App Review: PicoCMS

PicoCMS is the content management system I use for this website. It purports to be blazingly fast and stupidly simple. So is this description accurate?

I discussed Pico in a previous article. This article will go a bit more in depth, providing a basic explanation of the application's features.

Installing PicoCMS

Installing PicoCMS starts with some relatively simple Apache and PHP setup. Apache and PHP must both be installed, along with Apache's mod_rewrite and the standard PHP modules.

Additionally, Apache must be configured to run PHP files with the appropriate PHP runtime and must have AllowOverride All for the HTAccess file to work. (I went into more detail in my first article).

Once everything is in place, installing Pico should be as easy as extracting its files to your httpdocs folder (usually /var/www/html) and changing the file ownership to www-data:www-data. Pico is a flat-file CMS, i.e. it has no database, other than the one that is already available.

Developing for PicoCMS

PicoCMS uses Twig for templating, so it's rather easy to create your own website template. Everything you need to know is in the official documentation. PicoCMS can use either YAML or PHP for configuration; YAML is very easy to use, and in fact is almost natural. Plugins can be writtin in PHP. Lastly, Markdown is used for content, which makes it possible to edit posts in a text editor intuitively.

The choice of languages makes it extremely easy to develop a PicoCMS website.

Secure by design or inconvenient by design?

PicoCMS has no admin backend. There are extensions that add one, but most of them are outdated. Some would argue that this is very inconvenient. Traditional CMS software like Grav and Wordpress include a comprehensive admin backend including at least a configuration editor and a content editor, and usually include multi-user support.

Indeed, having no admin backend is very limiting to PicoCMS; it means that it can only be used in settings where a chosen few webmasters have total control over the site's content. This also, however, makes it secure by design, as the only way to edit the site's content or settings is to have filesystem access.

I use SSHFS as an effective replacement for an "admin backend." I can simply edit the themes, plugins, and content from my desktop. It's not much less convenient than a traditional admin backend.

Extensibility

As Pico's own documentation states, it is not a blogging platform. However, I wanted to use it as one, and to do that is rather simple.

I installed the "pagination" and "search" plugins for Pico, and added a template called "post" which references "image", "title", "date" and "description" variables attached to each post in their YAML headers. The Pagination plugin allowed me to separate the main page into multiple pages and the Search plugin would allow users to search for pages on my website. Neither of these are default Pico functions, but they are added via plugins.

While it might be better to include these functions by default, an extensible CMS is a universal one, so I like that.

Conclusion

Pico is a great CMS, but it should only be used if ALL content is controlled by experienced webmasters. That means no comments and no social networks.

In cases where reader engagement is absolutely necessary, something like Wordpress should be used. If you want to build a forum, use something like phpBB. If you want to build a social network, use something like Mastodon. Inexperienced webmasters might benefit more from something like WonderCMS or Grav, which are easier to administrate and just as easy to install.