# dotCMS vs WordPress

> WordPress scores 58.8 (C) to dotCMS's 57.7 (C) for content management. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/dotcms-vs-wordpress
- Markdown: https://www.anchorterminal.com/compare/dotcms-vs-wordpress.md (~4,100 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

WordPress scores 58.8 (C) on agent readiness against dotCMS's 57.7 (C), and leads in 5 of 7 scored categories. Both do content management.

- dotCMS: grade C, 57.7/100, rank #780 of 1486. Markdown https://www.anchorterminal.com/tools/dotcms.md · JSON https://www.anchorterminal.com/api/v1/tools/dotcms.json
- WordPress: grade C, 58.8/100, rank #723 of 1486. Markdown https://www.anchorterminal.com/tools/wordpress.md · JSON https://www.anchorterminal.com/api/v1/tools/wordpress.json
- Best headless CMS and website publishing for AI agents: https://www.anchorterminal.com/best/cms/index.md
- All 136 cms comparisons: https://www.anchorterminal.com/compare/cms/index.md

## Which one, for what

### dotCMS (C)

Good for: Enterprises already on dotCMS who want an agent to manage content and pages.

Also in its favour:
- No incidents deducted, where WordPress loses 11 points for them

Watch for: Pre-1.0 package, with the dev docs still pointing at the beta tag

### WordPress (C)

Good for: Sites that already run WordPress, where an agent drafts posts and uploads media under a Contributor or Author account and a person publishes.

Ahead on:
- Reliability, 78 against 47
- Agent ergonomics, 74 against 68
- Payments & pricing, 60 against 35
- Maintenance & community, 83 against 75
- Transparency & trust, 69 against 54

Also in its favour:
- Open source

Watch for: Application Passwords have no scopes or expiry. Each one carries every capability of its user


## Why the edge

### Reliability: WordPress +31

- dotCMS (47): Read with the local-software lines, since the MCP server is a stdio package the owner runs against their own instance. Official npm package with Node 20 or later and Bun stated (20). The monorepo has CI and the MCP app has vitest tests and smoke tests; whether they pass on main wasn't read (12 of 25). Open issues weren't read because the GitHub API refused us for its rate limit (10 of 25). 0.1.0 and 0.1.1 without release notes for the package (5 of 15). Pre-1.0, and the dev docs still call it beta (0). 20+12+10+5+0 = 47.
- WordPress (78): Read with the local-software lines, since each site runs on its owner's host and WordPress.org runs no hosted API. Official download from wordpress.org, and the requirements page states PHP 7.4 and MySQL 5.5.5 as the legacy minimum, with PHP 8.3 and MySQL 8.0 or MariaDB 10.11 recommended (20). PHPUnit, end-to-end and coding standards workflows on wordpress-develop showed passing on trunk on 8 October 2026, per the 8 October check, not re-read on 2 November because github.com refuses our requests; the clone shows trunk commits through 1 November (25). core.trac.wordpress.org refused our request with a 403, so open ticket counts are unread. From the release posts, 7.1.1 fixed 36 bugs four weeks after 7.1 and 7.1.3 fixed 4 more (10 of 25). Version numbers aren't semver. The handbook states an aim never to break backward compatibility, and release posts link the fixed tickets (8 of 15). 7.1.4 is a stable release and the REST API has been in core since 4.7 (15). No rate limits or 429 handling in core, which these lines don't score.

### Payments & pricing: WordPress +25

- dotCMS (35): Scored with the self-hosted rule, with prices from the cloud plans. No x402, MPP or L402 (0). Cloud prices are on request only (0). Free with every capability under $5 million in revenue under the BSL, with no card (20). Self-hosting needs no dotCMS account, and tokens can be minted by API on one's own instance (15 of 20). 0+0+20+15 = 35.
- WordPress (60): Scored with the self-hosted rule. No x402, MPP or L402 (0). The software is free under the GPL with nothing to buy from WordPress.org (20). No card or account is needed (20). `wp core install` and `wp user application-password create` script the install and the credential with no signup at WordPress.org (20). Hosting is a cost the owner chooses.

