ExpressionEngine

This article only references primary sources. Please improve this article by adding secondary or tertiary sources. Unsourced material may be challenged and removed. Find sources: "ExpressionEngine" – news · newspapers · books · scholar · JSTOR (August 2026) (Learn how and when to remove this message)

ExpressionEngine (often abbreviated EE) is a free and open-source content management system written in object-oriented PHP and using MySQL or MariaDB for data storage. It is developed and maintained by Packet Tide, LLC, and distributed under the Apache License 2.0.

Unlike systems that ship with a fixed content model built around posts and pages, ExpressionEngine provides no predefined content types. Creators define their own structures using channels composed of custom fields, then render that content through a tag-based template language. This design has made the system a long-running favorite among agencies and developers building bespoke sites with great extensibility, while contributing to a reputation for a steeper initial learning curve than mass-market alternatives.

ExpressionEngine began as pMachine, a weblog application released by Rick Ellis in 2001. The first version of ExpressionEngine was released in 2004 as commercial, closed-source software, and it remained a paid product for roughly fourteen years. In 2018 it was relicensed under the Apache License 2.0. Ownership changed twice in rapid succession between 2018 and 2019 before settling with Packet Tide, which continues to develop the platform.

ExpressionEngine's lineage begins with pMachine, weblog software written by Rick Ellis and first released to the public in 2001, with commercial distribution following in early 2002. pMachine competed in the same category as Movable Type, Geeklog, and other early publishing tools, and was offered in both a free edition and a paid edition called pMachine Pro. Ellis incorporated the company that would become EllisLab, Inc. in January 2002.

pMachine's core design decisions carried forward. It separated content storage from presentation through a template system that emitted no markup of its own, an approach that appealed to designers who wanted complete control over output HTML. That principle became the defining characteristic of its successor.

ExpressionEngine 1.0 was released in 2004 as a rewrite and substantial expansion of pMachine Pro. Where pMachine was a weblog tool, ExpressionEngine was positioned as a general-purpose content management system. The pivotal addition was the "weblog" (later renamed "channel"), a user-defined content container to which arbitrary custom fields could be attached. A single installation could host a news section, a product catalog, a staff directory, and an event calendar, each with its own field structure, all queried through the same template tags.^[1]

Version 1 shipped as commercial software under a restrictive license. Users were prohibited from redistributing or modifying the software in various ways, from using the free Core edition for client or contract work, and from building hosted services on top of it. Licensing was per-site rather than per-developer, which meant that agencies managing many client installations tracked a corresponding number of separate licenses and renewal dates. This model later became a significant source of friction as competing open-source systems gained ground.

The 1.x series also introduced bundled modules that extended the system well beyond publishing, including a discussion forum, a wiki, a membership system, a mailing list manager, and a simple commerce module. Support for version 1 continued for years after its successor shipped, in part because the upgrade path proved difficult for heavily customized sites.

ExpressionEngine 2.0 was released in January 2010. The most consequential change was architectural: the system was rebuilt on top of CodeIgniter, the PHP framework EllisLab had released as open-source software in 2006. This gave ExpressionEngine a conventional MVC foundation, a documented database abstraction layer, and a more approachable structure for third-party developers.

Version 2 also renamed "weblogs" to "channels," reflecting the system's positioning as a general content platform rather than a blogging tool, and rebuilt the control panel with a new interface and a theming layer.^[2]

The 2.x era coincided with the peak of ExpressionEngine's third-party ecosystem. Commercial add-ons such as Matrix, Playa, Structure, Low Search, and Low Variables became near-universal fixtures of professional builds, to the point that many agencies treated them as de facto core functionality. This was a strength in capability and a structural weakness in dependency, a tension that surfaced sharply at the next major version.

