The open-source, self-hostable website platform for agencies.
Build and run all your client sites from one place — author in code with live in-place editing, a built-in CMS, rich interactive components, and an AI assistant — then publish fast, framework-free static sites. Coding agents can build and edit your sites too, over MCP.
Why Sitewright
Agencies juggle dozens of client sites — each with its own brand, content, forms, languages, and release cadence. Sitewright is one platform for the whole lifecycle, self-hosted in a single container:
- Code-first, but clients can edit. Developers author pages in HTML + Tailwind + DaisyUI; mark any element editable and clients change text, images, and links in place in a live preview — with no access to the code.
- Batteries included. A built-in CMS, forms, multilingual, a rich component + motion library, an image pipeline, SEO, consent/GDPR, and a real deploy pipeline — not a pile of plugins to assemble.
- Agent-native. An in-editor AI assistant builds and edits sites for you, and an MCP endpoint lets external coding agents (Claude Code, ChatGPT, Cursor…) do the same over a scoped key. Your sites are programmable.
- Fast + cheap to host. Output is framework-free static HTML — only the CSS/JS a page actually uses is shipped, so simple pages carry near-zero JavaScript.
- Yours to run. One container, one volume. Hardened by default, versioned releases, automatic pre-upgrade DB snapshots. No SaaS lock-in.
Deploy in one command
docker run -d -p 127.0.0.1:8080:80 -v sw-data:/app/data \
-e SW_PUBLIC_URL=https://sites.example.com -e TRUST_PROXY=true \
-e SW_ENCRYPTION_KEY="$(openssl rand -base64 32)" \
ghcr.io/sitewright-cms/sitewright:latest
Put a TLS reverse proxy in front and you're live. Full guide → docs/deployment.md · every setting → docs/environment.md.
Features
✍️ Authoring
- Code-first pages — each page is HTML + Tailwind + DaisyUI; the code is the page (no lossy block tree).
- Live in-place editing — mark elements with
data-sw-*and clients edit text, rich HTML, links, images, and backgrounds directly in a live WYSIWYG preview, safely (no code access). - Reusable building blocks — components, snippets (a ~25-recipe cookbook to copy and own), full-page templates, data-backed widgets, and site-wide chrome slots (nav / footer / sidebars).
- Dual-mode editor — a full code editor (CodeMirror) or a client-safe content editor, with a searchable Library rail (components, icons, animations, button/parallax/SVG builders, Google-font gallery) and desktop/mobile preview.
🧩 Interactive components & motion
- First-party components — carousel/slider (Embla), tabs, lightbox gallery, native
<dialog>modals, dismissible banners, forms, a date/time/range picker, and WebGL shader backgrounds (30 presets). All accessible and degrade to usable HTML without JS. - Mini shop — a front-end cart (
{{sw-cart}}/{{sw-add-to-cart}}) with freely definable buyer fields and order hand-off to a form; off site-wide until explicitly enabled, so the helpers render nothing by default. - Motion & effects — scroll/entrance animations, multi-layer parallax, SVG draw-on + morph animation (with a visual studio), curated nav & button effect libraries, sticky-header modes, scrollspy, a page preloader, click ripples, back-to-top, and opt-in light/dark themes.
🗂️ Built-in CMS
- Typed datasets — collections with 17 field types (incl. nested list/object, references, media, icons, page refs), edited in a data panel and click-to-edit in the preview.
- Detail pages — one real page per item, sharing a single
template:ref, so every URL is a first-class page you can override individually. - Safe by design — rename a dataset and the slug cascades across every loop and reference in one transaction.
🌍 Multilingual
- Translate by inheritance — add a language and Sitewright scaffolds translated pages that inherit the master's code; edit the layout once and every language updates.
- Key-first catalog — shared UI strings via
{{sw-translate}}, per-locale content,hreflangalternates, and localized datasets.