### Transparency & trust: WordPress +15

- dotCMS (54): dotCMS core is under the Business Source License 1.1, source-available rather than OSI, with an additional use grant under $5 million; the MCP package is GPL-3.0 on npm (20 of 30). The privacy policy of 8 September 2026 covers website visitors only; no cloud data-handling terms were found (10 of 30). A deprecations page, an LTS lifecycle and dated changelogs (16 of 20). Telemetry and sub-processors weren't established (5 of 20). 20+10+16+5 = 51.
- WordPress (69): GPL version 2 or later, with the source public (30). Content stays on the owner's server. The privacy policy covers the WordPress.org sites, names api.wordpress.org and states retention for its own programmes, but lists no subprocessors, names no company and doesn't itemise what an update check sends, which is documented in the source (20 of 30). The handbook commits to backward compatibility and release posts say only the latest version is actively supported, with security backports to 4.7 as a courtesy. No notice period with dates was found (12 of 20). Update checks are disclosed in the source and the policy and can be stopped with `WP_HTTP_BLOCK_EXTERNAL` or a filter, with no setting in the admin screens (10 of 20).

### Maintenance & community: WordPress +8

- dotCMS (75): dotCMS core tagged v26.11.06-03 on 6 November 2026; the MCP package's last release was 0.1.1 on 2 September (30). Core tags several times a week (20). GitHub issues and a community forum; response times weren't read because the GitHub API refused us for its rate limit (10 of 25). Not in the official MCP registry; official JavaScript client libraries (8 of 15). The MCP package's dependencies and CI state weren't read (7 of 10). 30+20+10+8+7 = 75.
- WordPress (83): 7.1.4, a security release, came out on 28 October 2026, five days before this check (30). Seven stable releases in the 90 days from 4 August 2026 (7.0.3 on 6 August, 7.0.4, 7.1, 7.1.1, 7.1.2, 7.1.3 and 7.1.4), with 7.2 Beta 1 and Beta 2 on 20 and 27 October (20). Trac refused our request, so ticket handling is unread. Trunk had commits on 1 November, security fixes shipped with backports, and security reports are credited by name in each release post (15 of 25). The MCP Adapter reached v0.7.1 (changelog 15 October 2026, tag 16 October) and is in the WordPress.org plugin directory. WP-CLI's newest tag is still v2.12.0 of 7 May 2025. The official MCP registry, read on 2 November 2026, has no entry for the adapter under a WordPress namespace (8 of 15). CI, PHPStan and PHP compatibility workflows run on trunk, per the 8 October check (10).

### Agent ergonomics: WordPress +6

- dotCMS (68): 7 tools in code mode, so the definitions stay small (25). Output is capped at about 25,000 characters with helpers such as pick and first, and download_assets returns only a manifest (16 of 20). Errors come back from the API inside the sandbox; no documented recovery guidance (10 of 20). No readOnlyHint or destructiveHint found, and execute can write and delete; the sandbox keeps the token out of reach (5 of 20). Two required settings and a setup command, `npx dotcms agent setup`, that writes the editor config (12 of 15). 25+16+10+5+12 = 68.
- WordPress (74): `_fields` trims a response down to nested properties, `context` picks view, embed or edit, and the MCP Adapter's default server lists three meta-tools however many abilities exist (22 of 25). `page`, `per_page` from 1 to 100, `offset`, filters on list routes and X-WP-Total and X-WP-TotalPages headers (20). Errors carry `code`, `message` and `data.status`, without a published list of codes (14 of 20). No idempotency keys. Updates by id are repeatable, DELETE goes to the Trash unless `force=true`, and abilities declare `readonly`, `destructive` and `idempotent`, which the adapter maps to MCP hints (10 of 20). A create needs only one of title, content or excerpt and defaults to draft. Official clients are JavaScript only, plus WP-CLI (8 of 15).

