Ghost review
Best for publishing and newsletters
Ghost is the only entry in this directory that is a publishing product first and a headless CMS second, and that ordering explains everything about it. Memberships, paid subscriptions, email newsletters and an editor built for long-form writing are all in core rather than bolted on, and the MIT licence is unconditional in a way Strapi's is not. If you are building a publication, this is the shortest route from nothing to a paid newsletter.
Used headlessly, you get a Content API for reading and an Admin API for writing, over six resources: posts, pages, tags, authors, tiers and settings. That list is the product's philosophy made concrete. It models publishing extremely well and it does not model anything else, so a product catalogue, a component-based landing page or arbitrary structured content are all fights you will lose.
Anyone self-hosting needs to read the security section below before doing anything else. CVE-2026-26980 was a critical unauthenticated SQL injection in the Content API itself, present from v3.24.0 to v6.19.0 and fixed in 6.19.1. It was exploited at scale. Ghost(Pro) customers were patched by the vendor; self-hosters were not, and the practitioner complaint was that the patched Docker image lagged the release.
Our scorecard
Our editorial read across six dimensions, scored 1 to 5. This is our own assessment, not an aggregate of user reviews, and it is deliberately kept out of the page's structured data.
- Content modelling2/5
Six fixed resources and no custom content types. Superb for articles, useless for anything else.
- Developer experience4/5
A small, clean, well-documented API you can learn in an hour. Nothing to configure and little to get wrong.
- Editor experience5/5
The best writing environment here. Nobody has to be taught how to use it.
- Pricing5/5
Free self-hosted under a real MIT licence, and $15 a month hosted. Nothing else here is this cheap.
- Governance2/5
Staff roles and little else. No workflows, no localisation, no environments.
- Ecosystem4/5
Thousands of integrations and a large theme community, all aimed squarely at publishing.
An editorial read, not an aggregate of user reviews, and deliberately kept out of this page's structured data.
What you can query
Content API
/ghost/api/content/, key as a query parameter
Read-only access to posts, pages, tags, authors, tiers and settings, with browse and read endpoints by id or slug.
Admin API
Server-side only, never in a browser
Read-write access for creating and updating posts, uploading images and managing members, authenticated with a signed token rather than a public key.
Members and subscriptions
The reason to choose Ghost at all
Signup, tiers, paid subscriptions and Stripe integration, so the paywall is part of the platform rather than an add-on.
Newsletters
Bulk email included in Ghost(Pro)
Email delivery to your member list from the same editor and the same post, which nothing else in this directory does natively.
Webhooks
The usual ISR or rebuild trigger
Events on publish, update and member changes, which is how a static front end knows to rebuild.
Themes
Custom themes need the Publisher plan
Handlebars themes for the built-in front end, which you ignore entirely when using Ghost headlessly.
Who Ghost is for
Publications, newsletters and content-led businesses where the product is writing. Ghost gets you a site, a member list, a paywall and an email newsletter from one install, and the editor is good enough that nobody needs training. Used headlessly, the Content API is small enough to integrate in an afternoon.
It is the wrong tool the moment you need content types of your own. Six fixed resources with no custom modelling is a hard ceiling, not a starting point, and teams who choose Ghost for a marketing site with varied page types end up fighting it within weeks.
Strengths and limits
What it does well
- A genuinely unconditional MIT licence from the Ghost Foundation, with none of the cloud-account or competing-use carve-outs that qualify other open-source claims in this directory.
- Memberships, paid subscriptions and email newsletters are in core, so the whole commercial stack for a publication comes from one install.
- The best writing and editing experience here, and the one least likely to need an editor training session.
- A small, clean Content API over six resources that a developer can learn in an hour, fully cacheable and documented as having no request limits.
- The cheapest credible hosted option in this directory at $15 a month, and free forever if you self-host.
- Runs on modest infrastructure with MySQL or SQLite, so self-hosting is genuinely accessible rather than an enterprise project.
- A non-profit foundation owns it, which is a different set of incentives from every venture-backed platform on this list.
Where it falls short
- CVE-2026-26980: a CVSS 9.4 unauthenticated SQL injection in the Content API, present from v3.24.0 to v6.19.0 and exploited at scale before the fix in 6.19.1. Self-hosters had to patch themselves.
