Public roadmap
What we're building
The Community Edition roadmap, live from GitHub. Items move as work ships — nothing here is a promise with a date.
Now
In progress on Community Edition.
- Operations#57
Developer debug mode and Admin diagnostics center
Developers and self-hosters need enough visibility to diagnose plugin, hook, API, job, cache, database, rendering, and update failures without enabling unsafe raw error output…
- Content#101
Built-in site search for the public frontend and admin
A content platform needs search. Visitors expect a working site search box, and editors expect fast content search in admin. Today there is no first-party search surface for…
- Platform#103
Automatic responsive images and modern formats
#29 shipped the media library (local + S3). It stores originals but does not generate responsive sizes or modern formats, so pages ship oversized images and themes hand-build…
- #135
Headless federated API
Justflows exposes two HTTP surfaces today: the session-cookie management API under /api/ that only the administration SPA drives, and a read-only public content API under…
Next
Queued once the current slice lands.
- Platform#18
Redis cache adapter
Multi-instance deployments need a shared cache rather than process memory or a local filesystem.
- Operations#19
Backup and restore from admin Tools
Self-hosters need a supported, portable snapshot of content, configuration, and media without operating directly on SQL.
- Platform#64
Optional separate mobile and desktop cache variants
Responsive sites should normally serve the same HTML and use CSS for different viewport sizes. Some themes, plugins, menus, or integrations may intentionally render different…
- Content#92
Customizable 404 and error pages
When a URL does not resolve, or a request fails with 403, 410, 500, or a maintenance error, visitors currently see a generic system page. Operators want these pages to match…
- Content#95
Default privacy policy page generator and setting
Most sites need a privacy policy page. Today operators create one by hand with no starting point and no link between "the privacy policy" and the features that reference it…
- Content#98
Scheduled publishing and future-dated content
Authors expect to set a future publish date and have content go live automatically, and to schedule unpublish/expiry for time-limited content. Without it, publishing depends on…
- Content#109
Comment spam filtering and submission throttling
#50 shipped public comments and a moderation workflow, and #49 added CAPTCHA to Forms. Comments still need dedicated spam defense or moderation queues fill with junk and…
Later
On the horizon, not scheduled.
- Platform#23
First-class multi-site
The database already scopes records by site, but operators need a supported administration and routing model for multiple properties.
- Platform#54
Federated admin login, MFA, and session revocation controls
Production administration needs modern identity options and visible session control beyond password-only login.
- Content#59
Multiple language selector designs and customization
The existing core.language-switcher correctly resolves localized routes, but presentation is limited to inline language codes or names. Different headers, footers, mobile…
- Platform#66
Configurable GDPR and PSD2/PSD3 readiness and compliance controls
Organizations need privacy and payment-security controls that match their role, jurisdiction, risk, enabled features, and professional advice. Justflows should provide strong…
- Platform#94
Safe custom JavaScript and third-party snippet injection
#73 shipped custom CSS in the page builder. Authors also need to add JavaScript — analytics snippets, chat widgets, structured-data blocks, small interactions — per page or…
- Developer experience#97
Plugin and theme quality checker for authors
#10 documents plugin/theme authoring and #21 covers install trust and signing, but authors have no tool that checks a package for quality, compatibility, and security issues…
- Content#99
Shareable draft preview links
Editors need to show unpublished or scheduled content to reviewers and stakeholders who do not have admin accounts. Today previewing requires logging in, so review happens over…
- Platform#105
WebAuthn passkey sign-in for administrators and users
#70 shipped TOTP and #54 covers federated login and session revocation. Passkeys (WebAuthn) are now the strongest widely-supported option: phishing-resistant, no shared secret,…
- Content#106
Editorial workflow with draft, review, approval, and publish states
Teams larger than one person need review before publishing. Today content is either a draft or published, and any user who can edit can also publish. Newsrooms and marketing…
- Operations#107
Maintenance mode and coming-soon page
Operators need a supported way to take the public site offline for maintenance, or to run a pre-launch "coming soon" page, without stopping the process or hand-editing a proxy.