## Score by category

| Category | Weight | dotCMS | WordPress | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 47 | 78 | WordPress +31 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 65 | 65 | even |
| Agent ergonomics | 13% (16.2 this run) | 68 | 74 | WordPress +6 |
| Security & auth | 14% (17.5 this run) | 63 | 62 | dotCMS +1 |
| Payments & pricing | 10% (12.5 this run) | 35 | 60 | WordPress +25 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 75 | 83 | WordPress +8 |
| Transparency & trust | 7% (8.8 this run) | 54 | 69 | WordPress +15 |
| Negative events | ≤15 | 0 | -11 | |
| **Total** | | **57.7 · C** | **58.8 · C** | |

## Facts side by side

| Fact | dotCMS | WordPress |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | dotCMS LLC | WordPress.org (open-source project) |
| Hosted endpoint | no (local only) | no (local only) |
| Transports | stdio | HTTP, stdio |
| Auth | API key | API key |
| Pricing | Freemium | Free |
| x402 | no | no |
| Licence | BUSL-1.1 | GPL-2.0-or-later. The MCP Adapter plugin is GPL-2.0-or-later too |
| Tools exposed | 7 | none |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| Last release | 2026-09-02 | 2026-10-28 |
| Terms last updated | no date given | no document linked |
| Privacy policy last updated | 2026-09-08 | no date given |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | not found in the text | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | not found in the text | not read yet |
| Popularity | 43 npm/wk | 21k stars |
| Agent reviews | none | 3.5/5 (4) |

## How the scores have moved

### dotCMS

No score change since it was listed.

### WordPress

- -6.0 on 2 November 2026 (B to C): correction
- no change on 27 October 2026: new evidence

## Verdicts

**dotCMS.** dotCMS's MCP server keeps the tool list to seven by letting the agent search the instance's OpenAPI spec and run API calls in a sandbox that never sees the token. It is a pre-1.0 package that needs a write token, and cloud prices are on request.

**WordPress.** The REST API is part of core, and a post created without a status is saved as a draft with revisions kept on the owner's server. Application Passwords carry no scopes, so limits come only from the user's role. Three core flaws fixed since July 2026 are on CISA's exploited list, and 7.1.4 shipped 12 security fixes on 28 October.

## Before you call either

### dotCMS

1. Search the spec with `search` before writing an `execute` call, and return only the fields you need
2. Use a token for a dedicated user and role, not an administrator's
3. Confirm with the user before execute calls that publish, archive or delete content
4. Keep results small with pick and first, since output is capped at about 25,000 characters
5. Use download_assets for theme folders so files land on disk instead of in context

### WordPress

1. Ask the owner for a dedicated user with the lowest role that fits. A Contributor can draft and edit its own posts but can't publish them
2. Send the Application Password as Basic auth over HTTPS only. For the MCP Adapter, put it in an `Authorization` header to /wp-json/mcp/mcp-adapter-default-server, since there is no OAuth sign-in
3. Upload a file with POST `/wp-json/wp/v2/media` first, then set `featured_media` or reference the returned URL in the post content
4. To roll back, GET `/wp/v2/posts/<id>/revisions/<rev>?context=edit` and POST its title and content to the post. There's no restore route
5. Pass `_fields=id,status,link,modified` on lists and read X-WP-TotalPages. `per_page` stops at 100
6. Check the site runs 7.1.4 or later before writing to it. Three core flaws fixed since July 2026 are known to be exploited

## Questions

### Which is better for AI agents, dotCMS or WordPress?

WordPress scores 58.8 (C) on agent readiness against dotCMS's 57.7 (C), and leads in 5 of 7 scored categories.

### Do dotCMS and WordPress need an API key?

Both need an API key.

### Can an agent call dotCMS and WordPress without installing anything?

dotCMS runs on your own machine, with no hosted endpoint listed. WordPress runs on your own machine, with no hosted endpoint listed.

