Modern, secure & framework-less Content Management System (PHP 8.4+)
LAAS CMS is a security-first, frontend-agnostic CMS built with pure PHP.
No frameworks, no magic — just explicit architecture, strong security, and full developer control.
Successor of SLAED CMS, redesigned for modern PHP, operations, and long-term maintainability.
Note
LAAS is intentionally framework-less.
This is a conscious design decision to ensure transparency, predictability, and long-term stability.
LAAS focuses on clarity over convenience and control over abstraction.
- 🔒 Security-first core architecture
- ⚡ Fast & lightweight – no unnecessary complexity
- 🧩 Modular design (core, modules, blocks)
- 🧠 Clean template structure (no framework lock-in)
- 🌍 Multilingual support
- 🛠️ Developer-friendly (readable code, predictable behavior)
Important
LAAS enforces a strict separation of concerns:
Controllers return data only — templates own all markup and presentation logic.
➡️ https://github.com/SLAED-CMS/LAAS
- PHP 8.4+
- MySQL / MariaDB
- Actively maintained
- Recommended for all new projects
| Project | Status | Description |
|---|---|---|
| LAAS | ✅ Active | Modern CMS (recommended) |
| SLAED CMS 6.3 | 🟡 Maintenance | Stable legacy version |
| SLAED CMS 6.2 Pro | ⚫ Archived | Historical release |
Note
SLAED CMS remains available for legacy installations,
but all new development and innovation happens in LAAS.
- RBAC, CSRF protection, rate limiting
- Session hardening and timeouts
- 2FA / TOTP authentication
- Secure password reset flows
- Sanitized HTML with trust markers and raw-output guards
Warning
Disabling or bypassing security mechanisms (CSRF, rate limits, raw-output guards)
can introduce critical vulnerabilities and is strongly discouraged.
- Pure PHP 8.4+ with strict types
- No Laravel, Symfony, or hidden dependencies
- Predictable request lifecycle
- No global state, no magic methods
- Self-contained modules
- Explicit routes, controllers, repositories, migrations
- Enable/disable features without side effects
- HTML or JSON via content negotiation
- Optional headless mode
- Progressive enhancement friendly
- Health checks
- Backup & restore
- Audit log
- Performance budgets and guards
- Proposal → Plan → Diff workflow
- Read-only UI previews
- Explicit CLI apply (
--yes) - Full auditability
Caution
AI features in LAAS never apply changes automatically.
All modifications require explicit human approval via CLI using --yes.
- PHP: 8.4+
- Database: MySQL 8.0+ or MariaDB 10+
- Web Server: Apache / Nginx / IIS
- Composer: 2.x
- Encoding: UTF-8 (utf8mb4)
Optional:
- Redis (sessions)
- ClamAV (media scanning)
- S3 / MinIO (object storage)
git clone https://github.com/SLAED-CMS/LAAS.git
cd LAAS
composer install- Copy
.env.example→.env - Configure database credentials
- Run migrations:
php tools/cli.php migrate:up- Start a local server:
php -S localhost:8000 -t public/- Frontend: http://localhost:8000
- Admin: http://localhost:8000/admin
- Health: http://localhost:8000/health
Tip
Start with the default configuration and explore the system first.
LAAS is designed to be understandable without reading the full source code upfront.
MIT License
© Eduard Laas, 2005–2026
Website: https://laas-cms.org