Ghost
Ghost is an open-source publishing platform for creating websites, newsletters, and paid memberships. Run as a non-profit foundation, it offers both a managed hosting service (Ghost Pro) and free self-hosting, positioning itself as a creator-owned alternative to Substack and WordPress.
Score generated by AI agents based on publicly cited evidence and reviewed by the project maintainer. Not independently validated. Last assessed 2026-09-25.
Score History
Timeline events are AI-curated from public reporting. Score trajectory is derived from documented events.
Ghost launches on Kickstarter, ships as a minimal open-source Markdown blogging tool, and is set up as a non-profit foundation with no shareholders. Ghost(Pro) managed hosting (January 2014) becomes the only revenue source; the September 2014 price rise from $5 to $10 came with larger plans, no more suspensions for traffic spikes and grandfathered early users. Ghost 1.0 (2017), Ghost 2.0 (2018) and the headless Content API (2019) mature the product, with no ads, no commission and a public revenue dashboard.
Ghost 3.0 adds native memberships and Stripe subscriptions with 0% commission, turning Ghost from a blogging tool into a platform for paid publishing and creating a business-customer side for the first time. The May 2020 SaltStack compromise of Ghost(Pro) servers gets a public incident report; Ghost acquires theme studio IVEEL (October 2020) and releases its themes free; Ghost 4.0 (March 2021) adds native newsletters and a $9 Starter plan.
Ghost 5.0 adds premium tiers and multiple newsletters, making Ghost a direct Substack competitor as annual revenue grows to about $7.5M by 2024. A run of vulnerabilities follows (CVE-2022-41654, CVSS 9.6, and 2023 file-read flaws), and Ghost at first dismisses the CVE-2024-23724 stored XSS report. From April 2024 Ghost commits to the fediverse, funds Fedify, co-founds the Social Web Foundation, and O'Nolan acknowledges that the two-founder board needs external trustees.
The July 2025 Ghost(Pro) restructure raises the Starter price and removes paid memberships from it, pushing monetizing publishers to the $29 Publisher plan; existing customers are grandfathered. Weeks later Ghost 6.0 makes publications fediverse profiles and adds native analytics, and a rebuilt Ghost Explore (November 2025) adds a ranked discovery engine. Revenue passes $10M ARR in March 2026. A critical SQL injection patched in February 2026 is later used against 700+ unpatched self-hosted sites; Ghost is recognized as a digital public good in April 2026.
Alternatives
The newsletter platform most often recommended as a Ghost alternative, with built-in growth tools such as a referral program, recommendations and an ad network. The free Launch plan covers up to 2,500 subscribers; paid subscriptions with a 0% platform cut (Stripe fees still apply) need the Scale plan at $43/month billed annually. The catch: beehiiv is venture-backed ($33M Series B led by NEA in 2024) and leans on advertising, and unlike Ghost it is not open source, so you cannot self-host it.
The most popular newsletter platform with built-in audience discovery and network effects. Easy switch: just sign up and start writing. The catch: Substack takes 10% of paid subscription revenue on top of Stripe fees, where Ghost takes no cut; your publication lives on Substack's platform with limited design control, and SEO capabilities are limited.
The dominant open-source CMS with a massive plugin ecosystem and far more customization options than Ghost. Easy to moderate switch depending on complexity: WordPress.com offers managed hosting, or you can run the free software on your own server, and Ghost's exports and WordPress importers make moving content feasible. The tradeoff is significantly more complexity, maintenance burden, and a less focused publishing experience.
In the News
Dimensional Breakdown
Summaries below were written by AI agents based on the cited evidence. They are editorial interpretations, not independent research findings.
Dimension History
Timeline (40 events)
John O'Nolan Publishes Ghost Concept Post
Former WordPress UI Group deputy head John O'Nolan publishes 'Project Ghost', a concept post arguing that WordPress had outgrown blogging and laying out the vision for a simpler, writing-focused publishing platform (a 'WordPress-lite fork'). The post generates significant community interest and leads to a prototype developed with Hannah Wolfe.
Ghost Kickstarter Campaign Raises 800% of Goal
Ghost launches on Kickstarter with a £25,000 goal. The campaign is fully funded in 11 hours and ultimately raises £196,362 from 5,236 backers over 29 days. Notable backers include Seth Godin, Leo Babauta, Darren Rowse, and companies like Microsoft and Envato.
