Website Review
What is Concrete CMS?
Concrete CMS is a free, open-source content management system built for teams that need to create, edit, and publish web content together. It combines a visual, in-page editing experience with structured roles and permissions, so content creators, designers, and developers can work in one system rather than passing files back and forth.
Who it suits and why
- Content editors get a WYSIWYG editor that works directly on the live page. The site claims editors can become proficient quickly, which matters if non-technical staff publish regularly.
- Larger or regulated teams get role- and group-based access control down to individual content blocks, plus approval workflows, change logs, and version comparison with revert.
- Developers can extend or customize the platform, and the community marketplace offers add-ons for common needs.
- Security-sensitive organizations are the target of the compliance messaging: the site cites ISO 27001-aligned security, SOC 2 and HIPAA-compliant hosting options, and use by the U.S. Army.
Trade-offs to weigh
| Strength | Where it may not fit |
|---|---|
| In-page editing and built-in features reduce reliance on plugins | Teams wanting a fully hosted, zero-maintenance SaaS may prefer a managed platform |
| Granular permissions and approval workflows | Very simple brochure sites may not need that overhead |
| Open source, so you control hosting and customization | You or your host carry responsibility for updates and security patching |
| Compliance-oriented hosting options | Compliance depends on your chosen host and configuration, not the software alone |
Next step
If you are evaluating it, list your must-haves first — number of editors, approval requirements, hosting constraints, and any compliance rules. Then compare Concrete CMS against one or two alternatives on that list. For general CMS comparisons, official sources such as WordPress.org and Drupal can help you frame the open-source options, while Concrete CMS itself is the place to confirm current features and request a demo.
How does Concrete CMS's in-page WYSIWYG editing work for content creators?
Concrete CMS lets content creators edit directly on the live page rather than through a separate admin form. Its page evidence describes this as "WYSIWYG right on your webpage": you browse to a page, enter edit mode, and change text, images, and blocks in place, seeing the result as you go. Because the editor is built around blocks, you edit a specific piece of content — a headline, a text block, an image — instead of a whole page of raw HTML.
For a content creator, the practical workflow looks like this:
- Open the page you want to change and switch into edit mode.
- Click into the block you need (text, image, etc.) and edit it in place.
- Save or publish; the change appears on the rendered page.
The page also claims that built-in features cover most needs without extensions and that editors become proficient quickly. Treat "no extensions needed" as a starting point, not a guarantee — check whether your specific requirements (forms, multilingual, e-commerce) are covered out of the box or need add-ons.
A concrete scenario: a marketing coordinator updates a campaign banner and two paragraphs on a product page. In a block-based in-page editor, that is a few clicks and a save, with no developer involved. The trade-off is that in-page editing is optimized for content changes, not for redesigning layouts or adding new page types — those usually fall to a designer or developer.
H3: Where the surrounding features matter In-page editing works alongside permissions and workflow. The site notes role- and group-based access down to individual blocks, approval workflows, change logs, and version control with compare and revert. That matters if you have several editors: a junior editor can draft, an approver can review, and you can roll back a bad change. If you are a solo editor, you may not need the workflow layer at all.
H3: How to evaluate it for your team Ask three questions:
- Do your editors mainly change existing content? In-page WYSIWYG is a strong fit.
- Do you need approvals and granular permissions? Confirm the workflow matches your process.
- Do you need heavy customization? Check whether your needs are met by core features or require developer work.
For a next step, use the site's demo request to walk through your own content scenario with a real page, and compare against alternatives such as WordPress if broad plugin ecosystems matter to you, or Drupal if complex structured content is the priority.
Can Concrete CMS handle HIPAA or SOC 2 compliance requirements for sensitive industries?
Yes, Concrete CMS is positioned for this. Its own materials state that it offers out-of-the-box ISO 27001 certified security, with SOC 2 and HIPAA compliant hosting, and that tailored hosting can be arranged to meet specific organizational compliance needs. The U.S. Army is cited as a customer chosen for stringent security requirements.
