TY

Typecho

Lightweight, fast blogging program

Blogging Platforms ★ 12.4k stars Easy setup GPL-2.0

Typecho is an open-source blogging platform written in PHP, focused on being simple, lightweight, and fast. It is especially popular among developers in the Chinese-speaking community.

Key features

  • Lightweight and fast
  • Markdown support
  • Plugin and theme ecosystem
  • Simple installation

Pros & cons

Strengths

  • Very lightweight
  • Clean codebase

Trade-offs

  • Documentation mostly in Chinese
  • Smaller global community

Is Typecho secure?

1 known vulnerability affects Typecho's latest release (v1.3.0) according to OSV.dev; the most severe is rated medium.

Affecting v1.3.0

AdvisorySeveritySummary
CVE-2024-35539MediumTypecho v1.3.0 was discovered to contain a race condition vulnerability in the post commenting function.
1 unconfirmed match

OSV.dev links these advisories to this release, but their own version data doesn't confirm it: they cover a separately versioned sub-package of the repository, or record the fix only as a commit. They are listed for completeness and not counted in the health score.

Matched by OSV, not confirmed

AdvisorySeveritySummary
CVE-2024-35538MediumTypecho v1.3.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifying an arbitrary IP as value of X-Forwarded-For or Client...
  • Most recent fixed advisory CVE-2024-46494, published 2025-04-07 (555 days ago)

Source: OSV.dev, checked 2026-10-14. How this is measured.

Typecho replaces

Health badge

Maintain Typecho? Add its health score to your README. The badge links back to this page.

SelfHostIndex: 82 · excellent

Markdown
[![SelfHostIndex health score for Typecho](https://selfhostindex.com/badge/typecho.svg)](https://selfhostindex.com/app/typecho/)
HTML
<a href="https://selfhostindex.com/app/typecho/"><img src="https://selfhostindex.com/badge/typecho.svg" alt="SelfHostIndex health score for Typecho"></a>
reStructuredText
.. image:: https://selfhostindex.com/badge/typecho.svg
   :alt: SelfHostIndex health score for Typecho
   :target: https://selfhostindex.com/app/typecho/

The score is recomputed on every nightly rebuild from public repository data — see how it is calculated.

Last reviewed Aug 26, 2026 · 752 words

A Typecho blog runs on 128 MB of RAM, a single SQLite file and any web server that speaks PHP, installs through a 3-screen wizard, and has been doing exactly that since 2008. It is the lightest "real" blogging platform I know that still has an admin panel, comments, Markdown editing and a theme and plugin system, and it is the one I point at when someone says WordPress is too much and Hugo is too little. The catch is in the listing's cons and it is not small: the documentation and most of the community are in Chinese. If you can read it, or are comfortable with a translator open in another tab, read on.

The documentation caveat, up front

The official site, the docs and the plugin and theme directories are Chinese-first. Machine translation of the docs is fine for the install and the settings; it is the plugin descriptions, forum threads and error messages from third-party themes that will make you work. English-language posts about Typecho exist but are thin. This is the whole reason a project with roughly 12,400 stars and 18 years of history is a footnote outside China, and I would rather you know that in paragraph two than after an evening of guessing what a config option does.

Install: a PHP host, a database, three screens

Download the release archive, unpack it into a directory your web server serves, and open it in a browser. The wizard asks for a database (SQLite is a file inside the install and the right choice for a personal blog; MySQL and PostgreSQL are there for busier sites), a site name and an admin account, and you are done. The requirements are a current PHP with the usual extensions (mbstring, curl, the database driver) and a rewrite rule for clean URLs if you want them, which the admin panel tests for you. A Caddy site block is 4 lines:

blog.example.com {
    root * /var/www/typecho
    php_fastcgi unix//run/php/php-fpm.sock
    file_server
}

Community Docker images exist and work, but there is no official one at last check; I would rather run PHP-FPM on a small VPS or in a generic PHP container than depend on a stranger's image for a blog I want to still work in 5 years. Back up the SQLite file and the usr/ directory (themes, plugins, uploads) and you have the whole site.

Writing: Markdown in, HTML out, nothing in between

Posts are written in Markdown with a plain editor, no block builder. Pages, categories, tags, drafts, scheduled posts, native comments with moderation and anti-spam hooks, custom fields, and an XML-RPC endpoint for desktop clients are all in the box. Themes are PHP templates you can read in one sitting, which matters: when the theme you picked has a bug, fixing it is 10 minutes with a text editor rather than a support ticket. Plugins hook into the same simple event system. The default theme is plain; you will want one from the community directory, and the good ones are very good.

Against WordPress, Ghost and Hugo

WordPress does everything and costs you a heavier footprint, a database server, a plugin update treadmill and a security surface that needs watching. Ghost is the better-looking membership-and-newsletter product and needs Node plus MySQL. Hugo is a static generator with no admin panel, no comments and no server; it is what I use for sites that change monthly. Typecho sits between them: a dynamic site with an editor and comments, on the hosting requirements WordPress had before WordPress got heavy. The CMS category has the full field. On raw speed it is not close; a Typecho page renders in single-digit milliseconds on shared hosting without any cache plugin.

What I'd do

If you read Chinese, or are the kind of person who enjoys reading PHP templates and does not mind translated docs: Typecho on a 1 GB VPS with Caddy and PHP-FPM, SQLite, a community theme you have read the source of, a comment anti-spam plugin, and a nightly copy of the database file and usr/ to somewhere else. Expect it to run untouched for years. If you cannot face the language gap, take Ghost for a writer's blog or Hugo for a developer's, and keep Typecho in mind for the day a client asks for "WordPress, but small".

Compare Typecho

31 head-to-head comparisons.

Similar blogging platforms apps