UnitCMS compares CMS platforms, hosts and tools using published, checkable information, and builds plugin security alerts from public vulnerability data and vendor changelogs. This page explains where our information comes from, what our alert labels mean, and how we handle mistakes.
Who we are
UnitCMS is a new, independent site covering WordPress, Shopify, website builders, headless CMS platforms and CMS news. We are not owned by any platform, host or plugin vendor. We would rather tell you exactly how a page was put together than ask you to take it on trust.
What our reviews are based on
Our platform and hosting comparisons are research-based. We do not currently run hands-on tests of individual products or paid accounts, and we won’t write as though we had. Instead, every comparison draws on sources you can check yourself:
- Published pricing. Prices come from the vendor’s own pricing pages on the date we check them.
- Plan limits. Storage, bandwidth, number of sites, products, staff seats, API limits and similar caps, taken from plan tables and terms.
- Features. What each plan includes, according to the vendor’s feature lists and help documentation.
- Official documentation. Developer docs, knowledge bases and support articles, which are often more precise than marketing pages.
- Performance claims, checked where possible. When a vendor claims speed or uptime figures, we compare them with independent public data where it exists. Real-user datasets such as the Chrome UX Report and the HTTP Archive are examples. If no independent data exists, we say the claim is the vendor’s own.
How we handle pricing
Pricing is the part of any comparison that goes stale fastest, so we treat it carefully.
- We note whether a price is monthly or billed annually, and which currency it is in.
- We separate introductory prices from renewal prices. This matters a lot for hosting, where the first-term discount can be much lower than what you pay afterwards.
- We call out extra costs that change the real total. Examples include transaction fees, paid add-ons, required apps, domain renewals and per-seat charges.
- Every comparison shows the date the prices were last checked. If you see a price that no longer matches the vendor’s page, the vendor’s page wins, and we want to hear about it.
How we compare platforms fairly
A platform that is excellent for a five-page portfolio can be the wrong choice for a store with 10,000 products. So we frame comparisons around use cases rather than declaring one overall winner.
When we weigh options, we look at:
- Total cost over time, including renewals and the add-ons a typical site will need.
- Limits you are likely to hit, and what happens when you do.
- Lock-in and portability, meaning how hard it is to export content and leave.
- Maintenance burden. Self-hosted software like WordPress gives you control but also makes updates and security your responsibility.
- Documentation quality. Clear, current docs are a reasonable signal of how well a product is supported.
We state our conclusions plainly. When we think a product is a poor fit for a particular use, we say so and explain why.
How plugin security alerts work
Our security alerts cover vulnerabilities in WordPress plugins and themes and in extensions for other platforms we follow. Each alert is assembled from public information:
- Public vulnerability databases. Examples include the CVE program and the US National Vulnerability Database, along with WordPress-focused databases such as Wordfence Intelligence, Patchstack and WPScan.
- Vendor changelogs and advisories. We use these to confirm which version contains the fix.
- Repository listings. We check the plugin’s official listing for the current version number and whether the plugin is still available or has been closed.
Before an alert is published, we check that the affected and fixed versions in the database entry match the vendor’s own changelog. Sometimes they don’t match, or the changelog is vague. A changelog line that only says “security improvements” is a common example. In those cases the alert says what we could and could not confirm.
What each alert includes
- The plugin or theme name and the affected version range
- The type of vulnerability, such as cross-site scripting, SQL injection or privilege escalation
- Who can exploit it, for example unauthenticated visitors, subscribers or administrators
- The severity score from the source database, where one has been published
- The first version that contains a fix, if one exists
- What to do right now
What we never publish
We do not publish exploit code, proof-of-concept steps or anything that would make an attack easier. Each alert gives you enough to judge your risk and act, and nothing more.
What PATCH NOW, PATCHED and NO FIX YET mean
Every alert carries one of three status labels. They describe two things: whether a fix exists, and how urgently you should apply it.
| Label | What it means | What you should do |
|---|---|---|
| PATCH NOW | A fixed version is available, and the flaw is serious. Typically it is rated high or critical, can be exploited by unauthenticated or low-privilege users, or has been reported as actively exploited. | Update to the fixed version today. If you can’t, deactivate the plugin until you can. |
| PATCHED | A fixed version is available, and the risk is lower. Often exploitation requires an administrator account or an unusual setup. | Update during your normal maintenance cycle. Don’t leave it for months. |
| NO FIX YET | The vulnerability is public, but the vendor has not released a fixed version. This label also covers plugins that have been closed or appear abandoned. | Assess whether you need the plugin at all. Options include deactivating or removing it, restricting access to the affected feature, or replacing it with a maintained alternative. |
How we decide between PATCH NOW and PATCHED
Severity scores are a starting point, not the final word. A medium-rated flaw that any visitor can trigger can matter more than a high-rated one that needs full admin access. We weigh:
- The published severity score
- The access level an attacker needs
- Whether exploitation has been reported in the wild
- How widely the plugin is installed, where that figure is public
How labels change
Labels are updated as the situation develops. A NO FIX YET alert moves to PATCH NOW or PATCHED once the vendor ships a confirmed fix. Each alert shows the date it was last updated so you can tell how current it is.
What alerts can’t tell you
An alert tells you that a version is vulnerable. It can’t tell you whether your site has already been compromised. If you ran an affected version of a PATCH NOW plugin for a long time, updating is the first step, not the last. Review user accounts, check for unfamiliar files and consider a malware scan.
How we source CMS news
Our news coverage starts with primary sources:
- Official release notes and changelogs
- Developer blogs and announcement posts from the platforms themselves
- Public code repositories and release tags
- Official security advisories and status pages
We report version numbers and release dates as the vendor publishes them. If a story depends on secondary reporting, we say who reported it and how reliable that source has been. Unconfirmed information is labelled as unconfirmed. We don’t present roadmap promises or beta features as shipped products.
Independence
Vendors do not pay for placement, rankings or favourable coverage on UnitCMS. They don’t review our pages before publication. If we ever earn money from links or partnerships, we will disclose it clearly on the pages concerned.
How we keep pages current
CMS platforms change constantly. Prices move, plans get restructured, features are renamed and plugins are abandoned. Comparison pages show a “last checked” date. We revisit pages when a vendor makes a significant change we’re aware of. If a page is too out of date to be useful, we update it or take it down rather than leaving it to mislead people.
Corrections
We will get things wrong sometimes. When we do, we fix it in the open.
- Factual errors are corrected promptly. A dated correction note at the bottom of the page explains what changed.
- Outdated information is updated, and the “last checked” or “last updated” date is changed to match.
- Minor fixes such as typos and formatting are made without a note, because they don’t change the meaning.
If you spot an error, an outdated price or a security alert whose status has changed, please tell us through the contact options on this site. Point us to the source that shows the correct information. A vendor’s pricing page, changelog or advisory is ideal, and it helps us verify and correct the page faster.