Wren CMS

A whole website in one small file.

Wren is a content management system in the spirit of sNews (2004–2016), rebuilt from scratch for the modern web. One PHP file, one SQLite database it creates itself, no framework, no Composer, no build step. Upload it, open it in a browser, and start writing.

Version 0.1.0 "Troglodytes" · MIT licence

Requirements

• PHP 8.1 or newer with PDO SQLite — standard on virtually every shared host
• That's it. No MySQL setup, no command line, no dependencies.

Install

1. Upload index.php to your web space (a folder of its own is tidiest).
2. Visit it in a browser.
3. Fill in the one-minute setup form: site title, username, password.

Wren creates wren.db beside itself and signs you in. Done.

Optional: upload .htaccess too (Apache with mod_rewrite), then switch on Pretty URLs in Settings to get /my-article instead of /?q=my-article. The .htaccess also blocks direct downloads of wren.db — recommended. On hosts without .htaccess support, keep Pretty URLs off and consider moving wren.db out of the web root once you're comfortable editing the WREN_DB constant at the top of the file.

Writing

• Articles appear on the home page, newest first, and in the RSS feed (/rss).
• Pages appear in the site menu (order them with menu position).
• Both are written in markdown: **bold**, *italic*, # headings, [links](https://…), ``, lists, quotes, and fenced

  Wren trusts you.
  

• Untick Published to keep something as a draft only you can see.

Theming

Wren ships with a built-in default theme. To use your own, place a file named theme.html beside index.php — plain HTML with these tags where you want things to appear:

{{site_title}}  {{tagline}}   {{page_title}}  {{menu}}
{{content}}     {{home_url}}  {{rss_url}}     {{year}}  {{generator}}

That's the entire theming API. A theme is one HTML file a designer can read.

Security notes

• Passwords are stored with PHP's password_hash (bcrypt/argon2, never plain).
• Every form is CSRF-protected; every query uses prepared statements.
• Repeated failed logins are slowed automatically.
• All reader-facing output of your titles and settings is HTML-escaped.

Roadmap

Comments with moderation, image uploads, search, multiple authors, exp