- Six fixed resources and no custom content types at all. This is the single biggest constraint and it does not move.
- No localisation, no workflows and no environments, so it is not a fit for a multi-market or governed content operation.
- Custom themes require the Publisher plan, so the $15 Starter tier is the default theme only.
- Ghost(Pro) pricing scales with member count on every tier, so a successful newsletter costs progressively more.
- No MCP server, which is now a visible gap against most of this directory.
- Self-hosting means you own the patch cycle, and the Docker image lagging the security release is a documented practitioner complaint.
- Teams report hitting walls on anything outside publishing, such as adding commerce, without embedding third-party widgets.
Ghost pricing
Self-hosting is free under a plain MIT licence and there are no vendor limits on members, staff, posts or requests. You provide Node and MySQL, and you own the upgrade and patch cycle, which after CVE-2026-26980 should be read as a real obligation rather than a formality.
Ghost(Pro) starts at $15 a month billed yearly for 1,000 members, the default theme and a newsletter. Publisher at $29 adds three staff users, custom themes, paid subscriptions, advanced analytics and the integration catalogue. Business at $199 brings 15 staff users, 10,000 members, priority support and early access. Custom adds unlimited staff and members, a dedicated IP and a 99.9% uptime SLA.
The important mechanic is that Ghost(Pro) pricing scales with your member count rather than sitting flat. The quoted prices are the entry points for a small list, and the same plan costs more as the list grows, which is the opposite of how most of this directory bills and is worth modelling against your growth rather than your launch.
The honest way to frame the hosted premium is as a managed security subscription. $15 a month against a self-hosted install is not buying features, it is buying somebody else applying the patch on the day it ships.
Self-hosted
Free
MIT, unconditional
- No seat, member, request or entry limits from the vendor
- You run Node and MySQL, and you own the patching
- The MIT grant has no cloud-account or competing-use carve-out
- CVE-2026-26980 is your responsibility, not Ghost's
Ghost(Pro) Starter / Publisher
$15 / $29 / mo
Billed yearly, priced by member count
- Starter: default theme only, 1,000 members, newsletter
- Publisher: 3 staff users, custom themes, paid subscriptions
- 8,000+ integrations and advanced analytics on Publisher
- The vendor patches security for you, which is the real value
Ghost(Pro) Business / Custom
$199 / mo or custom
15 staff users, 10,000 members
- Priority support, higher usage limits, early feature access
- Custom adds unlimited staff and members
- Dedicated IP address and a 99.9% uptime SLA
- Prices rise with your member count on every tier
Query example
A minimal fetch against the live API, with credentials read from the environment rather than pasted inline.
curl -s -G "https://your-site.ghost.io/ghost/api/content/posts/" \ --data-urlencode "key=$GHOST_CONTENT_API_KEY" \ --data-urlencode "limit=10" \ --data-urlencode "include=tags,authors" \ --data-urlencode "fields=title,slug,published_at,excerpt" # The key goes in the query string on purpose: it is a public, # read-only content key and Ghost documents it as safe for # browsers. The Admin API is the opposite and must stay # server-side. # # Self-hosting? Confirm you are on 6.19.1 or later first. # CVE-2026-26980 was an unauthenticated SQL injection in this # exact API's slug ordering.
Limits and quotas
- Content API resources are fixed: posts, pages, tags, authors, tiers and settings. No custom types.
- No rate limits are documented on the Content API, which is described as fully cacheable.
- Content API keys are public and read-only by design, passed as a query parameter.
- Ghost(Pro) Starter: 1,000 members, default theme only.
- Ghost(Pro) Publisher: 3 staff users, custom themes, 1,000 members at the base price.
- Ghost(Pro) Business: 15 staff users, 10,000 members.
- A 99.9% uptime SLA and dedicated IP are on the Custom tier only.
- Self-hosted installs need Node.js plus MySQL or SQLite, and there are no vendor-imposed limits.
What developers say on Reddit
Ghost is well liked for what it does and the criticism clusters in two places, one of them serious.
The serious one is CVE-2026-26980. The r/selfhosted thread that surfaced it is less angry about the bug than about two things around it: that the vulnerable code sat in the Content API from July 2020 to February 2026, and that the fixed release landed before the fixed Docker image did. For a project whose self-hosting story is a headline feature, the second point lands hard.
