A Blog and Website You Actually Own
Hosted blogging platforms are convenient right up until the pricing changes, the export is incomplete, or the service shuts down. Inkwell takes the opposite position: the platform is free and MIT licensed, the code is on GitHub, and every post and page lives in a SQL Server database you control.
It is built on ASP.NET Core MVC with Dapper on .NET 10, renders plain server-side HTML for speed and search visibility, and covers both halves of a content site. Posts get a WYSIWYG or Markdown editor with drafts, scheduling and editorial review. Pages get a drag-and-drop block builder (or Markdown), contact forms, header and footer navigation menus and their own SEO fields, so the About, Services and Contact pages live next to the blog instead of in a second system. One installed binary can host many separate sites, each with its own look and authors.
There is no plugin marketplace, no usage tier and no phone-home. If you are a .NET shop that wants publishing under your own roof, this is the stack you already know.
Free and Open Source
MIT licence. Fork it, extend it, run it commercially — no per-seat or per-site fees, ever.
No Telemetry, GDPR by Design
No external API calls and no usage reporting. Reader data never leaves your infrastructure.
Built on .NET 10
ASP.NET Core MVC, Dapper and Microsoft SQL Server — a stack your existing .NET team can maintain.
Posts for the Blog. Pages for the Website.
Inkwell is more than a post feed. Pages are a separate content type for the parts of a site that don't belong in a blog: About, Services, Pricing, Contact and campaign landing pages. You build them in the same Desk, with the same theme, and they live in the same database as your posts.
Drag-and-Drop Page Builder
Drag blocks from the palette onto the canvas, reorder them, and edit each one's settings in the side panel. The post editor uses the same builder, so your editors only learn one tool.
These are the blocks in release v1.0.9. The Form block (pages only) places a form built in Admin → Forms, gallery blocks open in a self-hosted lightbox, and videos embed from a pasted URL.
Menus and Site Structure
The Menus manager builds header and footer navigation from pages, categories, tags, series and custom links, nested one level. Menu items point at content by id, so renaming a slug never breaks the menu.
SEO on Every Page
Each page has its own slug, meta title, meta description, canonical URL, Open Graph and Twitter Card fields and a featured image. Published pages are sent to IndexNow straight away.
Custom Fields
Define your own text, number, date, web address or yes/no fields for pages. Fields marked “Show to readers” appear as a Details list on the page.
Revisions and Permissions
Every saved change keeps a revision you can compare and restore. A separate pages permission decides who may edit the website pages, and each change is written to the audit trail.
Contact Forms
Build forms in Admin → Forms with up to 20 fields, including a required consent box, and place them with the Form block. Spam checks, email notifications, webhooks, CSV export and a retention period you set per form.
Visual or Markdown Pages
Write a page in the visual editor or in Markdown, with the same server-rendered preview as posts. Switching an existing page keeps it looking exactly the same, or is refused.
Everything a Publication Needs, Nothing It Doesn't
The editorial, design, SEO and operations tooling that shipped across releases v1.0.1 to v1.0.9.
Visual or Markdown Editor
Compose posts and pages in the Quill WYSIWYG editor, or switch to Markdown with a server-rendered preview. Save drafts, schedule for later and publish when ready.
20 Layouts × 16 Presets
Structure and colour are separate: pick an editorial Layout, pair it with a colour Preset — 320 combinations without touching a stylesheet.
Multi-Tenant Built In
One install serves many sites. Switch DeploymentMode to Cloud and each tenant is isolated by its URL slug, with its own Layout and Preset. No second deployment.
SEO Built In
Server-rendered HTML, structured-data validation before publish, IndexNow instant indexing, internal-link suggestions and a 301/302/410 redirect manager.
Analytics and AI-Crawler Reports
Built-in dashboard with UTM and geo breakdowns, plus reporting on which AI crawlers fetch your content and an answer-engine readiness score.
Immutable Audit Trail
Every admin action is logged and cannot be edited afterwards — useful for multi-author teams and for compliance reviews.
