Why Choose Luminal?
We did not set out to replace WordPress. We set out to build the CMS that WordPress should have become. Here is why that matters for your website.
The WordPress Reality Check
WordPress powers roughly 43% of all websites on the internet. That ubiquity is not a strength — it is a liability. When nearly half the web runs on the same software, attackers only need to find one vulnerability to compromise millions of sites.
We spent months analyzing server access logs from WordPress installations we managed. The picture was sobering. Here is what the data showed us.
of all websites run WordPress, making it the single most targeted platform on the internet
of CMS-related security breaches involve WordPress installations
daily automated attack requests observed on a single WordPress site in our server logs
average plugins per WordPress site, each an independent attack surface
Simplicity: One System, Fully Integrated
The WordPress ecosystem is built on a paradox: the core is intentionally limited, so you need plugins for basic functionality. Need a contact form? Plugin. Need SEO tools? Plugin. Need security? Plugin. Need caching? Plugin. Need image optimization? Plugin. Each plugin adds its own database tables, its own settings page, its own update cycle, and its own potential for conflict.
Luminal ships with 34 integrated modules covering content management, media handling, AI tools, ecommerce, analytics, email, events, podcasting, and server administration. These are not bolted-on afterthoughts — they are designed together, tested together, and maintained together. There is no plugin compatibility matrix to worry about. There are no abandoned modules from unknown developers running on your production site.
Modern Architecture: Built for Today
WordPress was designed in 2003 for blogging. Its architecture reflects that era — relational databases, server-rendered PHP templates, and a plugin hook system that predates modern web development by decades. Every major feature since then has been retrofitted onto this aging foundation.
Luminal was built in 2025 with full knowledge of how the modern web works. JSON data storage eliminates the database layer entirely. The module system uses auto-discovery instead of global hooks. The admin panel is a clean, modern interface with glassmorphic design. AI integration is native, not an afterthought plugin.
This is not about being new for the sake of being new. It is about having the freedom to design the right architecture without being constrained by two decades of backward compatibility requirements.
AI-Native: Not a Plugin, a Foundation
WordPress has dozens of AI plugins — each with its own API key configuration, its own UI, its own limitations, and its own monthly subscription. They bolt AI onto a system that was never designed for it.
Luminal was built with AI as a first-class citizen. The AI Resources module is a central hub for managing multiple AI providers — Claude, GPT, Gemini, and any OpenAI-compatible endpoint. Set up your keys once, and every part of the CMS that uses AI draws from the same provider pool.
AI Assist lives directly in the Page Manager editor. You write a prompt, choose your tone and content type, and the generated HTML drops right into your page. No switching tabs. No copy-paste. No reformatting. NotebookLM integration turns your content into AI-generated podcasts. The Agent Scheduler automates recurring AI tasks on a cron schedule.
This level of integration is only possible when AI is designed into the architecture from the beginning.
Total Control: Your Server, Your Data
Shared hosting puts your website in a condominium. You share CPU, memory, disk I/O, and network bandwidth with hundreds of other tenants. Some of those neighbors might be running cryptocurrency miners, spam operations, or compromised WordPress installations that are actively being used in botnet attacks. Their activity directly degrades your performance, and you have zero visibility into what is happening next door.
Luminal is designed for VPS and dedicated server deployment. Your site runs on your server, with your resources, under your control. The Farmout Manager lets you deploy and manage dozens of sites from a single server. Domains Manager handles Apache virtual hosts and SSL certificates. Backup Manager creates automated snapshots. Everything stays in your hands.
Your data never leaves your server. Your visitor analytics stay on your server. Your customer orders stay on your server. There are no third-party SaaS dependencies siphoning your data to sell to advertisers.
Try it yourself
WordPress served the web admirably for twenty years. But the web has changed, threats have evolved, and users expect better performance, better security, and smarter tools. Luminal CMS is what happens when you start with a clean slate and build the CMS the modern web actually needs.
You don’t have to take any of this on trust. The platform running this page is public — clone it, read it, run it. Everything it ships with is on the features page, the full reference is in the documentation, and the vertical builds live in Platform Extensions.
git clone https://github.com/tommyshutter/luminal-open-cms.gitAbsent, not hidden
The source is public — that is the point. Security that depends on nobody looking is not security. Read every line, including the admin path; what protects a Luminal site is what isn’t there.
These are not mitigations that can be misconfigured or switched off. You cannot inject SQL into a system with no SQL, and you cannot exploit a plugin that does not exist.
Server Sentinel
Advanced server hardening, available as an AI-native daemon that runs on your server, apart from the CMS. It watches traffic continuously, scores what it sees, and mitigates attacks as they happen — independently of the site it protects.
- Runs outside the web application, so a compromised site cannot switch it off
- Owns the server’s security configuration and reasserts it on every scan
- Scores live traffic and blocks sources as they turn hostile
- Proves it is enforcing — a self-test endpoint stamps the running build, so “protected” is a measurement, not a claim on a dashboard
That last one matters more than it sounds. A guard that reports itself healthy while doing nothing is the failure mode we built Sentinel to end. See availability →
Nothing to query
WordPress fires dozens of MySQL queries per page load. Luminal reads one JSON file from disk and renders it — no connection pool, no query tuning, no caching plugin papering over the architecture.