- Extensions#111
First-party Related Content plugin
Keeping readers on the site after an article is a core publishing need. There is a first-party Forms, Analytics, and Gallery plugin (#14, #15, #75) but nothing for on-page…
- Extensions#112
First-party Newsletter and subscriber management plugin
Publishers want an owned audience. Today there is no first-party way to collect subscribers, confirm opt-in, and send a broadcast or a post digest. This pairs with the Forms…
- Extensions#114
First-party Announcements and site-wide banners plugin
Operators frequently need a temporary site-wide message: a sale, an incident notice, a policy update, an event countdown. Today this means editing the theme. A small…
- Extensions#115
First-party Paid memberships and subscriptions plugin
Many independent publishers monetise through paid memberships and gated content. There is a hosted marketplace (#13) and a public user system (#56), but no first-party way to…
- Extensions#116
First-party Documentation and knowledge-base theme
A large share of Justflows installs will be product docs, knowledge bases, and internal handbooks. There is a Theme Customizer (#72) and page builder (#73) but no first-party…
- Extensions#117
First-party Portfolio and agency theme
Freelancers, studios, and agencies are a natural audience for a self-hosted site builder. A first-party portfolio/agency theme gives them a polished starting point that shows…
- Extensions#118
First-party Magazine and news theme
News sites, blogs with volume, and multi-author publications need dense, hierarchy-rich layouts that the default theme does not target. A first-party magazine theme exercises…
- Operations#119
OpenLiteSpeed / LiteSpeed hosting and LSCache integration
Justflows already ships a production Nginx config (docker/nginx.conf) and targets Node hosting on Plesk / cPanel, but LiteSpeed and OpenLiteSpeed are a large share of that…
- Platform#120
Detect modified Justflows core and extension files
Justflows already verifies .jfpkg archive digests and Marketplace signatures before installing plugins, themes, and CSS providers (#21). That establishes authenticity at…
- Extensions#121
First-party Content access control and gating plugin
Publishers frequently need to restrict who can see a page, post, custom-type entry, media file, or download — not only paying subscribers. The roadmap has recurring memberships…
- Extensions#122
First-party Ticketing and event tickets plugin
Operators want to sell tickets — for events, tours, workshops, timed entry, donations-with-admission, or any priced pass — directly from their own site instead of a third-party…
- Extensions#123
First-party Interactive maps plugin
Sites need embeddable, interactive maps — store and office locators, event venues, travel and real-estate listings, coverage areas, hiking routes, data overlays — without…
- #126
Create new patterns
Create new patterns available via the load directory in the pattern panel Create new patterns available via the load directory in the pattern panel
- #127
Add PWA
Add a full working PWA feature Add a full working PWA feature should be able to be fully configurable
Shipped
Already in Community Edition.
- Content#7
Persist custom content types and fields
Admin → Content Types currently edits types in the browser only. They are not stored in the database or exposed on the API, so custom types cannot survive a reload or drive the…
- Platform#8
Public content REST API and OpenAPI for headless use
The website promises a typed headless CMS. Plugin authors have @justflows/sdk; frontend consumers still need a stable, documented public content API.
- Content#9
Built-in SEO: titles, canonicals, sitemap, and robots.txt
A complete website out of the box needs discoverability without a plugin.
- Developer experience#10
Plugin and theme author documentation
The runtime and SDK exist; authors still need a single path from hello-world to a signed-off .jfpkg.
- Developer experience#11
CI quality gate for core packages
Public CE needs a predictable merge bar: lint, typecheck, and tests on every PR into developers.
- Platform#12
Admin accessibility pass
The admin is the product for authors. Keyboard paths, names, and contrast should meet a WCAG 2.2 AA bar on the primary flows.
- Extensions#13
Hosted marketplace catalog for community packages
Site owners need a reviewed catalog of plugins and themes that installs directly from Admin → Marketplace.