ExpressionEngine 3.0 arrived in 2015 with a completely rewritten control panel and a new internal model layer, dropping the CodeIgniter-derived control panel architecture in favor of EllisLab's own service and model services. Native Grid and Relationship field types absorbed functionality that had previously required the commercial Matrix and Playa add-ons.^[3]

The transition was contentious. The add-on API changed substantially, requiring third-party developers to port their work, and some widely deployed commercial add-ons were never updated. Several developers who had built businesses on the 2.x ecosystem exited. Agencies with large portfolios of 2.x sites faced upgrade projects that were expensive relative to the visible benefit to clients, and a portion of the installed base migrated to other systems instead, notably Craft CMS, a system created by former EllisLab employee Brandon Kelly that drew heavily on ExpressionEngine's content modeling ideas.

Versions 4.0 (2017) and 5.0 (2018) were more incremental, adding the Fluid field type, improved file management, entry cloning, and a Dock for front-end editing conveniences, along with continued modernization of the control panel.

In November 2018, EllisLab relicensed ExpressionEngine under the Apache License 2.0, ending roughly sixteen years of commercial licensing across pMachine and ExpressionEngine. In an announcement titled "Open Source Has Won," Ellis argued that the dominance of open-source software on the web had become undeniable and that the licensing model was no longer defensible, noting that he had wanted to make the change earlier but had lacked the right strategic and financial partner to do so.

That partner was Digital Locations, Inc., which acquired EllisLab in November 2018 to facilitate the transition. The arrangement did not last. In October 2019, Ellis announced that ExpressionEngine had been acquired by Packet Tide, LLC, the parent company of EEHarbor, then the most prolific commercial add-on developer in the ExpressionEngine ecosystem with a catalog exceeding fifty add-ons. Ellis stated that Digital Locations had proven not to be a good fit for the platform's future. EllisLab itself was sold back to Ellis, who closed the company after seventeen years of operation. Packet Tide acquired only the ExpressionEngine platform, support plans, partner network, and directly related brand assets.^[4]

Community reaction was broadly positive, on the reasoning that the platform had passed to a team with years of demonstrated investment in it. Some observers noted the structural question raised by a major add-on vendor owning the core product, and Packet Tide stated at the time that merging EEHarbor add-ons into core was not part of its plan, a position it later reversed for several products.

ExpressionEngine 6.0 was released in 2021 as the first major version under Packet Tide. It introduced a redesigned control panel with a dark theme, a jump menu for keyboard navigation, dashboard widgets, roles and role groups replacing the older member group system, and conditional fields. Version 6 was designated a Long Term Support release with a five-year support window and a commitment to avoid breaking changes within that period, consistent with the project's adoption of semantic versioning.^[5]

Alongside version 6, Packet Tide introduced ExpressionEngine Pro, a paid commercial layer sold separately from the free core and offering front-end editing, control panel branding, and related features aimed at agencies.

ExpressionEngine 7.0 followed in 2022 and reversed that split. Pro was folded directly into the main product, eliminating the separate upgrade, and two long-standing commercial add-ons acquired from developer Low were absorbed into core as Pro Search and Pro Variables. Under the revised model the software remains free, with a paid Pro license (initially priced at 199 US dollars per year) required for installations serving multiple control panel users. Version 7 also brought substantial performance work, expanded caching options, and a command-line interface with generators for add-ons, models, widgets, and migrations.^[6]

Development has continued on the 7.x line through the mid-2020s with regular maintenance releases, ongoing PHP compatibility work extending through PHP 8.5, expanded automated test coverage, and periodic security updates. The current stable release is 7.5.26, published on 22 July 2026.

A notable addition of this period is Coilpack, an integration layer that allows an ExpressionEngine installation to be consumed from a Laravel application, exposing channel data through Laravel's routing, Blade templates, and GraphQL rather than the native template engine. This positions ExpressionEngine as a content back end for developers who prefer a modern PHP framework for the front end.