The other criticism is the ceiling. Users who chose Ghost for a blog and later wanted something else, a shop page being the recurring example, describe running out of platform quickly and having to embed third-party widgets. Nobody frames this as a bug, and it matches what the six-resource API tells you up front.
“This vulnerability is present in Ghost v3.24.0 to v6.19.0. 3.24.0 was released on Jul 10, 2020, so it's been nearly 6 years that this vulnerability has been out there. This wasn't some new regression introduced recently.”
r/selfhosted on Reddit“It's concerning to me that this kind of code ever made it to the production branch. [...] I don't often criticise the work of open source teams but this is embarrassing to leave in.”
r/selfhosted on Reddit“This is exactly why the "just use Docker" advice needs a massive asterisk. Docker images from upstream projects are often an afterthought, not a first-class deliverable.”
r/selfhosted on Reddit“I initially launched my blog with ghost, but quickly moved off when I found it nearly impossible to make certain changes that I found simply basic. [...] you can't add a shop page to your blog without embedding third party”
r/selfhosted on Reddit
Verdict
If you are building a publication, Ghost is the right answer and the decision is quick. Nothing else here gives you writing, memberships, a paywall and a newsletter from one MIT-licensed install, and nothing else is close on price. Used headlessly it is a small, clean API that gets out of the way.
The six-resource model is the whole risk. It is not a limitation you grow out of with a plugin, it is the shape of the product, so if there is any chance you will need custom content types, choose something else now rather than migrating later.
On hosting, be honest about who patches. CVE-2026-26980 sat in the Content API for five and a half years, was exploited at scale, and was a version bump for Ghost(Pro) customers and a manual job for everyone else. If nobody on your team owns dependency updates, the $15 a month is not a hosting fee, it is the cheapest security contract in this directory.
Ghost FAQ
How much does Ghost cost?
Self-hosting is free under MIT. Ghost(Pro) is $15 a month billed yearly for 1,000 members and the default theme, $29 for custom themes and paid subscriptions, and $199 for 15 staff users and 10,000 members. Prices rise with your member count on every tier.What was CVE-2026-26980?
A critical unauthenticated SQL injection in Ghost's Content API, rated CVSS 9.4. A crafted payload in a slug filter or ordering parameter allowed blind reads of any table, including admin credentials, password hashes, session secrets and Admin API keys. It affected v3.24.0 to v6.19.0 and was fixed in 6.19.1.Am I affected if I use Ghost(Pro)?
Ghost(Pro) customers were patched by the vendor, which is the clearest argument for the hosted plan that exists. Self-hosted installs had to be upgraded manually to 6.19.1 or later, and the practitioner complaint at the time was that the patched Docker image lagged the release itself.Can Ghost handle custom content types?
No. The Content API exposes six fixed resources: posts, pages, tags, authors, tiers and settings. There is no way to define your own, so anything that is not an article, a page or a taxonomy has to be modelled awkwardly or handled elsewhere. It is the single biggest reason not to choose Ghost.Is Ghost genuinely open source?
Yes, and unusually cleanly. The LICENSE file is a plain MIT grant from the Ghost Foundation with no enterprise-directory carve-out, no cloud-account condition and no competing-use restriction. Among the self-hostable options in this directory that is the least qualified open-source claim on offer.Does Ghost work as a headless CMS?
Yes, and the Content API is well suited to it: read-only, fully cacheable, no documented rate limits, and a public key that is safe to use from a browser. You ignore the Handlebars theme layer entirely and render with whatever front end you like.Does Ghost have an MCP server?
No, and it is now one of the few platforms here without one. If agent-managed content matters to your roadmap, that is a real gap against Strapi, Storyblok, Contentful and Sanity, all of which ship one.Ghost or a general headless CMS?
Ghost if the content is genuinely articles and you want memberships and email in the box. A general headless CMS if you need custom content types, localisation, workflows or environments. The two are not really competing: Ghost is a publishing business in a box, and the others are content infrastructure.
Other platforms worth a look
This is an independent review. We have no affiliate relationship with Ghost, earn nothing if you sign up, and no vendor pays for placement in the directory. Prices were read from the vendor's own pages in September 2026 and change without notice.