Headless CMS for small websites
Search for “WordPress alternative” or “Astro CMS” and you get lists of fifteen systems, many written by the vendors themselves. For a small business website the more useful question is a different one: who actually changes what, and how often?
The honest answer first: often no CMS at all
Many small businesses never edit their own website, even when they get an editor. They email the new phone number. An agency owner with hundreds of WordPress clients on maintenance put it this way in a developer discussion: nine out of ten had never logged in. That is a single voice, not a statistic, but it matches what many agencies report.
For these clients a static site without a CMS is the better solution:
- Nothing needs patching while the site simply runs.
- The site is fast because only finished files are served.
- The agency makes changes in minutes in the repository.
You can sell that as a comfort, not a limitation: no login, no password, no updates.
When a headless CMS makes sense
A CMS pays off when someone publishes regularly without a developer. Typical cases:
- Blog or news, several times a month
- Case studies and projects added over time
- Job ads
- Events, menus, courses with changing dates
“Headless” means the CMS only manages content. Astro (or another framework) builds the site from it, ideally as static files. Design and accessibility stay in the code and therefore stay checked. The client swaps text and images in fixed fields.
The three families
Git-based: Sveltia CMS, Decap CMS, Keystatic. A browser interface that writes content as Markdown files into the repository. No database, no server of its own. For text and images in predefined fields, this is the sweet spot. Differences that matter: Keystatic works online only with GitHub repositories. Decap supports GitHub plus GitLab, Gitea, Forgejo, Bitbucket and Azure, but its interface feels dated. Sveltia CMS is built as a modern successor to Netlify/Decap CMS and supports GitHub, GitLab and Gitea/Forgejo, but not Bitbucket or Azure. Limit: none of them is a visual page builder. If editors want to drag blocks around, this is the wrong family.
Self-hosted with a database: Payload, Directus and similar. Powerful, with roles, approvals and many content types. In exchange, each client gets their own application with a database: updates, backups, monitoring and attack surface included. Payload is built on Next.js; with Astro you work against it. Directus is free for organisations under USD 5M revenue and under 50 employees; its pricing page lists the telemetry opt-out under Enterprise.
SaaS: Storyblok, Contentful and others. Comfortable, often with a visual editor on the real page. You run nothing, but you pay ongoing and depend on the API. Storyblok is based in Austria, which helps with GDPR considerations. Check the region, sign a DPA, and put the licence in the client’s name.
Decision table
| Situation | Recommendation | Why |
|---|---|---|
| Content changes rarely, agency maintains | No CMS, static site | Nothing to maintain, fastest site |
| Client edits text and images now and then, repo on GitHub | Keystatic or Sveltia | No database, content stays as files |
| Client edits regularly, repo on self-hosted Gitea/Forgejo | Sveltia or Decap | Both support Gitea/Forgejo |
| Client wants to edit visually on the real page | Storyblok (SaaS, EU) | Visual editing, nothing to run yourself |
| Several editors, roles, approvals, many content types | Self-hosted CMS with database, one standard stack | Capable, but price in the operations |
| Many plugins needed, team knows WordPress | WordPress | Still sensible, with a committed update plan |
| Shop with a handful of products | Static site plus payment links | No shop system to run |
What to watch for, whatever you choose
- Few section types. Five or six the client can refill and reorder. Nobody touches twenty special cases.
- Enforce accessibility in the fields. Alt text required, no free choice of heading level, no raw HTML.
- Limit images. Otherwise an 8 MB phone photo ends up in the build. Cap the size in the CMS or resize at build time.
- Feedback after saving. With a git CMS the site rebuilds after saving, which takes a moment. Tell the client how long, or they’ll click three times.
- Plan the exit. With git-based systems, content is files in the repository. With database and SaaS systems, test the export path up front.
And WordPress?
WordPress isn’t bad. For many small sites it’s simply more than they need. Patchstack (which sells WordPress security products, so this is vendor data) counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 91 % of them in plugins. Core has its share too: WordPress 7.1.3, released 6 October 2026, shipped seven security fixes.
If you mainly use WordPress so someone can edit text, a static site with a git-based CMS is the leaner alternative. If a plugin brings real value and someone commits to the updates, stay with WordPress.
How this fits with Kiekkist
Kiekkist designs export as a static Astro or HTML site and as a WordPress block theme. For the static version, the handover pack includes a guide for the end client, including the “Astro with an editing interface” case. Which CMS you put in front is your call. The fields a client will need later already exist as sections in the design.
Sources
- Keystatic, GitHub mode: https://keystatic.com/docs/github-mode
- Decap CMS, Backends: https://decapcms.org/docs/backends-overview/
- Sveltia CMS, Backends: https://sveltiacms.app/en/docs/backends
- Directus, pricing and licence: https://directus.com/pricing
- Payload CMS: https://payloadcms.com
- Storyblok: https://www.storyblok.com
- Contentful, pricing: https://www.contentful.com/pricing/
- Patchstack, State of WordPress Security in 2026 (vendor data): https://patchstack.com/whitepaper/state-of-wordpress-security-in-2026/
- WordPress 7.1.3 Maintenance and Security Release, 6 Oct 2026: https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/