Fast by default
Pages are rendered once and served from memory until something changes. Search runs inside PostgreSQL. There is no PHP pool, no Node process and no extra cache to set up.
Open source · CPAL‑1.0 · Written in Go
The CMS that ships as one binary
sap13ns is a WordPress-style CMS written in Go. One executable and PostgreSQL behind nginx give you a fast, secure site with themes, plugins and two languages from day one.
- Single Go binary
- PostgreSQL behind nginx
- No Node.js in production
Why sap13ns
Built for people who would rather publish than babysit servers.
Secure by design
A strict Content Security Policy, Argon2id passwords, two-factor sign-in and plugins that cannot touch files, the network or the database unless you allow it.
Simple to run
One binary, one PostgreSQL database and nginx in front. Migrations run on start and an update is a file swap and a restart.
Features
Everything a site needs. Nothing it does not.
The parts you would otherwise assemble from a dozen plugins ship in the box, tested together and covered by the same security rules.
Full-text search
PostgreSQL ranks titles, excerpts and bodies. No external search service.
In-memory page cache
Public pages are served from memory and invalidated on every edit.
Five themes
Apple, Neumorphism, Glassmorphism, Bento Grid and Dashboard, each light and dark.
WASM plugins
Sandboxed modules with per-permission approval pinned to the file hash.
Multilingual
Translations linked per post, language prefixes and hreflang alternates.
Feeds and WebSub
RSS, Atom and JSON Feed for the site, every category, tag and author.
Markdown editor
Write visually or in Markdown, with a preview, revisions and scheduled posts.
Responsive media
Uploads are checked, stripped of metadata and resized into variants.
Comments with anti-spam
Threaded replies, moderation, a honeypot and signed form timestamps.
Five roles
Admin, editor, author, contributor and subscriber, with clear capabilities.
Two-factor sign-in
TOTP with recovery codes, or a passkey. Passkeys also sign you in without a password.
Audit log
Who changed what and when, for settings, users, plugins and content.
WordPress importer
Bring posts, pages, terms and media over from a WordPress export.
AI assistant
Claude, OpenAI-compatible, local models or Gemini. It suggests; it never publishes.
llms.txt
llms.txt and llms-full.txt give language models a clean map of your site.
Automatic OG images
Posts without an image get a share card drawn from their title. No design tool needed.
Redirects
Keep old links alive when you change a slug or move from another CMS.
Cookie-less analytics
Aggregate visit counts without cookies, banners or personal data.
Backups
Database and uploads in one verified archive, optionally encrypted.
Multisite
One account for many sites, each with its own domain, themes and plugins.
Deploy
One binary. One database. Done.
Templates, stylesheets, icons and translations are compiled into the executable. Copy it to a server, point it at PostgreSQL and let nginx talk to it over a Unix socket.
- Database migrations run on start, inside a transaction.
- No open port: nginx connects through a socket only its group can use.
- Updates are atomic: the old binary or the new one, never a mix.
- Node.js is only used at build time. Production never sees it.
# 1. Install the binary
$ sudo install -m 0755 sap13ns /usr/local/bin/
# 2. Create the database
$ sudo -u postgres createuser sap13ns
$ sudo -u postgres createdb -O sap13ns sap13ns
# 3. Generate a secret key for the env file
$ sap13ns keygen
9f2c…e41a
# 4. Migrate and start
$ sudo -u sap13ns sap13ns migrate -env /etc/sap13ns/sap13ns.env
$ sudo systemctl enable --now sap13ns
msg="sap13ns listening" addr=unix:/run/sap13ns/sap13ns.sock
$ Themes
Five themes. Light and dark, all of them.
Every theme follows the visitor's system preference, remembers a manual choice and passes the same strict CSP. Pick one, set an accent and publish.
Security
Secure by default, not by plugin.
Most CMS breaches start with an add-on or an upload. sap13ns treats both as untrusted and makes the safe setting the only one.
content-security-policy: default-src 'self'; script-src 'self'; style-src 'self'; frame-ancestors 'none'; …
x-frame-options: DENY
x-content-type-options: nosniff
cross-origin-opener-policy: same-origin
referrer-policy: strict-origin-when-cross-originStrict CSP
No inline scripts, styles or event handlers anywhere, admin included.
Argon2id
Slow, memory-hard password hashes and no silly composition rules.
CSRF protection
Synchronizer tokens plus Go's Cross-Origin Protection on every form.
Rate limits
Sign-in, password resets and comments are throttled per address.
Sanitised HTML
Markdown and plugin output pass through bluemonday allow-lists.
Upload validation
Type from content, matching extension and a sandbox CSP when served.
Plugin isolation
WebAssembly with memory caps, deadlines and no ambient access.
Per-site isolation
In multisite, every site lives in its own PostgreSQL schema.
Multisite
One account. As many sites as you need.
Run a personal blog, a project site and a client's shop notes from the same sign-in. Each site keeps its own domain, theme, plugins and data.
- A domain per site, with HTTPS.
- Themes and plugins chosen site by site.
- A separate PostgreSQL schema for every site.
Hosting
Rather not run a server? We will.
Personal sites are free once we have validated them. Commercial sites pay monthly through Stripe. Same software, same security, no lock-in.
Personal
Free
Personal, non-commercial sites
- 1 site
- An address under sap13ns.site
- 1 GB storage
- Plugins from the network's catalogue
- Reviewed by a person before it goes live
Pro
Recommended9 €/ month
99 €/ year1 month free
or 99 € a year1 month free
VAT included
Commercial use allowed
- 1 site
- Up to 2 custom domains with HTTPS
- 10 GB storage
- Upload your own plugins, reviewed before they run
- Upload your own themes
Business
30 €/ month
330 €/ year1 month free
or 330 € a year1 month free
+ VAT
Commercial use allowed
- 1 site
- Up to 2 custom domains with HTTPS
- 50 GB storage
- Upload your own plugins, reviewed before they run
- Upload your own themes
Open source
Free to use. Credit where it is due.
sap13ns is released under the CPAL‑1.0 licence. Use it for anything, commercial work included, as long as the visible “Powered by sap13ns” link stays and modified versions offered over a network publish their source.
- Any use, including commercial
- Keep the “Powered by sap13ns” link
- Share changes you run as a service
Blog
Notes from the team
Releases
Introducing sap13ns
A content management system in the spirit of WordPress, written in Go, shipped as one binary and built on the assumption that the internet is hostile.
Product
Multisite: one account, many sites
How sap13ns runs many sites from one installation, each with its own domain, themes, plugins and database schema, while you sign in only once.
Security
Plugins in a WebAssembly sandbox
Why sap13ns plugins start with no access to anything, how permissions are approved, and why the approval is tied to the exact file you reviewed.
Your next site is one file away.
Install it on your own server in minutes, or let us host it for you.