A complete website and content platform — visual for authors, flexible for developers, and ready to run on your own infrastructure.
Content management
Create structured content without giving up visual control. Pages, posts, and custom content types share one publishing workflow and one flexible block document.
Visual builder for pages, posts, and other content types
Reusable blocks, responsive grids, patterns, and undo/redo
Multilingual routes, a visual menu designer with mega menus, Post List, Link List, and WordPress import
Configurable permalink structures with automatic 301s, plus a redirect manager with 404 reports
Public threaded comments with moderation, notifications, and CAPTCHA
Working revisions on every type — draft, compare, and restore the last five
Recoverable Trash for content, media, comments, and menus
Give every person the access they need, from public registration to full administration — with a second factor, session rotation, and a reconstructable audit trail.
TOTP two-factor authentication with encrypted recovery codes
Password change and reset that revoke every existing session
Administrative audit log, signed sessions, CSRF, and rate-limited login
Site-local custom roles, per-user capability grants and denies, and content, locale, and ownership scopes
Device-session list with per-session revoke, plus self-service password reset by email
Keep files organized in one library and reuse them throughout the site. MIME verification, upload limits, library quotas, and safe local delivery are built into the live admin path.
Verified image, document, video, and audio uploads with configurable limits
Media picker inside Image and other URL-aware blocks
Site icon from Settings, plus Gallery layouts: Grid, Masonry, Carousel, Slideshow, and List
Use Justflows as a complete website or as the content backend for any frontend. The public contract is discoverable, documented, and friendly to typed clients.
Public REST endpoints for content, types, media, and menus
OpenAPI document for client generation and API exploration
Locale-aware published content for headless applications
Outgoing signed webhooks for content, media, user, and system events
Extend the platform at stable boundaries instead of patching core. Plugins can add behavior and editor experiences while lifecycle and permissions remain explicit.
Typed actions, gates, filters, jobs, blocks, and admin extensions
Install, activate, deactivate, and remove plugins at runtime
Plugin-owned admin apps in a sandboxed same-origin frame — Forms is now a fully standalone plugin
A content-hashed front-end asset bundle every active plugin folds into
Signed packages, declared permissions, and active-only execution
Publish your site in the admin, then write the whole thing out as a folder of files you can serve from object storage or a CDN — no Node origin required for the published pages.
Every published page, asset, locale variant, sitemap.xml, robots.txt, favicon, themed 404, and the built /theme.css
A manifest with per-file sha256 and Cache-Control advice, plus a _headers file for Cloudflare Pages and Netlify and ready-to-use .htaccess / nginx config
Optional auto-rebuild: an incremental re-export after publish, menu, theme, or settings changes
Forms, comments, analytics, and cookie consent keep working off-origin via CORS and a generic window.__JF_ORIGIN__ stamp
staticExport.routes, assets, formAction, completed, and deploy SDK hooks
Run the platform with the tools an operator expects: guided core updates, deep diagnostics, versioned system emails, and a recoverable delete for everything.
One-click core updates with checksum verification, plus an opt-in daily auto-update that never crosses a major version
Admin diagnostics: runtime, database, migration, cache, plugin and hook state, correlation IDs, and confirmed support bundles
Site-scoped Trash for content, media, comments, and menus — restore with revisions intact or purge on a schedule
Move the admin URL off /admin with a reachability check and automatic rollback
Versioned system emails with branding, typed variables, locale variants, and sanitized test sends
The repository explains itself to modern coding agents. Machine-readable guidance helps them find the right extension points and preserve the platform’s contracts.
Repository-native instructions and focused development skills
Architecture, security boundaries, and verification paths in context
Guided workflows for plugins, themes, APIs, and platform changes
