WahPress CMS.
PHP · MySQL. Drop it in. Done.
WahPress is a professional content platform built for teams that ship. One zip package. Drop it into any public directory on any PHP host. The installer runs in two steps. You have a website with posts, pages, media, users, themes, and a RESTful master API that any control plane can talk to. No bloat. No plugin directory. No update ecosystem.
Six production modules. All of them work on day one.
Six admin sections, twelve REST endpoints, five user roles, one capability matrix, and one double-gated master API.
Admin Dashboard
4 KPI cards · Site Connectivity token card
- +Published Posts, Pages, Media, Active Users counters
- +Recent Content table with Edit + View actions
- +Site Connectivity card: Instance URL, API Base, Master Bearer Token
- +Active Theme preview with screenshot + version badge
- +Recent Users 5-row users with Role and Status badges
- +Quick Links: Settings, Invite User, JSON Feed, Sitemap
Posts & Pages
Draft, Pending Review, Published workflow
- +Posts and Pages as independent post types with separate routing
- +Status flow: Draft, Pending Review, Published
- +Media uploads handled as attachment post type (64MB max)
- +Author, date, permalink slug routed front-end
Theme System
WordPress-compatible style.css headers
- +Theme directory requires style.css + screenshot.png
- +Zip install via file upload or direct URL fetch
- +Activate, Delete UI with nonce protection
- +Full hierarchy: home, single, page, 404, searchform, sidebar, header, footer, functions.php
Users & Roles
5 roles with capability matrix
- +Administrator, Editor, Author, Contributor, Subscriber
- +bcrypt cost-12 passwords with session tokens
- +Role bitfield + suspended user_status flag
- +HMAC-SHA256 per-action nonce salts
Settings & Options
Key/value autoload store
- +Site name, description, admin email, posts per page
- +Active theme persisted via options
- +Mixed-type serialization for arrays and objects
- +wah_kses_post() HTML tag whitelist sanitizer
- +Single key get/set + bulk access
Master REST API v1
Bearer token + IP/CIDR whitelist double-gated
- +6 resources: Site, Posts, Pages, Users, Themes, Options
- +/wah-api/v1 full CRUD GET POST PUT DELETE
- +hash_equals constant-time token comparison
- +Debug mode with response payloads, CORS preflight
- +Theme install: zip_b64 push OR zip_url TLS-validated pull
How it looks once installed.
Three real screens from the shipped admin dashboard. Drop in, install, you have exactly this.
Admin Dashboard
4 KPI cards + Recent Content
Site Connectivity
Master-slave integration card
Appearance Gallery
Installed, Active, Library
Showcase · Portfolio
Six real industry tiles from the GA launch cohort. Every single one is WahPress end to end.
PixelForge Studio
The Daily Ledger
North Bay Goods
Harbor Cafe & Roasters
Mara Klinefeld — Essays
LedgerOps SaaS Platform
Loved by agencies, founders, and dev shops.
Real words from real teams running WahPress in production on launch day.
Runs on any PHP host. Any.
WahPress runs on every PHP stack known to exist. Shared, VPS, dedicated, cPanel, Plesk, or LAMP.
- Extract and upload to public_html or any subdirectory
- Visit the URL, installer redirects to install.php automatically
Timeline · From R&D to GA
Five ledger rows mapping out the WahPress journey. The GA date is locked: 01 January 2027.
WahPress PHP architecture R&D kickoff
Core architecture finalized — plugin-free footprint, 56-file package, bcrypt sessions, HMAC nonces, PDO layer.
v0.9 Private beta · 12 founding agencies
Twelve founding agencies ran real client sites on v0.9. 400+ issues closed, installer hardened, theme system validated.
v1.0.0 RC1 · installer, API, theme system frozen
Feature freeze for v1.0. Release candidates distributed. Master API v1 schema locked. Twelve endpoints, six resources.
🎉 General Availability · Stable ZIP, docs GA
Stable v1.0.0 ZIP published. Full documentation site live. websiteandhost.com managed cloud onboarding open. Long-term support branch created.
v1.1 · Custom post types, taxonomy API, multisite
Registerable custom post types + shared taxonomy API. Multisite network support with per-site upload silos and network-level master API.