Ghost 0.3 'Kerouac' Alpha Released to Backers
Ghost releases its first public alpha, version 0.3 codenamed Kerouac (after Jack Kerouac's continuous-writing method), to Kickstarter backers. It includes a full Markdown editor, post management, and the Casper default theme. The general public release follows on October 14, 2013.
Ghost Foundation Established as Non-Profit
Ghost is structured as a non-profit foundation with no shareholders, no investors, and no owners. The legal constitution ensures the company can never be bought or sold, with 100% of revenue reinvested into the product. John O'Nolan and Hannah Wolfe serve as the two-person board of trustees.
Ghost(Pro) Managed Hosting Service Launches
Ghost launches its managed hosting platform (renamed Ghost(Pro) in March 2014), providing a paid alternative to self-hosting. This establishes Ghost's sole revenue model: hosting fees rather than platform commissions on creator revenue. Plans start at $5/month, with higher tiers up to $80/month; by the end of 2014 hosting brings Ghost to $350K ARR and profitability.
Ghost(Pro) Raises Entry Price from $5 to $10
Ghost announces new Ghost(Pro) plans: the entry-level plan rises from $5 to $10 a month, view allowances in every plan more than double, and blogs are no longer suspended for exceeding view limits. Existing plans are honoured for early users. Ghost says it needs more revenue as a not-for-profit that cannot take venture capital.
Ghost Opens Public Revenue Dashboard on Baremetrics
Following a January 2015 pledge to focus on transparency, Ghost opens a real-time, streaming Baremetrics dashboard showing its key revenue metrics and transactions publicly. At the time, Ghost's ARR is approximately $411,000 with 3,764 Ghost(Pro) subscribers.
Ghost Foundation Reincorporates in Singapore
Ghost Foundation moves its legal incorporation from the UK to Singapore, maintaining the exact same non-profit Company Limited by Guarantee structure. The move is driven by Singapore's Stripe support, non-EU jurisdiction, and simple non-resident incorporation. The fully distributed team model continues unchanged.
Ghost Reaches $600K Annual Revenue at Third Anniversary
At its third birthday, Ghost reports $600,000 in annual revenue with healthy, sustainable, and profitable growth. The entire growth has been achieved through word of mouth with zero marketing spend, demonstrating organic adoption of the open-source platform.
Ghost 1.0 Released with Koenig Block Editor
Ghost reaches its 100th release with version 1.0, featuring the new Koenig block-based editor built on MobileDoc. The release includes 2,600+ commits and introduces the new Casper 2.0 theme, dark mode, and custom redirects. The editor supports both Markdown and rich media blocks.
Ghost 2.0 Adds Custom Routing and Multi-Language Support
Ghost 2.0 ships a new rich block editor as the default (Markdown is no longer the default, though it remains available as a card), custom site routing, content collections, and multi-language site support. The rigid single-stream blog structure is removed in favor of flexible site architectures.
Ghost Launches Headless CMS and Content API
Ghost officially supports use as a headless CMS with JAMstack architectures, enabling developers to use Ghost purely as a content backend with custom front-ends built with Gatsby or other static site generators. The new Content API (released the previous month) and Admin API enable full programmatic content management.
Ghost 3.0 Introduces Native Memberships and Subscriptions
Ghost 3.0 launches with built-in memberships, paid subscriptions via Stripe integration, and API-driven site architectures. Ghost takes no transaction fee on creator revenue, contrasting with competitors that take 10% or more. At this point, Ghost has generated $5 million in cumulative customer revenue while giving away 0% of the business.
TechCrunch Covers Ghost 3.0 Membership Launch
TechCrunch reports on Ghost 3.0's open-source subscription and membership capabilities, positioning Ghost as a direct alternative to Substack for independent publishers who want to own their platform and avoid platform commissions on subscriber revenue.
Ghost Pro Servers Compromised by SaltStack Crypto-Mining Attack
Attackers exploit critical SaltStack vulnerabilities (CVE-2020-11651, CVE-2020-11652) days after their public disclosure to compromise Ghost(Pro) infrastructure and install cryptocurrency mining malware, affecting Ghost(Pro) sites and billing services. Ghost(Pro) sites experience about 5 hours of intermittent downtime while additional security configurations are deployed. Ghost's incident report finds no customer data was accessed; as a precaution all keys, sessions, passwords and certificates are revoked and additional firewalls added.
