Payload logo

[Platform profile]

Payload for marketing websites

Payload for code-defined content, a self-hosted admin and marketing website delivery.

Self-hosted Open core Official website
Kalle Bertell

By Kalle Bertell

Direct answer

Payload suits teams that will run the CMS, admin and database as a TypeScript application they deploy. Editors use the generated admin, and live preview appears after a frontend URL is configured. Choose a managed CMS when nobody will operate the Node.js app, database and file storage, or when visual editing must be included without an enterprise agreement.

Good fit

  • Self-hosted content storage

    The MIT-licensed app runs on your Node.js host. MongoDB, Postgres or SQLite, plus file storage, stay in your operations.

    View sources (2)
    • Payload get started: States the MIT license, self-hosting on Node.js, and enterprise SSO, hosting and visual editing.
    • Payload production deployment: Says Payload runs anywhere Next.js runs, and that you still provide a database and file storage.
  • Code-defined content models

    Collections, fields and blocks live in the TypeScript config, so schema review happens in the same repository as the app.

    View sources (2)
    • Payload blocks field: Stores mixed blocks, such as a page builder, each with its own schema in config.
    • Payload REST API: Generates CRUD routes from collections, including depth, locale and where queries.
  • Drafts you configure

    Versions can store drafts, autosave and a scheduled publish time. Access rules decide who can read those drafts.

    View sources (2)
    • Payload drafts: Drafts require versions and can autosave or schedule publish and unpublish events.
    • Payload versions: Stores version history, diffs, restore, draft visibility and scheduled publishing when enabled.

Consider alternatives

  • No operator for the stack

    Payload does not host the database or files for a standard project. Your team provides that infrastructure and keeps it running.

    View sources (2)
    • Payload production deployment: Says Payload runs anywhere Next.js runs, and that you still provide a database and file storage.
    • Payload get started: States the MIT license, self-hosting on Node.js, and enterprise SSO, hosting and visual editing.
  • Visual editing in the open product

    Live preview is an iframe you configure. The on-page visual editor is listed with enterprise SSO and vendor hosting.

    View sources (2)
    • Payload live preview: Renders the frontend in an iframe and sends document changes with window.postMessage.
    • Payload get started: States the MIT license, self-hosting on Node.js, and enterprise SSO, hosting and visual editing.
  • Ready-made approval chains

    Drafts and field access are configured in code. Publishing approval workflows are described as an enterprise feature.

    View sources (2)
    • Payload enterprise: Lists visual editing, SSO, publishing workflows and vendor or self-hosted enterprise deployment.
    • Payload access control: Documents collection, global and field access functions, including locale-specific checks.

Evidence by criterion

How we evaluate platforms

Visual editing and preview

Iframe preview; visual editing is enterprise

Live preview loads your frontend in the admin and posts each change to that frame. The separate visual editor is named as an enterprise feature, not as part of the MIT app.

Plan considerations: The open-source website template lists Live Preview. Enterprise materials add on-page visual editing.

View sources (3)
  • Payload live preview: Renders the frontend in an iframe and sends document changes with window.postMessage.
  • Payload get started: States the MIT license, self-hosting on Node.js, and enterprise SSO, hosting and visual editing.
  • Payload enterprise: Lists visual editing, SSO, publishing workflows and vendor or self-hosted enterprise deployment.

Marketer autonomy

Admin follows the config developers ship

Editors create and publish documents in the generated admin, including blocks once those blocks exist. Changing fields, validation or who can publish means a config change.

View sources (2)
  • Payload blocks field: Stores mixed blocks, such as a page builder, each with its own schema in config.
  • Payload access control: Documents collection, global and field access functions, including locale-specific checks.

Content modeling

Collections, fields and mixed blocks in code

The config defines collections, globals, relationships and blocks that editors can reorder. That same config generates the admin and the APIs.

View sources (2)
  • Payload blocks field: Stores mixed blocks, such as a page builder, each with its own schema in config.
  • Payload REST API: Generates CRUD routes from collections, including depth, locale and where queries.

Workflow and governance

Drafts and access are code; approvals are enterprise

You can enable versions, drafts, autosave and scheduled publish, then restrict drafts with access functions. Approval workflows are described on the enterprise page.