Every WahPress install connects back.
Manage every instance from websiteandhost.com. Posts, Pages, Users, Themes, Options — six resources, twelve authenticated endpoints. Push content across all your installs in one stroke. Bearer tokens plus IP and CIDR whitelist. No surprises.
Three tiers. Free core, optional cloud.
WahPress core is GPLv3 free forever. Add managed cloud or agency seat when you need it.
GPLv3 core. Download the ZIP, drop it on any PHP host. Own every byte.
- ✓ Full v1.0.0 ZIP package · 56 files
- ✓ 6 admin modules, 12 REST endpoints
- ✓ Theme system (style.css + hierarchy)
- ✓ Master API v1 with bearer + CIDR gate
- ✓ Community docs · GitHub issues
- ✓ Install on unlimited hosts/sites
Hosted on websiteandhost.com. Backups, updates, telemetry, and one-click restores.
- ✓ Everything in Self-Hosted, hosted
- ✓ Daily + on-demand encrypted backups
- ✓ One-click WahPress version updates
- ✓ Master API pre-wired to your control plane
- ✓ 99.9% uptime SLA · PHP 8.3 tuned
- ✓ Priority email support · 24h response
For agencies and dev shops managing multiple client installs. Unlimited sites per seat.
- ✓ Everything in Managed Cloud
- ✓ Unlimited WahPress installs per seat
- ✓ Cross-site bulk content push via master API
- ✓ White-label wah-admin branding tools
- ✓ Shared staging + client preview links
- ✓ Slack channel + named support engineer
Questions, answered before launch day.
Six home-page FAQs covering install time, theme compat, PHP support, API security, license, and migration.
Two steps and roughly 60 seconds. Unzip wahpress-v1.0.0.zip into any public directory on your PHP host, then visit the URL in a browser. The installer auto-redirects to install.php where you enter your MySQL credentials and admin account details. The installer writes wp-config.php equivalent, creates 12 tables, seeds your admin user, and redirects you to wah-admin.
Yes, partially. WahPress implements the full WordPress theme hierarchy (home, single, page, 404, searchform, sidebar, header, footer, functions.php) and reads the standard style.css theme header format. Themes that rely on WordPress core plugin APIs, shortcode ecosystems, or hooks like the_content filters will need to be ported. Clean template-only themes typically drop in unchanged. We publish a wah-default theme and three starter themes on launch day.
WahPress v1.0.0 supports PHP 8.2 and newer. PHP 8.1 will work but is not officially tested or recommended. Required extensions: pdo, pdo_mysql, mbstring, json, openssl, zip, fileinfo. Recommended but optional: curl, gd, intl, bcmath. The installer checks all of this up-front and refuses to proceed with a clear checklist rather than failing halfway.
The master API at /wah-api/v1 uses two independent gates. Gate 1: a 48-char Bearer token compared via hash_equals() (constant-time, no timing leak). Gate 2: an IP and CIDR whitelist with XFF chain validation for proxied hosts. Additionally, all write endpoints require a matching HMAC-SHA256 nonce per action, debug mode is opt-in and logs payloads, and TLS is validated for any outbound URL-fetch operations (such as theme installs). The token and whitelist are editable from wah-admin under Site Connectivity.
WahPress core is released under the GNU General Public License v3.0 (GPLv3), the same license family used by WordPress. You are free to run, study, modify, and redistribute the code. Themes you write yourself can be any license you choose. The default wah-default theme is also GPLv3. Managed-cloud and agency tiers from websiteandhost.com are commercial hosted offerings on top of the GPLv3 core.
Yes. WahPress v1.0 ships with a WordPress WXR import tool under wah-admin → Tools → Import. Point it at a WordPress WXR export file and it will import posts, pages, media attachments, authors, categories, and tags into the equivalent WahPress tables. Theme and plugin migrations are manual by nature. websiteandhost.com managed customers can request assisted migration from the GA launch date.
Download WahPress today.
One package. PHP and MySQL. Two steps. No account, no activation key, no lock-in. When you outgrow a single host, connect it back to websiteandhost.com and scale from there.