Ghost Acquires Theme Studio IVEEL, Releases Themes Free
Ghost acquires IVEEL, a popular maker of premium Ghost themes, and its founder joins to lead a new theme team. The IVEEL themes, including the Dawn newsletter theme, are updated and released free under the MIT license; previous buyers keep their licenses, but the premium versions get no further updates.
Ghost 4.0 Ships Native Newsletters and Dashboard
Ghost 4.0 is released, over 20,000 commits after the original Kickstarter prototype. Memberships and subscriptions move out of beta into the core product, email newsletters are now natively built in, and a new dashboard shows how content and members are performing. The release also rebuilds the theme directory with live previews and automatic installs, and launches a new $9 Starter plan on Ghost(Pro).
Ghost 5.0 Adds Premium Tiers and Multiple Newsletters
Ghost 5.0 ships, adding custom premium tiers with monthly and yearly billing, multiple newsletters with independent branding, special promotional offers, audience segmentation, and 12 new editor card types. The dashboard gains expanded audience analytics and insights.
Ghost Launches Native Comments System
Ghost introduces native comments, one of its most requested features after search. Comments are member-only by default, which helps prevent spam. Owners and administrators can moderate inline, and members can report problematic comments. The first versions of comments and search were built in 5 days at a team retreat.
Critical Newsletter Authentication Bypass Discovered
CVE-2022-41654 (CVSS 9.6), discovered by Cisco Talos, reveals that newsletter members (unprivileged users) could modify or create newsletters via an API validation gap, potentially sending arbitrary content to all subscribers. The vulnerability affects Ghost 4.46.0-4.48.7 and all 5.x versions before 5.22.7. Ghost publishes its advisory and patches (4.48.8 / 5.22.7) on November 28, 2022; BleepingComputer reports the flaw after Talos's public disclosure in December.
Path Traversal Vulnerability Allows Unauthenticated File Reads
CVE-2023-32235 (CVSS 7.5) reveals that Ghost versions before 5.42.1 allow unauthenticated attackers to read arbitrary files within the active theme's folder via directory traversal in the /assets/built/ path.
Symlink Exploit Enables Arbitrary Host File Reads
CVE-2023-40028 is disclosed, showing that authenticated users can upload symlink files to Ghost CMS versions before 5.59.1, allowing them to read arbitrary files on the host operating system, including configuration files and credentials.
Ghost Partners with Tiny News Collective for Local Journalism
Ghost partners with the Tiny News Collective, upgrading all TNC publisher members from TNC's custom-built platform to Ghost(Pro) Creator plans. The partnership provides small, independent local news organizations with professional publishing infrastructure and customized resources to build audience engagement and revenue.
Ghost Launches Cross-Platform Recommendations Feature
Ghost ships a native Recommendations feature built on the open Webmentions standard, allowing publishers to recommend other sites regardless of platform. The feature tracks referral clicks and subscriptions bidirectionally, encouraging organic cross-promotion without walled gardens or vendor lock-in.
Ghost Dismisses Stored XSS Vulnerability as Invalid
Rhino Security Labs discloses CVE-2024-23724, a stored XSS vulnerability allowing privilege escalation to owner via malicious SVG profile pictures. Ghost initially dismisses it, stating 'all staff users are expected to be trusted.' Rhino submits a fix via pull request using DOMPurify. Ghost later merges the PR.
Ghost Confirms ActivityPub Federation Plans for 2024
Ghost officially announces plans to integrate ActivityPub and join the fediverse, enabling Ghost publications to interact with Mastodon, Threads, Flipboard, WordPress, and other federated platforms. The announcement positions Ghost as a pioneer in connecting independent publishing to the open social web.
Ghost Funds Fedify for ActivityPub Development
Ghost approaches Hong Minhee, creator of the Fedify framework (a specialized ActivityPub development toolkit), to fund the project and implement features needed for Ghost's ActivityPub service. Ghost builds its multi-tenant ActivityPub server on top of Fedify, investing directly in open-source fediverse infrastructure.
Ghost Joins as Founding Sponsor of Social Web Foundation
The Social Web Foundation launches with Ghost as a founding sponsor alongside Mastodon, Meta, Automattic, and Flipboard. The non-profit, led by Evan Prodromou and Mallory Knodel, aims to foster a growing, healthy, financially viable, and multi-polar fediverse. Ghost's sponsorship reflects its commitment to decentralized, open social infrastructure.