Plan considerations: Localized draft status is documented as beta. Test it before relying on per-locale publishing.

View sources (3)
  • Payload versions: Stores version history, diffs, restore, draft visibility and scheduled publishing when enabled.
  • Payload drafts: Drafts require versions and can autosave or schedule publish and unpublish events.
  • Payload enterprise: Lists visual editing, SSO, publishing workflows and vendor or self-hosted enterprise deployment.

Localization and multisite

Field locales in config, with fallback

Locales are listed in the Payload config and enabled per field. Fallback is on by default, and the docs state no limit on how many locales you add.

Plan considerations: Per-locale publish status is a beta option and is off unless you enable it.

View sources (1)
  • Payload localization: Configures locales in code, with fallback on by default and no documented locale cap.

Developer experience

One TypeScript app for admin, API and data

Developers own the Next.js app, config, migrations and deployment. Editors inherit the admin that config generates, including custom components the team chooses to build.

View sources (2)
  • Payload production deployment: Says Payload runs anywhere Next.js runs, and that you still provide a database and file storage.
  • Payload REST API: Generates CRUD routes from collections, including depth, locale and where queries.

APIs and extensibility

REST, GraphQL and a local API from one config

Collections generate REST routes and a GraphQL endpoint. Queries can filter, select fields and populate relationships to the depth you request.

View sources (2)
  • Payload REST API: Generates CRUD routes from collections, including depth, locale and where queries.
  • Payload GraphQL API: Exposes a GraphQL API from the same config, by default at /api/graphql.

Hosting and operations

You run the app, database and files

Payload deploys anywhere Next.js runs, including Vercel or your own servers. The database, permanent file storage and email provider remain your responsibility.

Plan considerations: Enterprise agreements can include Payload hosting. The documented default is to host the app yourself.

View sources (2)
  • Payload production deployment: Says Payload runs anywhere Next.js runs, and that you still provide a database and file storage.
  • Payload get started: States the MIT license, self-hosting on Node.js, and enterprise SSO, hosting and visual editing.

Security and governance

App-level controls; compliance follows your host

Payload documents HttpOnly cookie auth, CSRF checks and field-level access in the app you deploy. SSO is enterprise, and a SOC report depends on the host you choose.

View sources (2)
  • Payload security: Describes HttpOnly cookie auth, field access control, CSRF checks and enterprise SSO.
  • Payload SSO: Describes SAML and OAuth 2.0 sign-in as an enterprise feature.

Pricing and cost drivers

MIT app; you pay hosting and enterprise extras

The CMS is MIT-licensed and free to run. Budget the Node.js host, database and storage, and ask sales if you need SSO, visual editing or Payload-operated hosting.

View sources (2)
  • Payload get started: States the MIT license, self-hosting on Node.js, and enterprise SSO, hosting and visual editing.
  • Payload enterprise: Lists visual editing, SSO, publishing workflows and vendor or self-hosted enterprise deployment.

Migration and exit

Content stays in the database you operate

Leaving means exporting the database you already run and replacing the admin, hooks and API usage in the application. REST can also read documents out of a running app.

View sources (2)
  • Payload production deployment: Says Payload runs anywhere Next.js runs, and that you still provide a database and file storage.
  • Payload REST API: Generates CRUD routes from collections, including depth, locale and where queries.

Marketing website fit

Fits when the team will own the stack

Blocks and live preview can support campaign pages after the frontend URL and block components exist. The team keeps owning that app after launch.

View sources (2)
  • Payload blocks field: Stores mixed blocks, such as a page builder, each with its own schema in config.
  • Payload live preview: Renders the frontend in an iframe and sends document changes with window.postMessage.

Team takeaways

For content teams

Editors work in an admin shaped by the TypeScript config, with drafts and blocks when those are enabled. They do not get an on-page visual editor unless the enterprise feature is in the contract. Page structure still depends on the blocks developers ship.

For developers

The team owns the Next.js process, database, file storage and config migrations. Live preview is an iframe integration, while REST and GraphQL come from the same config. There is no standard plan where Payload operates that whole stack for you.