Publii

Last reviewed Sep 13, 2026 · 893 words

Publii is the CMS that runs on your laptop instead of your server. You write posts in a desktop app with a WordPress-shaped interface, it generates a static site, and it uploads the result over SFTP, to S3, to GitHub Pages, to Netlify, or into a Git repository. Your server, if you have one, serves HTML files and nothing else: no PHP, no database, no admin login to attack. For a single author who wants a blog that cannot be hacked and does not require learning a static site generator's templating language, it is the most approachable option in the blogging category. For a team, it is the wrong tool, and that limit is structural.

Where it sits in a self-hosted stack

The mental model is that the desktop app is the CMS and the server is a file share. Publii keeps each site's content in a local SQLite database and a folder of media and theme files, all under its own data directory. Hitting Sync renders the site and pushes only the changed files to the target. On the hosting side, a self-hoster's natural target is SFTP to a directory served by Caddy or static-web-server: a Caddy site block for a static root is 3 lines including automatic TLS, and the whole hosting footprint is a few megabytes of RAM. Because output is plain files, the same site can be pushed to a VPS and mirrored to a Git host as a backup with no changes.

There is no server component to update, which is the security argument in one sentence. WordPress's attack surface is the login page, the plugin ecosystem, and PHP; a Publii site has none of those. The Core Web Vitals for static sites piece covers why the same choice also makes the performance work almost free.

What it is not

Publii is single-author by design. The content database lives on one machine, and while you can move the data directory to a synced folder to work from two computers, two people editing concurrently will corrupt it. There is no headless API, no user accounts, no comment system (it integrates with Disqus and a few alternatives client-side), no search beyond a client-side index, and no dynamic anything. Forms need a third-party endpoint. If you want authors, roles, scheduled publishing on the server, or an editorial workflow, Ghost is the self-hosted tool for that, at the cost of running Node and a database. If you want static output but with the full power of templates and build pipelines, Hugo is the bigger project and the one most technical writers land on; the trade is a text editor and a command line instead of a GUI.

Themes and the WordPress-like editing

Publii ships with a handful of free themes and sells more, and the theme system is Handlebars templates with a visual settings panel per theme, so colours, layouts, and menus are clicked rather than coded. The editors are a WYSIWYG block editor, a Markdown editor, and a plain block editor, per post. Tags, authors, featured images, excerpts, and SEO fields (title, description, canonical, Open Graph) are all form fields. It also generates a sitemap, RSS feed, and structured data without configuration, which is more than most static generators do out of the box. Non-developers get further with it in an afternoon than they would with a week of Hugo.

Migration in and out

There is a WordPress importer that takes the standard WXR export and brings posts, pages, tags, and media across; expect to fix internal links and shortcodes by hand. Going the other way, the output is HTML, so any site can be crawled or copied, but there is no Markdown-with-front-matter export that another generator would read directly. That is the lock-in to be aware of: the content is on your disk in SQLite, which is far better than a hosted platform, but leaving Publii for Hugo means a conversion script. Back up the data directory, not just the published site, because the published site cannot be edited.

Who actually runs it

The typical user is a solo blogger, a photographer with a portfolio, a small club or church that needs 10 pages and a news section, or a self-hoster who is tired of patching WordPress for a site that changes twice a month. GPL-3.0, 7,296 stars, built on Electron for Windows, macOS, and Linux. It is stable and unhurried, with releases a few times a year. It is not a tool for a company blog with 4 contributors, and it is not what you want if you already live in a terminal; WriteFreely or Hugo suit those users better.

What I'd do

For a single author who does not want to learn a build tool, install Publii, pick a free theme, point Sync at an SFTP account on a small VPS running Caddy, and add the data directory to your regular backup. Push the output to a Git repository as a second target so the site is recoverable even if the laptop dies. The moment a second regular author appears, move to Ghost and treat Publii as having done its job.