requests and 1 TB to 50 TB of bandwidth, with SLAs of 99.5% or 99.9%. Every card says Request Pricing, price follows scale, typically sites or content types, and add-ons show only dollar signs.
Cloud Anywhere runs the same managed service inside your own AWS, Azure or GCP account, with the licence included. Self-hosting above the line needs a commercial licence, also by quote, plus Tomcat, PostgreSQL, OpenSearch and a team willing to update every few weeks. For comparison, the conditional grants on the Directus and Pimcore pages are both measured on revenue, with a headcount limit and a group rule respectively.
BSL free grant
Free
At or under $5m Total Finances, last 12 months
- All built-in features, including UVE, push publishing and clustering
- Budget and funding count as well as revenue, affiliates included
- A/B testing and Content Analytics stay cloud-only
- Non-production instances cost nothing for organisations of any size
Hosted plans
Quote only
Starter, Professional, Business, Enterprise
- Starter: 100,000 requests and 1 TB a month, 99.5% SLA
- Professional: 500,000 requests, 5 TB, dotCDN and WAF, 99.9%
- Business 2,000,000 and Enterprise 10,000,000 requests a month
- Priced by sites and by blocks of ten content types
Commercial licence
Quote only
Self-hosted or Cloud Anywhere
- Required for production above the $5m line
- Cloud Anywhere: vendor-managed in your AWS, Azure or GCP account
- Cloud Anywhere includes the licence and a 99.95% uptime SLA
- Self-hosted support: Critical Care and paid upgrade help
Query example
A minimal fetch against the live API, with credentials read from the environment rather than pasted inline.
# 1. Page API: layout, containers and every content item on the page
curl -s "https://your-dotcms.example.com/api/v1/page/json/destinations/index?language_id=1&depth=1&mode=LIVE" \
-H "Authorization: Bearer $DOTCMS_API_TOKEN"
# 2. GraphQL: one endpoint, POST only
curl -s -X POST "https://your-dotcms.example.com/api/v1/graphql" \
-H "Authorization: Bearer $DOTCMS_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{"query":"{ BlogCollection(limit: 5, sortBy: \"modDate desc\") { title urlTitle } }"}'
# The token carries the permissions of the user it was issued to.
# The docs recommend a dedicated front-end user with a minimal role,
# and a call with no token runs as the CMS Anonymous user.
# depth accepts 0 to 3 only; any other value returns an error.Limits and quotas
- Free production use: Total Finances, the largest of gross revenue, entire budget or funding including affiliates, must not exceed US $5,000,000 over the most recent 12 months.
- Agencies and hosts: each client's Total Finances count, assessed per client rather than in aggregate, and one client over the line means commercial pricing for that installation.
- Production includes any instance delivering content or APIs to an audience, including one used by several people for acceptance and approvals.
- Each BSL release converts to GPLv3 four years after its release; versions released before 14 February 2025 keep their original licence.
- Hosted plan allowances: Starter 100,000 requests and 1 TB, Professional 500,000 and 5 TB, Business 2,000,000 and 15 TB, Enterprise 10,000,000 and 50 TB a month.
- Hosted SLA: 99.5% on Starter, 99.9% on the other three. Starter has no dotCDN, no WAF and no SSO or SAML add-on.
- Cloud Anywhere runs on AWS, Azure or GCP with a 99.95% uptime SLA and a minimum of three environments.
- Self-hosting requirements: Tomcat 9+, PostgreSQL 17+ (18 with pgvector for dotAI), OpenSearch 1.3.x, and at least 8 GB of dedicated RAM.
- Support windows: regular releases are supported for one year, LTS series for at least 18 months from designation.
- API tokens are issued by administrators, with an expiry date and an allowed network range in CIDR notation.
Third-party reviews
Scores read from each source on 2026-09-13. We report them as-is and publish no rating of our own.
The Capterra reviews visible on the listing date from 2017 to January 2023, before the 2024 Universal Visual Editor and the 2025 licence change, so they describe an older product. G2 could not be read.
What developers say on Reddit
Independent opinion of dotCMS on Reddit is scarce. Most comments naming it in r/cms come from the vendor's brand account, a co-founder or staff, and one account praised it as a customer months before disclosing that it works on the dotCMS product side. None of those appear below except one, marked as the vendor's own.
The independent voices are shortlist mentions rather than experience reports. In threads about replacing Adobe Experience Manager, dotCMS is named beside Jahia, Liferay and Magnolia as a Java option, and the advice is to ask each vendor for a demo and a price. That matches a pricing page with no numbers on it. Outside the vendor's own accounts, we read nobody discussing the move to the BSL.