O'Nolan Publishes Governance Roadmap Amid WordPress Drama
In response to the WordPress/WP Engine governance crisis, John O'Nolan publishes 'Democratising Publishing,' outlining Ghost Foundation's governance structure and acknowledging that the two-founder board needs to expand. He commits to adding external trustees as Ghost approaches its 50-person headcount cap, arguing that community governance is essential.
Ghost Connects to Fediverse in Public Beta
Ghost opens its ActivityPub 'social web' integration as a beta for Ghost(Pro) sites. Publications become followable fediverse profiles (@index@yourdomain.com) that can receive likes, replies and reposts from Mastodon and other ActivityPub platforms, with a built-in reader for following others. Interactions with Threads do not yet work because Threads blocks them.
Ghost Pro Pricing Restructure Strips Starter Plan Features
Ghost restructures Ghost(Pro) pricing: the Starter plan moves from $9/mo to $15/mo (billed yearly) and its member limit rises from 500 to 1,000, but it loses paid subscriptions and tips and is limited to one theme and one staff user. The Creator plan ($25/mo) is replaced by the Publisher plan at $29/mo. Existing customers are grandfathered. Users on the Ghost Forum object to paying more for fewer features, and one review calls the change 'a big step back'.
Ghost 6.0 Launches with ActivityPub and Native Analytics
Ghost 6.0 ships as the platform's most significant release, integrating ActivityPub federation (connecting publications to Mastodon, Threads, Flipboard, Bluesky, and WordPress) and a native cookie-free analytics suite built on open-source ClickHouse. Publications become first-class social web entities with short-form Notes alongside long-form posts.
TechCrunch Covers Ghost 6.0 Open Social Web Launch
TechCrunch reports on Ghost 6.0 connecting to the open social web, positioning Ghost as a Substack rival. The coverage notes that Bluesky support works through the Bridgy Fed bridge, that Ghost publishers have earned over $100 million, and that Ghost's own annual revenue is $8.5 million.
Alison Roman Moves 343,000-Subscriber Newsletter from Substack to Ghost
Cookbook author Alison Roman moves A Newsletter from Substack to her own Ghost-powered site. Because both platforms use Stripe, subscribers stay subscribed and paid subscribers do not re-enter card details, which shows how portable a publisher's paid audience is on Ghost.
Ghost Relaunches Explore as a Ranked Discovery Engine
Ghost launches a rebuilt Ghost Explore discovery engine for independent Ghost publications. Ghost 6 sites are listed by default (public data only) and can opt out; the ranking algorithm is built mainly on ahrefs data, and sites that choose to share growth metrics can rank higher. A Social Web category helps readers find Ghost publications on the fediverse.
Ghost Patches Critical Content API SQL Injection (CVE-2026-26980)
Ghost releases 6.19.1 to fix an unauthenticated SQL injection in the Content API (CVSS 9.4) affecting versions 3.24.0 to 6.19.0, which lets attackers read the database, including Admin API keys. Ghost's advisory credits Nicholas Carlini of Anthropic, who found it using Claude, and recommends reviewing staff users and rotating keys. Ghost(Pro) sites are updated by Ghost; self-hosters must upgrade themselves.
Ghost Crosses $10M ARR
John O'Nolan announces that Ghost has crossed $10M in annual recurring revenue as a bootstrapped non-profit foundation, and that publishers have earned about $130M on Ghost. By September 2026 the foundation's public dashboard shows about $11.1M annual run rate and 30,579 active customers.
Ghost Recognized as a Digital Public Good
The Digital Public Goods Alliance recognizes Ghost as a digital public good after review against the DPG Standard, which covers open licensing, data privacy, platform independence and best practices. Ghost says it is the only publishing platform to have met the standard.
Patched Ghost Flaw Used to Hijack 700+ Unpatched Sites
QiAnXin XLab reports that at least two groups have used CVE-2026-26980, patched in February, to steal Admin API keys from unpatched Ghost sites and inject ClickFix malware loaders into articles. More than 700 sites were affected, including pages belonging to DuckDuckGo, Harvard and Oxford; attacks were first seen on May 7, 2026. The victims are sites that had not installed the update.
Ghost Adds Automated Email Sequences for New Members
Ghost launches email sequences in beta: publishers can build automated series of emails for new free and paid members in a drag-and-drop editor, and members can opt out of automated emails without unsubscribing from the newsletter. It follows welcome emails earlier in 2026, gift subscriptions and reader referrals.