H3 What that means in practice
Compliance is not a property of the CMS software alone. It is a combination of the application, the hosting environment, the configuration, and your organization's policies. Concrete CMS separates these: the platform provides the security and permission model, while compliant hosting is offered or arranged to satisfy SOC 2 and HIPAA obligations.
For a HIPAA context, the practical questions are about business associate agreements, encryption in transit and at rest, audit logging, access controls, and breach procedures. For SOC 2, the focus is on documented controls, monitoring, and evidence over time. Concrete CMS's permission-aware features are relevant here: role and group assignment down to individual content blocks, fine-tuned permissions for features, content approval workflows, change logs, and version control with review, compare and revert. Those support the access-control and audit-trail expectations auditors typically test.
H3 Who this suits
- Regulated teams that need granular editorial permissions and an audit trail without custom development.
- Organizations that want an open source CMS but require a vendor-supported compliant hosting path.
- Public sector or defense-adjacent teams, given the cited U.S. Army use.
H3 Trade-offs and a decision criterion
Compliant hosting usually means higher cost and less flexibility than generic shared hosting, and you remain responsible for your own policies, training and retention rules. If your requirement is strict HIPAA or SOC 2 scope, ask the vendor directly whether a signed BAA is available and which specific hosting tier carries the SOC 2 report; that answer, not the feature list, should drive your shortlist.
A useful next step is to request a demo and state your compliance scope up front, so the response addresses hosting and agreements rather than only editing features. You can compare general positioning with WordPress or Drupal, but confirm compliance documentation with each vendor directly.
How do Concrete CMS permissions and approval workflows compare to other open source CMS platforms?
Concrete CMS treats permissions as a first-class feature rather than an add-on. Its own product page describes role- and group-based access "down to the individual block of text," fine-tuned permissions for any feature, workflow content approvals, change logs, and version compare/revert. That combination is unusual in open source CMS: granularity reaches the page-block level, and editorial workflow ships in the core instead of through third-party modules.
Where the difference shows up
| Capability | Concrete CMS (per its page) | Typical open source CMS pattern |
|---|---|---|
| Permission granularity | Roles, groups, and per-block control | Often page- or content-type-level; block-level needs extensions |
| Approval workflow | Built-in content approvals with change logs | Frequently a contributed module or custom code |
| Version control | Review, compare, revert | Common in core, but not always with approval gating |
| Compliance posture | ISO 27001 security, SOC 2 and HIPAA-compliant hosting options | Varies by host and project; rarely stated by the project itself |
Practical reading of this
The block-level granularity matters most for organizations with mixed contributor groups — for example, a university where department editors own their sections but a central communications team must approve anything on the homepage. Per-block permissions let you grant editing rights narrowly without splitting the site into separate installations. Approval workflows plus version comparison reduce the risk that a bad edit reaches production, which is the usual reason teams bolt workflow tools onto a leaner CMS.
The trade-off is weight. A CMS with granular permissions and workflow in core asks more of whoever sets up the permission model; role sprawl becomes its own maintenance problem. If your site has one or two editors and no approval requirement, that machinery is overhead you will still have to configure and understand.
How to compare against alternatives
Judge candidates on four questions rather than feature lists:
- Can permissions be scoped to the unit your editors actually work in (section, page, block)?
- Is approval workflow in core, or does it depend on a module's maintenance?
- Do version compare and revert exist alongside approvals, or separately?
- Does your compliance requirement (HIPAA, SOC 2) apply to the CMS or to your hosting choice? Concrete CMS points to compliant hosting options; confirm what your own host provides.
If you want a benchmark from a platform with a long-established workflow ecosystem, look at Drupal, and for a widely deployed core with role-based permissions and revision history, WordPress.
Next step
Write down your permission model before evaluating anything: list each editor group, what they may change, and who approves. Then test Concrete CMS against that list in a demo — its own page offers one — and do the same with your second-choice platform. The platform that matches your model with the least custom configuration is the one to pick.
Is Concrete CMS a good fit for enterprise teams that need to manage multiple websites?
