release notes

Sitecake 4 is a complete rewrite. The editor was rebuilt in React and TypeScript, and the backend is now dependency-free PHP 8. Everything below shipped from April 2026 onwards.

4.0 — the rewrite

The editor no longer runs on Java. It is a React application talking to a PHP 8 backend that carries no Composer dependencies at all — nothing to install, nothing to keep patched.

• Rebuilt editor: faster to load, works on touch screens
• Undo and redo across every edit, with keyboard shortcuts
• Lasso-select several blocks and move or delete them together
• Resize and crop images in place
• WebP support, and PhotoSwipe galleries on published pages
• Your own CSS classes offered as styles in the toolbar
• Page manager for cloning pages and ordering the menu

Updates that install themselves

Sitecake checks for new versions and updates from inside the editor — one click, with rollback if a release does not suit you. Fresh installs are a single command:

curl -sS https://admin.sitecake.com/install | php

Security

4.0.9 and 4.0.10 closed 26 issues found in a full audit of the PHP and JavaScript: bcrypt password hashing, CSRF protection, rate limiting, and fixes for SSRF and ZIP Slip in the upload and update paths.

Every release