Evidence (42 citations)
D1: User Value Erosion
D2: Business Customer Exploitation
D3: Shareholder Extraction
D4: Lock-in & Switching Costs
D5: Twiddling & Algorithmic Opacity
D6: Dark Patterns
D7: Advertising & Monetization Pressure
D8: Competitive Conduct
D9: Labor & Governance
D10: Regulatory & Legal Posture
Scoring Log (7 entries)
Checked 3 alternatives. WordPress: clarified self-hosting wording. Substack: 10% cut confirmed, reworded comparison with Ghost's zero cut and softened 'don't own your website' (Substack support, 2026 guides; record confirms Ghost 0%). Carrd: removed as a category mismatch (one-page builder, no newsletters or memberships). Added beehiiv (slug beehiiv): Launch free to 2,500 subs, Scale $43/mo annual with 0% take rate (beehiiv.com/pricing), $33M NEA-led Series B 2024. No typed-in site scores found.
Checked 2 trimmed claims: 0 restored, 0 partly restored, 2 confirmed removed. Ghost 4.0 (2021-03-16): '18 months of development' appears in neither ghost.org/changelog/4/ nor the GitHub v4.0.0 release; 'dark mode' is mentioned by WebDesignerDepot but Ghost Admin's 'Night shift' dark theme already existed by 2019 (Mozilla bug 1546707), so it was not a 4.0 feature; the 20,000-commit figure is already kept in its correct cumulative-since-Kickstarter form. Native comments: the '5.8.0' version is contradicted by the GitHub release notes, which list native comments under v5.9.0 (not added, since the item's changelog source does not state a version); 'second most requested' and 'staff' moderation were already correctly narrowed per the changelog.
Checked 69 items + prose. 33 verified, 30 corrected (14 date-only), 3 re-sourced, 3 removed (2 duplicates, 1 junk source). Invented or unsupported specifics: concept post title 'WordPress is Overkill' (real title 'Project Ghost'); ARR figures $940K (2018), $6.3M (2023), $10.4M (2024, only a getlatka estimate); '20K+ customers'; 'Ghost justified increases as necessary for sustainability'; 'conservative plan limits while benchmarking'; CVE-2023-32235 exposing config files/env vars. Also fixed: timeline[29]/evidence[21] cited a 2014 pricing post for the July 2025 restructure; timeline[20] cited the wrong CVE advisory; 'no acquisitions' (IVEEL 2020); Ghost 2.0 '50+ languages'; Trustpilot 2.1 -> ~2.5; SaltStack downtime and CVSS details.
10→10. No current dimension moved; all 10 re-derived from criteria. Since Feb 2026: critical Content API SQLi (CVE-2026-26980) patched Feb 16 and later used to hijack 700+ unpatched self-hosted sites (May 2026); ARR crossed $10M (Mar 2026), ~$11.1M by Sept; Digital Public Goods recognition (Apr 2026); feature releases (gifts, referrals, email sequences, GEO tools off by default); no price changes (the $18 Starter figure is the monthly-billing price, $15 yearly, unchanged since the July 2025 restructure); team ~40, no layoffs; governance still two-founder board. Earlier in window: Ghost Explore relaunched as ranked discovery engine, default listing with opt-out (Nov 2025); Alison Roman migration from Substack (Sept 2025). Eras: 'Kickstarter Launch' (2013-10-01) and 'Ghost Pro & 1.0 Maturity' (2017-07-01) merged into 'Nonprofit Blogging Tool' dated 2013-04-29 (Kickstarter launch; same hosting-funded character, and Ghost(Pro) began Jan 2014, not 2017); 'Membership Platform Pivot' re-dated 2019-10-01→2019-10-22 (Ghost 3.0); 'Creator Economy Era' re-dated 2022-05-01→2022-05-23 (Ghost 5.0), summary fixed (SaltStack May 2020 moved to prior era), D10 2→1 (recalibration: an initial CVE dismissal with no legal threat is not 'standard industry lobbying'); current era re-dated 2026-02-19 (assessment date)→2025-07-01 (Ghost(Pro) restructure, followed by Ghost 6.0) and relabeled 'Open Social Web'→'Social Web & Repricing'. Early-era D7 set to 1 from Ghost(Pro) launch and D4 to 1 throughout (image-export friction constant).