Open-source headless CMS compared

Most of the cost comes from people and infrastructure, not the software license. Community editions of Strapi, Directus and Payload are free to download, so you pay for the engineers who model content, build the admin experience and integrate the API, plus the hosting for application servers, a SQL or MongoDB database, backups and monitoring. One-time costs include the initial build and data migration. Recurring costs include hosting, upgrades, security patches, on-call support and any paid plan you adopt. Strapi's self-hosted pricing page lists a Growth plan at 45 US dollars per month including 3 users, with paid SSO and Enterprise features such as audit logs and review workflows. Ask any vendor or consultant to separate license fees, hosting, build effort and run effort in a quote.

A pilot's length depends on the content model's size, the number of integrations, the identity setup and how many editors must test the admin panel. No single duration applies across platforms, so do not accept one from a vendor without the scope behind it. A useful pilot covers one real content type end to end: modeling, editor workflow, API access from the front end, role permissions and a backup and restore test. Confirm which features your chosen edition includes before the pilot starts, because audit logs and review workflows sit on Strapi's Enterprise plan. DeployOpen plans and implements engagements under fixed scope, with deliverables and timelines agreed in writing before work starts.

A team can run one without outside help if it already operates Node.js or TypeScript services and a managed SQL database. Strapi 5 runs only on Active or Maintenance LTS Node.js versions and supports MySQL, MariaDB, PostgreSQL and SQLite. Directus connects to an existing SQL database through its DB_CLIENT setting. Payload is code-defined and runs inside a Next.js application, so it needs developers who can ship React and TypeScript. The skills you need are schema design, API security, upgrade testing, backup and restore, and access control for editors. If those skills are thin, a fixed-scope engagement or a support retainer can cover the gap while your staff learn the platform.

Payload is the option in this comparison that supports MongoDB, alongside PostgreSQL and SQLite. Strapi 5 does not support MongoDB or other NoSQL databases, and the Strapi installation documentation lists MySQL, MariaDB, PostgreSQL and SQLite. Directus connects to SQL databases only, including PostgreSQL, MySQL, MariaDB, Oracle Database, Microsoft SQL Server, SQLite and CockroachDB. If your organization standardizes on MongoDB, that requirement should shape the shortlist before any feature comparison. Confirm the exact Payload database adapter version and its support terms with the vendor before you commit.

Directus is licensed under the Monospace Sustainable Core License 1.0, which permits any use except a Competing Use against Monospace's paid offerings. Building an internal tool or a customer-facing site on Directus is generally a different question from building a product that competes with Monospace's paid offerings, so the license text should be read with counsel. Each version converts to GPL-3.0 four years after release. Directus changed its license to BSL-1.1 in April 2023 and replaced it with the Monospace Sustainable Core License in 2026, so earlier versions may carry different terms. Ask your legal team to review the license file in the repository before a build starts.

Payload suits a non-React front end only when you accept that the CMS itself runs inside a Next.js application. Payload describes itself as a Next.js native CMS that installs directly into an existing Next.js /app folder. Its admin panel is a customizable React admin panel, and the platform generates TypeScript types from code-defined collections. Your storefront or site can still be Vue, Svelte or mobile, because you consume Payload's API over HTTP. The coupling affects your hosting, your upgrade path and the skills on your team. Test the API and admin panel with your actual front end before committing.

Ask for a written scope that names the platform and edition, the content types, integrations, identity method and hosting environment. Each deliverable should map to a line item, with acceptance criteria and the dates or milestones agreed up front. Request separate lines for licensing or paid plans, hosting, data migration, admin customization, security testing, documentation, training and handover. Ask what is one-time and what recurs, including upgrades, backups and support. Confirm who owns the code, the configuration and the infrastructure accounts at the end of the engagement. DeployOpen does not publish a price list, and a quote follows from the written scope.

Check the vendor's release cadence, end-of-life dates and the size of the breaking changes between major versions. Strapi v4 reached end of life on April 30, 2026, and its migration to v5 involves codemods, data migration scripts that run on first start, and a note that downgrading is not supported. Strapi 5 also replaces the Entity Service API with the Document Service API and changes the response format. Back up the database before any upgrade. Ask the vendor or consultant for a migration plan that covers test environments, rollback steps and the effort for custom plugins.