Yes, Concrete CMS is a credible fit for enterprise teams managing multiple sites, especially when those teams mix marketers, designers and developers. Its pitch centers on three things that matter at scale: in-page editing, granular permissions and collaboration, and compliance-oriented security. The page explicitly describes role and group permissions that can be tuned "down to the individual block of text," approval workflows, change logs, and version compare/revert — the mechanics multi-site teams actually lean on when several brands or regions share one platform.
Where it fits well
- Multi-editor teams. Editors work with WYSIWYG editing directly on the page, and the page claims editors become proficient quickly, which lowers training cost across many contributors.
- Governed publishing. Workflow approvals, permission tiers and version control suit organizations where regional or brand teams publish under central oversight.
- Compliance-sensitive environments. The page cites ISO 27001 certified security, SOC 2 and HIPAA compliant hosting options, and adoption by the U.S. Army.
- Developer extension. One cited customer, creative director Tim Macknelly, calls it well thought out for editors and good for developers to build on — useful if you plan custom integrations across sites.
Trade-offs to weigh
Multi-site management is not the same as multi-site tooling. The page emphasizes editing, collaboration and security; it does not detail domain routing, shared content syndication or centralized theme deployment. If your requirement is dozens of near-identical sites with shared templates, verify that architecture directly rather than assuming it. Also note Concrete is open source, so hosting, upgrades and compliance configuration are largely your responsibility — an advantage for control, a cost for staffing.
A practical next step
List your non-negotiables — number of sites, shared vs. separate content, approval depth, hosting compliance — then ask for a demo framed around those. The site itself offers a demo path and a shortlist conversation, which is the right venue for multi-site specifics. For comparison, evaluate WordPress (ubiquitous, huge plugin ecosystem, more assembly required) and Drupal (strong multi-site and governance heritage, steeper learning curve).
Decision criterion: choose Concrete CMS if governed editing and compliance matter more than out-of-the-box multi-site orchestration; look harder at Drupal or a headless setup if centralized management of many sites is the primary requirement.
What developer tools and APIs does Concrete CMS offer for building custom features?
Concrete CMS is positioned as a system that developers can build on, not just a point-and-click site builder. Its own page emphasizes that it serves "content creators, designers, and developers" together, and a customer quote from creative director Tim Macknelly describes it as "great for editors and very good for developers to build off." That framing is the main signal: expect an extensible core rather than a locked-down hosted product.
What the page actually evidences
The site's feature copy leans toward built-in capability rather than a long list of named APIs:
- Custom functionality through add-ons and themes. The blog notes new marketplace add-ons (Top Navigation Bar PLUS, Hero Image PLUS), which implies a package/add-on model as the primary extension route.
- Block-level granularity. Permissions can be assigned "down to the individual block of text," which is the kind of fine-grained model that typically maps to developer-facing permission APIs.
- Version control and change logs. Review, compare and revert features suggest an underlying content versioning layer developers can hook into.
- AI integration work in the ecosystem. A post about "Atlas" and an MCP Server, built by Macareux Digital, indicates third-party developers are extending Concrete CMS into AI tooling via open source integrations.
The page does not enumerate specific REST endpoints, SDKs, or hook names, so treat any list of exact API methods as something to verify in the developer documentation rather than assume from the marketing page.
Practical next step
If you are evaluating it for custom development, decide based on your extension style:
| Your need | What to check first |
|---|---|
| Add features without forking core | Add-on/package structure and marketplace conventions |
| Integrate external systems | Whether a REST or headless API exists and its auth model |
| Control who edits what | The permissions and workflow layer, since block-level control is advertised |
| Ship a custom front end | Theme and template override mechanics |
A concrete scenario: a small agency building a client intranet with custom approval routing would likely start with an add-on package, use the built-in roles and workflow rather than writing them from scratch, and only touch core APIs for the routing logic itself.
For authoritative details, go to the project's own developer resources at Concrete CMS and its documentation, and compare extension models against alternatives such as WordPress if you need a much larger third-party plugin pool.
User reviews (0)