🖼️ Media, fonts & performance
- Responsive images — AVIF/WebP with
srcset, blur-up LQIP, no-CLS intrinsic sizes, on-demand thumbnails, materialized minimally at publish. - Vectors & icons — SVG kept as sanitized first-class vector; ~1,865 Lucide icons, ~270 brand logos, ~250 country flags — all inlined.
- Fonts — self-hosted uploads and Google Fonts downloaded + self-hosted (never a CDN); a full favicon/PWA icon set generated from one master.
- Lean CSS — publish-time Tailwind v4 emits only the classes you use, brand tokens as first-class utilities, one cacheable stylesheet.
🚀 Publish, deploy & host
- Framework-free static output — only-used-ships CSS/JS, atomic publish, a portable self-contained artifact (runs at a domain root, a subfolder, or locally).
- Deploy anywhere — local hosting, FTP/FTPS, SFTP (with rsync/tar fast paths), and git (HTTPS token or SSH key) — via a wizard, with encrypted secrets, SSRF guards, and live streamed progress.
- Incremental delta deploys — a content-hash manifest uploads only what changed, with a tar-over-SSH fast
path, transport compression, and immutable
?v=cache-busting. - Site search — a static search index emitted at publish (per-locale), with a Unicode-aware tokenizer and a delta format, so full-site search runs client-side with no server.
- Always-on preview — a whole-site draft preview rebuilt on change, plus revocable share links for stakeholders.
- Self-host client sites — serve them in-container at
<slug>.<your-domain>(origin-isolated so author JS runs safely) or via a/sites/<slug>/path.
🔎 SEO & 🔒 privacy
- SEO built in — per-page Open Graph, Twitter cards, canonical +
hreflang,sitemap.xml,robots.txt, and schema.org Organization JSON-LD. - Insights — an in-editor Lighthouse speed + SEO audit (also an API route and an agent tool).
- Consent Manager — auto-gates third-party iframes and analytics scripts by consent category and
derives a tight per-site Content-Security-Policy (never
unsafe-inline/*) — GDPR-friendly by construction.
🤖 AI & agents
- On-page AI assistant — a server-side agent loop drives ~50 authoring tools to build and edit the site live (bring the platform key, or a per-project key). Anthropic or any OpenAI-compatible endpoint.
- MCP, everywhere — a remote OAuth MCP endpoint (
/mcp) lets coding agents edit a project over a scoped key. (The localsitewright-mcpstdio bridge is deprecated — retired in favour of the HTTP endpoint. It still runs and its code remains in the repo, but it is no longer developed.) - Import & clone — crawl or upload an existing site into an editable project (self-hosting its images + fonts, extracting brand identity); AI-assisted nativize with objective fidelity audits.
👥 Agency, accounts & ops
- Multi-tenant — per-project corporate identity/branding; white-label the whole admin panel.
- Client access — invite-only registration and one-time, project-scoped client invites (edit-only, no email infra required).
- Hardened auth — MFA/TOTP, passkeys/WebAuthn, OIDC SSO, and project-scoped API keys.
- Safety net — project-wide version history + restore across pages, datasets, and settings; a 90-day media recycle bin; automatic WAL-safe DB snapshots before every upgrade.
- Self-host ops — one System Settings panel (SMTP, AI, OIDC, branding, HSTS, log level, backups),
/health/readyprobes, structured logs, and versioned GHCR releases with an in-app update banner.
Monorepo
pnpm + Turborepo. The whole product ships as apps/api's container; the packages are internal (not published
to npm).
Deeper design docs: architecture · authoring model.
Development
corepack enable # provides pnpm (Node ^22.23.4 || ^24.22.1 || >=26.12.1, see .nvmrc)
pnpm install
pnpm verify # typecheck + lint + test + build
Contributions follow a strict quality bar (TDD, full code + security review, E2E) — see CONTRIBUTING.md. To cut a release, see RELEASING.md; to report a vulnerability, see SECURITY.md.