Newsletter Sending
Double opt-in subscribers, then write, preview, test and send issues through your own SMTP server in batches, with one-click unsubscribe and no tracking pixels.
IP Firewall
Automatic threat scoring blocks hostile traffic at the application layer, and the Content Health dashboard flags posts that need maintenance.
WordPress and Ghost Importers
Bring an existing site across: WordPress WXR exports and Ghost JSON or ZIP archives import with posts, pages and authors intact.
Search Console in the Admin
Connect Google Search Console and see 28-day clicks, impressions, CTR and position per post, with striking-distance pages flagged.
Revision History
Every post and page keeps its revisions, with line-level diffs and one-click restore. Restores are themselves undoable.
Honest Traffic Numbers
Views are counted by a self-hosted beacon, and crawlers are verified against published IP lists, so bots and scrapers do not inflate your stats.
Editorial Review and Roles
Admin, Editor and Author roles with granular permissions. Authors without publish rights submit for review, and editors approve or send back with a note.
Two-Factor Sign-In
Authenticator-app codes with single-use recovery codes, and Admins can require two-factor sign-in for a whole role.
Backup, Restore and Export
One-ZIP whole-site backups that restore into a fresh install, export to WordPress (WXR) or a Ghost import ZIP, or a push straight to a live WordPress or Ghost site. Your content never gets stuck in Inkwell.
Responsive Images
Every JPEG, PNG and WebP upload gets 480, 800 and 1200 px WebP copies served with srcset, plus width, height and lazy loading, so phones download a small copy and text does not jump.
Accessibility Checks
The editors flag missing or file-name alt text, skipped heading levels, "click here" links, tables without headers and very long paragraphs, with an Accessibility view in Content Health.
Content Calendar
A month view of published and scheduled posts, and dated drafts, in the site's time zone. Each entry opens its editor; on a phone the month becomes a list.
Right-to-Left Sites
Sites in Arabic, Hebrew, Persian, Urdu and other right-to-left languages read right to left, with every Layout and Preset mirrored. The direction follows the site language.
Headless API
Fetch published pages with GET /api/v1/pages/{slug}, and read and write typed custom fields on posts, for headless front ends and integrations.
Page-View Retention
Choose how long page-view details are kept (31 to 3,650 days). Older details are removed hourly while Analytics keeps every figure from its daily summary.
Layouts Set the Structure. Presets Set the Mood.
Most blog themes bundle page structure and colour into one package, so changing the palette means changing the theme. Inkwell splits them. A Layout decides how the front page, post and archive templates are composed; a Preset decides the palette, type scale and spacing — from warm paper whites to near-black dark modes.
Any of the 20 Layouts pairs with any of the 16 Presets, and each tenant on the same install can run a different combination. Switching is a configuration change — no rebuild, no migration.
Three Steps to a Running Site
A normal ASP.NET Core deployment — if you have shipped a .NET app before, nothing here will surprise you.
Clone and Run
Three commands from the README: git clone, cd inkwell, dotnet run. With SQL Server LocalDB that is a working local instance.
Configure
Copy appsettings.example.json to appsettings.json and set the SQL Server connection string. There is no migration step: the schema is created and updated automatically on startup.
Publish and Deploy
Publish the binary and put it behind IIS, Caddy or nginx with TLS. Runs on Linux, Windows Server or macOS. Or run docker compose up for the app, SQL Server and Caddy with automatic HTTPS.
What a Single-Tenant Install Needs
Modest by design — a small VPS runs one publication comfortably. Add RAM as you add tenants.
ASP.NET Core MVC with Dapper and raw SQL for data access. The runtime alone is enough for hosting.
Microsoft SQL Server in production; SQL Server LocalDB is fine for development.
The floor for a single tenant. Scale up as you add publications and traffic.
Behind a reverse proxy (IIS, Caddy or nginx) terminating TLS, or in Docker.
Who Inkwell Is For — and Who It Isn't
We would rather you pick the right tool than pick ours.
A good fit when
- Your team already runs .NET and SQL Server and wants publishing on the same stack.
- You need several publications — brands, regions, clients — from one install, each with its own look.