- Extensions#14
First-party Forms plugin
Contact forms are core functionality for a complete website platform.
- Extensions#15
First-party privacy-friendly Analytics plugin
First-party, on-site analytics provides useful traffic insight without requiring a paid or third-party service.
- Platform#16
Content webhooks
Headless and integration users need push delivery, not only polling.
- Content#17
Locale-aware content routing
Multilingual sites need content locales, translation relationships, localized routes, and language-aware discovery.
- Developer experience#20
Stable SDK compatibility policy
A stable release requires plugin and theme authors to know which public contracts can change and how deprecation works.
- Extensions#21
Plugin signing and install trust
Package installation is a supply-chain boundary and must verify provenance before activation.
- Platform#22
Role and capability editor in admin
Administrators need more control than selecting one of the five built-in roles.
- Platform#24
Static / edge export
Static output lets high-traffic public pages be served from object storage or an edge CDN without hitting the Node origin.
- Operations#25
Browser install wizard
Shipped in v0.1.0. Finish setup in the browser after Docker or shared hosting. See README Option A/B.
- Platform#26
Unified Express server (API + admin + public site)
Shipped in v0.1.0. PostgreSQL, MySQL, and MariaDB. One Node process.
- Content#27
Visual block editor and page builder
Shipped in v0.1.0. Eleven core blocks and a drag-and-drop page builder.
- Extensions#28
Plugin and theme runtime (.jfpkg + typed SDK)
Shipped in v0.1.0. Upload packages in admin. Authors use @justflows/sdk.
- Content#29
Media library (local + S3-compatible)
Shipped in v0.1.0. Uploads, derivatives, local and S3 adapters.
- Platform#30
Auth, CSRF, and security admin
Shipped in v0.1.0. Capabilities, signed sessions, PBKDF2, security header pages.
- Operations#31
Caching, health checks, and in-admin updates
Shipped in v0.1.0. Memory/filesystem cache, Tools performance controls, health, updates.
- Content#32
WordPress WXR importer (posts and pages)
Shipped in v0.1.0. Admin → Tools accepts a WordPress export .xml.
- Extensions#49
Add configurable CAPTCHA protection to Forms
The shipped Forms implementation has per-IP rate limiting and a honeypot, but automated abuse still needs a challenge option for higher-risk public forms.
- Content#50
Complete public user comments and moderation workflow
Comment storage, moderation routes, and an admin moderation page are partially present, but visitors cannot submit or view comments through the public site, so the feature is…
- Platform#51
Allow administrators to change the admin URL safely
Operators may want the administration entry path to be non-default for policy, branding, or reduction of opportunistic login noise. This is defense-in-depth and must not be…
- Platform#52
Add a Justflows marketing and discovery section to Admin Home
Admin Home should help operators discover useful Justflows resources, releases, marketplace packages, documentation, and community channels without overwhelming core…
- Platform#53
Add advanced per-user scope and capability selection
Default roles are convenient but cannot express narrower access such as editing only selected content types, locales, sites, or owned content. This issue complements #22, which…
- Operations#55
Fix migration bookkeeping and PostgreSQL pending-migration reruns
The migration runner calls every name in MIGRATIONORDER on each installed-server startup and never reads migrations. Only 0001initial writes a tracker row; migrations 0002…
- Platform#56
Replace mock Users admin with real user management API
Administrators need to manage real accounts from Admin → Users. This is distinct from #22: this bug restores the expected fixed-role user-management behavior; #22 adds custom…
- Content#58
Site favicon management in Admin and public frontend
Site owners need to select a recognizable browser/app icon without editing theme files or server assets manually.