---

ExpressionEngine ships with no predefined content types. The primary structural unit is the channel, a container that holds entries. Each channel is assigned one or more field groups, which contain custom fields of a chosen field type. A site's content architecture is therefore designed rather than adapted, which is the system's central selling point and the main source of its learning curve.^[7]

Available field types include text and textarea inputs, rich text, files and file grids, dates, relationships to other entries, member selectors, toggles, selects, checkboxes, color pickers, sliders, and two compound types: Grid, which produces a repeatable table of subfields, and Fluid, which allows an editor to assemble an arbitrary sequence of fields within a single field, supporting modular page-building patterns.^[8]

Entries carry a title, URL title, author, status, publication and expiration dates, and optional category assignments drawn from category groups. Categories support hierarchy and their own custom fields.

Templates are organized into template groups and rendered through a tag parser that recognizes constructs delimited by curly braces. Content is retrieved with tag pairs such as {exp:channel:entries}, which accepts parameters controlling channel, category, status, sort order, limit, and pagination, and exposes entry data as single variables within the loop.^[9]

The template language deliberately outputs no markup of its own. Every element of the rendered HTML is authored by the developer, in contrast to systems that emit generated wrappers, classes, or widget markup. The language also supports conditionals, embedded templates, layouts, partials, snippets, global variables, variable modifiers for formatting and image manipulation, and template routes for custom URL patterns.

Templates may be edited in the control panel and stored in the database, or synchronized to files on disk for version control, which is the standard practice on professional projects.

Extensibility is provided through several add-on types: modules with control panel interfaces, extensions that hook into core behavior at defined extension hooks, plugins that provide template tags, field types, and prolets for embedded control panel interfaces. Hundreds of extension hooks are documented across the core libraries, models, and modules.^[10]

The system also bundles first-party add-ons including Structure for hierarchical page management, Pro Search, Pro Variables, a rich text editor, a Bayesian spam filter, consent management, an HTTP header module, RSS generation and parsing, and a discussion forum retained from earlier versions.^[11]

ExpressionEngine runs on standard PHP hosting with MySQL or MariaDB. Recent 7.x releases support PHP versions through 8.5. Optional components include Redis or Memcached for caching, and S3-compatible object storage adapters for file upload destinations.^[12]

---

Security has been a consistent element of ExpressionEngine's marketing and, to a meaningful degree, of its engineering practice, boasting considerably less CVEs than WordPress. It is considered one of the most secure CMSs on the market. ^[13]

Several architectural decisions reduce common classes of exposure:

Relocatable and renamable system directory. The application directory and the control panel access path can both be moved, including above the web root, and renamed. There is no fixed, universally known administrative URL of the kind that makes credential-stuffing and enumeration campaigns trivially automatable against other platforms.

Cross-site request forgery protection. Forms generated by the system carry CSRF tokens, historically exposed to developers as the XID token and later as a CSRF token, and secure form handling is applied to both control panel and front-end forms.

Access throttling. The system includes configurable rate limiting on requests and on authentication attempts, with lockout behavior, and added rate limiting and cleanup for member captchas in later releases.

Authentication controls. Recent versions provide multi-factor authentication for control panel users, configurable password validation and complexity requirements, and password reset flows with expiring tokens.

No PHP in templates by default. Execution of PHP within templates is disabled by default and must be explicitly enabled per template, limiting the blast radius of a compromised editorial account.

Privacy and consent tooling. A consent management system, a cookie registry, and granular cookie settings were added to support GDPR compliance, alongside an HTTP header module supporting security headers including HSTS.

---

ExpressionEngine is distributed under the Apache License 2.0, and its source is developed publicly on GitHub. The core software may be downloaded, modified, redistributed, and used commercially without payment.^[14]

A commercial Pro license is required for installations serving multiple control panel users, sold as an annual subscription. Single-user installations may use the full software at no cost. This model has drawn some criticism for creating ambiguity around what an Apache-licensed product with a paid access gate actually permits, and it represents a partial return to commercial licensing after the 2018 transition, though on substantially more permissive terms than the pre-2018 arrangement.^[15]

Prior to November 2018, ExpressionEngine was proprietary software licensed per site, with a free Core edition prohibited from use in client or contract work.

