Total CMS 3.5 shipped last week, and 3.5.1 followed a few days later. Some of you have already updated. For everyone else, here’s the proper writeup — because this is the biggest release in the product’s history, big enough that I skipped a few version numbers to say so. 3.2 straight to 3.5.
Total CMS started as the best way to add real, editable content to a site you’d already built. With 3.5 it becomes a platform: build the whole site in it, extend the system itself, automate your content, and let an AI agent work on it without guessing.
What’s in it
Site Builder. Create pages, routes and templates right inside the admin. Add a page, set its URL, and it’s live — no build step, no generate command. There are four starter kits (minimal, blog, business, portfolio) that scaffold a complete site in one command, and an optional Vite frontend pipeline if you want one.
To be clear about what this isn’t: Site Builder is an option, not a requirement. Total CMS still works exactly the way it does today with Stacks, with hand-coded HTML, or with anything else that outputs HTML on a PHP server. Nothing about your existing sites changes.
Extensions. A real extension architecture — Twig functions, CLI commands, routes, admin nav, dashboard widgets, custom field types, event listeners, MCP tools. Every extension runs inside crash containment, so a broken one renders nothing instead of white-screening your site, and a review screen shows you exactly what it can reach before you enable it.
MCP server and OAuth 2.1. Agents like Claude, ChatGPT and Cursor can read and write your content through a standards-based interface, with full schema validation and the same event cascade as a normal save. The part I’d highlight for this room: the same access groups that govern your operators now govern your agents. “Let an agent into my site” is a permission decision you make in the same place you make every other permission decision, and a new Permission Matrix page shows what a given token could actually reach before you hand one out.
And MCP is no longer Pro-only. It comes with Standard now. Reading your content from an agent isn’t reserved for the top tier. Agent writes still need Pro, because that’s what API keys and the OAuth server unlock.
Automations (Pro) run your own PHP handlers on a schedule, a webhook, or a content event. Internationalization brings localized field types and an admin in seven languages. MarsEdit, Byword and Ulysses can now publish straight into Total CMS. And installs are Composer-based with a first-run Setup Wizard and a full tcms CLI.
Full detail in the release notes — it’s a long list and this is the short version.
Extensions are already happening
Jochen Abitz has five Total CMS 3 extensions out already — Quick Rules (free), Statser, Suki Gallery, Toolbar Wizard and TotalRecall. He built them against the beta and posted them five days after 3.5 shipped, which tells you something about how usable the extension API turned out to be. His announcement is right here in the community:
He’s running 20% off the paid four with the code EXT20 for a limited time. If you’ve been thinking about building one yourself, the Extension Starter repo demonstrates every extension point.
Before you update
3.5 is a platform release and a few things moved. Read this bit properly.
From 3.5:
- API routes now live under
/api/. Every content endpoint that used to sit at the root moved. External callers and webhook URLs need the prefix; server-side templating is unaffected. A few things deliberately moved out —/sitemap,/feeds, and ImageWorksdownload/andstream/. - Auth routes moved under
/admin/—/admin/login,/admin/logout, and so on. Custom login forms posting to the old paths need updating. - Template includes are namespaced — prefix paths with
templates/, e.g.{% include 'templates/header.twig' %}. - Whitelabel templates move to a
whitelabel/folder. The upgrade migrates anything already in awhitelabel/subfolder automatically. If you had whitelabel overrides saved outside it, open them in the admin and re-save so they take effect. - Session-authenticated API writes now need a CSRF token. Browser forms are fine. Scripts driving the API with a session cookie need updating. API-key callers are unaffected.
- Super admins are only recognised in the default auth collection. If you run several auth collections, check your operators still have the access you expect.
- Add
tcms-data/.system/site.keyto your backups. Theencrypt/decryptfilters are now keyed to a per-site secret instead of a constant that shipped in public source. Existing values keep working, but that file matters now.
And you’ll land on 3.5.1, so also:
- Everyone gets signed out once. Session files move into
tcms-data/.system/sessions, and sessions in the old location aren’t carried over. Anyone who used “keep me signed in” is restored automatically rather than bounced to the login form. - Behind a CDN that isn’t Cloudflare, set
trustProxyHeaders. Cloudflare and a reverse proxy on the same server keep working untouched. Any other CDN in front of the site needs$settings['trustProxyHeaders'] = 'always'— and its origin firewalled first, or that setting is an open door. Settings → Server Info tells you what your install is doing. - Regenerate any UPC-E or Codabar barcodes. Both were encoding incorrectly, so existing ones are wrong wherever they’ve been printed or saved.
tcms push --collectionschanged meaning — it now moves collection settings rather than objects. Use--pagesfor Site Builder page objects.--collection-metais removed and fails loudly.
3.5.1 also closes a rate-limiting bypass — client IP headers were being trusted unconditionally in seven places — so if you’re on 3.5.0, don’t sit on it.
Getting it
Existing site: update from the Stacks library, the T3 admin dashboard, or tcms update:apply. Composer install: composer update totalcms/cms then tcms cache:clear. New project: composer create-project totalcms/totalcms mysite.
New project: composer create-project totalcms/totalcms mysite. Or use Stacks!!!
As always — post here if something looks wrong after updating. I’d rather hear about it early.
Your Data. Your Agent. Working Together.