- Content#60
Multiple light and dark mode selector designs
The existing core.color-scheme widget supports light, dark, and optional system behavior, but only basic button and icon presentation. Themes need several polished selector…
- Content#61
Dedicated menu designer with horizontal, dropdown, and mega-menu layouts
Admin → Menus can create menus from pages, posts, custom links, and nested child items, but authors cannot visually design navigation behavior or build responsive dropdown and…
- Platform#63
Customizable system email designs and template editor
Justflows can send system notifications through sendmail or SMTP, but subjects and text bodies are currently assembled in individual routes/services. Site owners need…
- Content#65
Working revisions for every content type without overwriting the live version
Authors must be able to edit and save a draft of already-published content without changing what visitors currently see. The draft should become live only through an explicit…
- Platform#69
Admin server-side rendering for every admin route
Administrators should get a fully rendered admin document on first load. Site owners must never need a frontend build toolchain, and admin screens must not be indexed.
- Platform#70
TOTP two-factor authentication and password rotation
A compromised password could not be rotated from inside the product, and there was no second factor on admin sign-in.
- Platform#71
Administrative audit log and subject-access/erasure APIs
Security and privacy operations need a reconstructable record of administrative actions, plus a way to export or erase personal data held about an account.
- Content#72
Theme Customizer: homepage, blog index, footer, design tokens, and dark mode
A site owner should choose the home and blog pages, edit the footer, and control typography, spacing, and light/dark palettes without editing theme files.
- Content#73
Page builder: saved headers, grid, reusable blocks, animations, and custom CSS
Authors need layout, header, and styling controls in the visual builder without dropping into theme source.
- Content#74
Post List and Link List blocks
A complete site needs a blog index and reusable link columns without a plugin.
- Extensions#75
First-party Gallery plugin with extra layouts
Image galleries are core website functionality and should install as a first-party package alongside Forms and Analytics.
- Content#78
Keep selected language in public nav and fall back when a translation is missing
On a multilingual public site, choosing NL (or any non-default locale) must stick for the rest of the visit. Menu links currently drop back to the default language, and…
- Operations#87
Automatic core updates and release discovery in Admin → Updates
Self-hosters currently have to watch for releases and upload justflows.zip by hand from Admin -> Updates. The screen should discover new releases on its own and, when an…
- Platform#93
Self-service password reset for administrators and users
Administrators and registered users who forget a password currently have no supported self-service recovery. #70 delivered scheduled password rotation, not a reset flow.…
- Content#96
WordPress-style permalink structure settings
Operators migrating from WordPress and other CMSs expect to control URL structure: date-based, /%postname%/, category-prefixed, custom base paths per content type, and a…
- Content#100
Redirect manager with 404 logging, import, and export
Site migrations, restructures, and permalink changes create broken inbound links. Operators need to manage redirects in admin instead of editing proxy configuration, and to see…
- Content#102
RSS, Atom, and JSON feeds for content
#9 shipped titles, canonicals, sitemap, and robots.txt, but there are no syndication feeds. Readers, aggregators, podcast clients, and newsletter tools expect RSS 2.0, Atom,…
- Operations#104
SMTP transport configuration and email delivery log
#63 covers email template design, but there is no admin surface for the transport that actually sends mail, and no visibility into whether messages were delivered. Operators…
- Content#108
Trash and recycle bin with retention for all content types
Deletion today is effectively permanent, which makes accidental loss unrecoverable without a backup restore (#19). Users expect a trash with a grace period, like every mature CMS.
- Content#110
Block pattern library and pattern directory
#73 shipped reusable blocks and saved headers. Authors still build common section layouts (hero, feature grid, pricing, testimonial, CTA, FAQ) from scratch each time. A pattern…
- Extensions#113
First-party Cookie consent and script-gating plugin
Sites that use analytics, embeds, or marketing snippets in the EU and similar jurisdictions need a consent banner and a way to gate scripts until consent is given. This…
- #132
BUG Webhook DB entry incorrect
On admin/webhooks when creating a new webhook. We get this errot Incorrect datetime value: '2026-09-05T08:42:02.512Z' for column justflows.webhookendpoints.createdat at row 1…
This page reads the public Justflows GitHub project. Columns can change without a release date attached.
Ready to flow?
Join the open-source community building the future of content platforms.