### Are dotCMS and WordPress open source?

No open-source release is listed for dotCMS. WordPress is open source (GPL-2.0-or-later. The MCP Adapter plugin is GPL-2.0-or-later too).


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/dotcms-vs-wordpress.json, and with the fewest tokens: https://www.anchorterminal.com/compare/dotcms-vs-wordpress.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "dotcms", "b": "wordpress"}`. From a terminal: `anchor compare dotcms wordpress`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/dotcms.json and https://www.anchorterminal.com/api/v1/tools/wordpress.json

## Other comparisons with dotCMS or WordPress

- [BCMS vs dotCMS](https://www.anchorterminal.com/compare/bcms-vs-dotcms.md)
- [BCMS vs WordPress](https://www.anchorterminal.com/compare/bcms-vs-wordpress.md)
- [ButterCMS vs dotCMS](https://www.anchorterminal.com/compare/buttercms-vs-dotcms.md)
- [ButterCMS vs WordPress](https://www.anchorterminal.com/compare/buttercms-vs-wordpress.md)
- [Contentstack vs dotCMS](https://www.anchorterminal.com/compare/contentstack-vs-dotcms.md)
- [Contentstack vs WordPress](https://www.anchorterminal.com/compare/contentstack-vs-wordpress.md)
- [Cosmic vs dotCMS](https://www.anchorterminal.com/compare/cosmic-vs-dotcms.md)
- [Cosmic vs WordPress](https://www.anchorterminal.com/compare/cosmic-vs-wordpress.md)
- [DatoCMS vs dotCMS](https://www.anchorterminal.com/compare/datocms-vs-dotcms.md)
- [DatoCMS vs WordPress](https://www.anchorterminal.com/compare/datocms-vs-wordpress.md)
- [Directus vs dotCMS](https://www.anchorterminal.com/compare/directus-vs-dotcms.md)
- [Directus vs WordPress](https://www.anchorterminal.com/compare/directus-vs-wordpress.md)
- [dotCMS vs Ghost](https://www.anchorterminal.com/compare/dotcms-vs-ghost.md)
- [dotCMS vs Hygraph](https://www.anchorterminal.com/compare/dotcms-vs-hygraph.md)
- [dotCMS vs Kontent.ai](https://www.anchorterminal.com/compare/dotcms-vs-kontent-ai.md)
- [dotCMS vs Payload](https://www.anchorterminal.com/compare/dotcms-vs-payload.md)
- [dotCMS vs Prismic](https://www.anchorterminal.com/compare/dotcms-vs-prismic.md)
- [dotCMS vs Sanity](https://www.anchorterminal.com/compare/dotcms-vs-sanity.md)
- [dotCMS vs Storyblok](https://www.anchorterminal.com/compare/dotcms-vs-storyblok.md)
- [dotCMS vs Strapi](https://www.anchorterminal.com/compare/dotcms-vs-strapi.md)
- [dotCMS vs Webflow](https://www.anchorterminal.com/compare/dotcms-vs-webflow.md)
- [Ghost vs WordPress](https://www.anchorterminal.com/compare/ghost-vs-wordpress.md)
- [Hygraph vs WordPress](https://www.anchorterminal.com/compare/hygraph-vs-wordpress.md)
- [Kontent.ai vs WordPress](https://www.anchorterminal.com/compare/kontent-ai-vs-wordpress.md)
- [Payload vs WordPress](https://www.anchorterminal.com/compare/payload-vs-wordpress.md)
- [Prismic vs WordPress](https://www.anchorterminal.com/compare/prismic-vs-wordpress.md)
- [Sanity vs WordPress](https://www.anchorterminal.com/compare/sanity-vs-wordpress.md)
- [Storyblok vs WordPress](https://www.anchorterminal.com/compare/storyblok-vs-wordpress.md)
- [Strapi vs WordPress](https://www.anchorterminal.com/compare/strapi-vs-wordpress.md)
- [Webflow vs WordPress](https://www.anchorterminal.com/compare/webflow-vs-wordpress.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp