Why we built our own CMS — the VosCMS story

Our last three articles dealt with WordPress security: the unauthenticated remote code execution in core, the irony of protective plugins being breached first, and the figure that 23% remain unpatched thirty days after a fix exists.

Anyone who read them is left with one question. "So what should we actually do?"

This article is our answer — though less "use this" and more an explanation of why we chose the structure we did.

1. It started as an annoyance

THEVOS has built and run client websites for many years, and the same things kept happening.

• An update notice appears, and there is no way to know whether it is safe to apply
• You apply it, it conflicts with another plugin, and the layout breaks
• A client calls to say the site looks wrong. An update had been applied overnight
• One plugin has been abandoned. There is nobody to wait on for a fix

A single site carries a dozen or more plugins, each from a different company. Their quality, their speed of response, and whether they will still be maintained next year were all outside our control.

So we started building.

2. The structure we chose

Do not attach features from outside. Build them as in-house modules inside the core.

VosCMS does have plugins — booking, boards, payments, membership, blogging are all plugins. The difference is that every one of them is a module we wrote, on one shared core.

Which means:

• There is one place to update, not a dozen release schedules to follow
• When something needs fixing, we fix it rather than waiting on someone else's release
• Modules do not conflict, because they share one design

There is a cost, of course. We do not have the WordPress plugin ecosystem, where almost anything already exists. Anything needed, we have to build. In exchange, we stand behind what we build.

3. It is open source

VosCMS is released as open source, free to use. You can download and install it yourself, read the code, and modify it to suit your needs.

The only encrypted portion is the part that handles licence management. The rest of the core and its modules are open.

The reason is simple: a closed tool traps the client. If the company that built the site disappears, or the contract ends, the site still has to stand. Saying "we will see it through" only means something if we also make sure things work without us.

The data, the source and the domain registration all belong to the client.

4. Pages without code

Pages in VosCMS are assembled from widgets — pick what you need, place them in order, and you have a page. No HTML required.

Design is a skin: change it and the whole site changes character. Some clients switch by season, others only during a campaign.

Features are plugins: enable booking if you need booking, membership if you need membership. Anything unused stays switched off.

5. Thirteen languages is not a translate button

VosCMS supports Japanese, Korean, English, Chinese (simplified and traditional), German, Spanish, French, Indonesian, Mongolian, Russian, Turkish and Vietnamese.

What matters is that this is not machine translation. Interface text and the admin screens are properly translated into each language, rather than falling back to English.

This blog is the example. Switch language at the top of the page and the same article appears in another language. It is not a separate site — one article carries content per language.

6. Many sites, one core

Multiple branches or multiple brands usually mean multiple site builds — and therefore multiple things to update and administer.

VosCMS runs several sites from one core and one database. Each site has its own domain and design, but updating happens once. Data stays separated internally per site.

7. Built for doing business in Japan

THEVOS is based in Fukuoka, and the platform was shaped around Japanese commercial practice from the start.

• PAY.jp payments — card payments, recurring billing and refunds through a Japanese provider
• Business documents — quotations, delivery notes, invoices and receipts
• PWA — the site installs to a phone's home screen like an app, with no app store listing and no app development cost

8. Industry solutions — RezlyX DX

Built on top of VosCMS for businesses where booking is the core of the operation.

• Salon DX — hair and nail salons: stylist-specific booking, treatment records, customer notes
• Restaurant DX — table booking, waitlists, menu management
• Hotel DX — room booking, check-in and check-out
• GYM DX — class booking, memberships, attendance
• Dental DX — web booking, web medical questionnaire, in-clinic chair board, recall

9. Where VosCMS is not the right choice

Stated plainly — in these cases there is no reason to change.

• WordPress is already running well and someone is looking after it. If it is being run properly, that is the right answer
• Your operations are deeply tied to a specific WordPress plugin. Rebuilding the same thing can cost more than it returns
• You already have an in-house team fluent in WordPress. The cost of switching a familiar tool can outweigh the gain
• Breadth of documentation and available talent matters most. Nothing matches the world's most-used platform there

We did not build VosCMS because WordPress is bad. We built it because we wanted the sites entrusted to us to be something we could stand behind to the end.

10. It comes back to the same thing

The previous three articles ended on "who keeps watching over it". So does this one.

Whatever the tool, the period after launch is the longer one. Building our own CMS, and including one year of maintenance at no charge after every site we deliver, come from the same decision.

A demo is available if you would like to try VosCMS directly. Tell us what kind of site you have in mind and we will start by working out whether it is the right fit.