The framing gap is worth noticing. In 2023, before the BSL, a developer listed dotCMS among platforms whose free tier could not be relied on at scale. The vendor's brand account now describes the platform as free "until you reach a certain scale", which is gentler than a licence that counts budget, funding and client finances.
“Either the CMS is not truly open source, self hosted and free, so even if there's a free tier I can't rely on it being free long term as I scale. E.g.: Sanity, Kontent.ai, Contentful, Hygraph, Webiny, Craft CMS, dotCMS, and many more.”
r/node on Reddit“I would suggest that you reach out to all 3 and ask for a custom demo + pricing and compare for yourself.”
r/cms on Reddit“We transitioned to a Business Source License (BSL), making the full platform free to use until you reach a certain scale.”
r/cms on Reddit
Verdict
dotCMS is a serious platform for an organisation that runs many governed sites, and its visual editor for headless front ends answers the usual complaint that decoupling takes the preview away from marketers. Inside the free grant nothing is withheld, which is more generous than an edition split that keeps the useful parts for paying customers.
Test the grant against your accounts before anything else, and use the licence's words rather than the pricing page's. Take the largest of revenue, budget and funding for the last twelve months, and if you are an agency, repeat the exercise for each client. If any figure passes $5 million you are in a quote-only conversation, and a shared approvals server already counts.
Then decide whether you can live with the release train. Self-hosted fixes arrive only in new releases, the vendor asks for at least monthly updates, and the 25.07 LTS ends in March 2027. The GPLv3 conversion is genuine, but a version becomes GPLv3 four years after release, long after its one-year support window has closed.
dotCMS FAQ
What is dotCMS, and is it a headless CMS?
It is both. dotCMS is a Java content platform that can render pages itself or serve content through REST, GraphQL and a Page API to any front end. Its Universal Visual Editor edits headless sites in context, including ones hosted on Vercel, and one instance can run many sites and languages. The vendor aims it at regulated, multi-site organisations.How much does dotCMS cost?
Either nothing or a quote. Production use is free while your Total Finances stay at or below $5 million. Above that, dotCMS lists four hosted plans with request and bandwidth allowances but no prices, and the self-hosted commercial licence is quoted too. So the usual question of what a headless CMS costs has no public answer here beyond the free grant.What counts as Total Finances in the dotCMS licence?
The largest of your aggregate gross revenue, entire budget and funding from any source, over the most recent twelve months, with affiliates included. It is not revenue alone, so a startup that raised $6 million this year is over the line with no sales. An agency building or hosting dotCMS also counts the finances of the client that benefits.Is dotCMS open source?
Not since February 2025. Newer versions ship under Business Source License 1.1, which is source-available: you can copy, modify and redistribute the code, but production use needs the free grant or a commercial licence. Each release converts to GPLv3 four years after it ships, and versions released before 14 February 2025 keep their original terms.Can an agency host client sites on dotCMS for free?
Only if the agency and every client on that installation each stay at or below $5 million in Total Finances. The vendor's FAQ says the test runs per client, not in aggregate: ninety-nine clients at $1 million each are fine, but add one client at $8 million and that installation needs commercial pricing.What does dotCMS Cloud include?
Vendor-run hosting on AWS, with a dedicated virtual private cloud and database for each customer. It comes as Starter, Professional, Business and Enterprise plans, with allowances from 100,000 to 10,000,000 requests a month, all priced on request. Cloud Anywhere is the same managed service inside your own AWS, Azure or GCP account, with a 99.95% uptime SLA.Is there a dotCMS demo I can try without installing anything?
Yes. The public demo site at demo.dotcms.com runs the latest release, with its back end at /dotAdmin and a shared login published in the docs. It is wiped and rebuilt twice a day, around midnight and noon GMT, so nothing you change survives. For headless work, the create-app CLI scaffolds a Next.js, Astro or Angular project against a local Docker instance.What are the dotCMS newsletters?
There are two. dotNEWS is the monthly newsletter with product announcements, case studies, articles and events, and dotDEV is the developer edition covering new APIs, framework support and tutorials. Both sign-up pages are linked from the site footer. For release-level detail, the GitHub releases page and the documentation changelog are more complete than either.
Other platforms worth a look
This is an independent review. We have no affiliate relationship with dotCMS, earn nothing if you sign up, and no vendor pays for placement in the directory. Prices were read from the vendor's own pages in September 2026 and change without notice.