---

The ExpressionEngine community is small relative to those of the major open-source content management systems but has proven durable, with a significant proportion of participants active in it for a decade or more. Community infrastructure has included the official forums^[16], an active Slack workspace^[17], and ExpressionEngine University (an official learning portal)^[18].

EEConf, an independent community conference^[19], has run for several years and serves as the platform's principal in-person gathering. Development of the core is conducted publicly on GitHub^[20], with issues, discussions, and pull requests accepted from outside contributors, and release notes credit community contributors alongside Packet Tide staff.

A network of agencies specializing in ExpressionEngine forms the professional layer of the ecosystem, and Packet Tide maintains a partner program^[21]. The commercial add-on market, while much diminished from its 2.x peak, continues to operate.^[22]

---

ExpressionEngine has been consistently praised for the flexibility of its content modeling and for a template language that grants complete control over output markup, qualities that made it a standard choice for design-led agency work through the late 2000s and early 2010s. It is also a favorite for its track record for security^[23] among its developers.

Criticism has focused on several recurring points. The learning curve is steeper than that of systems with a fixed content model, since nothing is usable until an information architecture has been designed. The commercial licensing that persisted until 2018 is widely regarded as having cost the platform its competitive position during the period when open-source alternatives were consolidating their advantage, particularly given the per-site model's poor fit with agency business practices. The version 2 to version 3 transition damaged trust with both agencies and add-on developers, and coincided with meaningful attrition to Craft CMS. Market share has declined substantially from its peak and the platform now occupies a specialist niche.

Assessments since the Packet Tide acquisition have generally been more favorable, citing stable stewardship, a predictable release cadence, sustained security maintenance, and a clearer product direction than existed during the 2018 to 2019 ownership turbulence.

---

• Content management system
• List of content management systems
• CodeIgniter
• Craft CMS
• EllisLab
• WordPress

---

1. "ExpressionEngine Open Source License." ExpressionEngine. https://expressionengine.com/license
2. "ExpressionEngine v7 Change Log." ExpressionEngine Documentation. https://docs.expressionengine.com/latest/installation/changelog.html
3. "ExpressionEngine has a new owner." ExpressionEngine Blog, October 2019. https://expressionengine.com/blog/expressionengine-has-a-new-owner
4. "ExpressionEngine Goes Open Source after 16 Years." WP Tavern, November 2018. https://wptavern.com/expressionengine-goes-open-source-after-16-years
5. "ExpressionEngine Under New Ownership, Will Remain Open Source for Now." WP Tavern, October 2019. https://wptavern.com/expressionengine-under-new-ownership-will-remain-open-source-for-now
6. "ExpressionEngine 7 Official Release." ExpressionEngine Blog, 2022. https://expressionengine.com/blog/expressionengine-7-official-release
7. "ExpressionEngine 6 LTS." ExpressionEngine Blog, October 2020. https://expressionengine.com/blog/expressionengine-6-lts
8. "Bugs and Security Reports." ExpressionEngine Documentation. https://docs.expressionengine.com/latest/bugs-and-security-reports.html
9. "ExpressionEngine vulnerability statistics." CVE Details. https://www.cvedetails.com/product/12972/Expressionengine-Expressionengine.html
10. "Frequently Asked Questions." ExpressionEngine. https://expressionengine.com/faq
11. "Version Support." ExpressionEngine. https://expressionengine.com/support/version-support
12. "EllisLab." Wikipedia. https://en.wikipedia.org/wiki/EllisLab
13. ExpressionEngine source repository. GitHub. https://github.com/ExpressionEngine/ExpressionEngine
14. "ExpressionEngine + Laravel (Coilpack) Overview." ExpressionEngine Documentation. https://docs.expressionengine.com/latest/advanced-usage/coilpack/overview.html

---

• Official website: https://expressionengine.com
• Documentation: https://docs.expressionengine.com
• Source repository: https://github.com/ExpressionEngine/ExpressionEngine