- Data residency, GDPR or a no-third-party-scripts policy rules out hosted platforms.
- You want the blog and the website pages (About, Services, Contact, landing pages) managed in one system instead of two.
- You are migrating off WordPress or Ghost and want the importer to do the heavy lifting.
Look elsewhere when
- You want a fully hosted service with zero server responsibility — Inkwell is self-hosted only.
- You need PostgreSQL, MySQL or SQLite — Microsoft SQL Server is the only supported database.
- Your workflow depends on a plugin marketplace — Inkwell has none; features are built into the core or added as code.
- You need a static-site generator or a Git-based Markdown workflow — Inkwell is a database-backed app with a visual editor.
How Inkwell Compares
Publicly documented defaults, October 2026. Every one of these is a capable choice.
| Platform | Stack | Hosting model | Editor | Multi-site from one install |
|---|---|---|---|---|
|
In
Inkwell
This product |
.NET 10 ASP.NET Core SQL Server
|
Self-hosted, free (MIT) | WYSIWYG, Markdown and page builder | Yes — Per-tenant Layout and Preset |
|
W
WordPress
|
PHP MySQL / MariaDB
|
Self-hosted (GPL) or WordPress.com | Block editor (Gutenberg) | Yes — Via Multisite |
|
G
Ghost
|
Node.js MySQL
|
Self-hosted (MIT) or Ghost(Pro) | Koenig block editor | No — One site per install |
|
H
Hugo
|
Go Static files
|
Static hosting (Apache-2.0) | Markdown files | No — Separate builds per site |
Comparison reflects each platform's publicly documented defaults as of October 2026. The right one depends on your stack and hosting appetite.
PHP2Shell and Your Site: What It Means for Inkwell and WordPress
On 21 October 2026 PHP released emergency fixes for CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell”. Both are remote-code-execution flaws that need no login, and both score 9.2 on CVSS v4.0. Every PHP runtime that serves web requests is in scope, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Public exploit code is out, and attacks were reported before the fixes shipped.
Inkwell Has No PHP Runtime
Inkwell is a compiled ASP.NET Core application on .NET 10, served by Kestrel or IIS. No PHP interpreter sits in its request path, so these two CVEs do not apply to Inkwell itself. You have nothing to patch on the Inkwell side.
Check the Rest of the Server
If the same machine also runs PHP, such as an old WordPress install, phpMyAdmin or a contact-form script, that software is still exposed. Patch it or remove it. Moving the blog to .NET doesn't help if a forgotten PHP app is still running next to it.
No Stack Is Vulnerability-Free
.NET has security bugs too. Install Microsoft's monthly .NET 10 servicing updates and keep Inkwell on its latest release. Inkwell is safe from this incident only because of its stack, so keeping that stack patched is still your job.
Running WordPress Today?
- Upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your vendor's patched package), then restart the PHP workers.
- Treat config workarounds such as
session.upload_progress.enabled=0as stopgaps only. Patching is the only fix. - On shared hosting, confirm with your host that the patch is live. Hosts roll it out on their own schedule.
- Review access logs from 17 October onward. Exploit attempts were seen before the disclosure date.
Two ways PixoBots can help
Patch and harden the WordPress site you have now through our WordPress team, or move it to Inkwell with the built-in WXR importer.
Sources: PHP security advisory of 21 October 2026; CISA alert; Datadog Security Labs. A separate, narrower advisory (CVE-2026-115560, 23 October) is not fixed by these releases. See PHP's advisory for details.
The Software Is Free. The Help Is Optional.
Run Inkwell yourself at no cost, or have the team that builds it do the deployment, the upkeep or the design. Prices as published on useinkwell.app.
Installation
- Production deployment on your infrastructure
- Database provisioning and backups configured
- TLS, reverse-proxy and DNS handover
- One tenant, one Layout, one Preset
- 30-day post-launch warranty
Support Retainer
- Priority issue triage on your repo
- Security patches within 48 hours
- Quarterly version upgrades, in place
- Up to 4 hours of minor work each month
- Private email and scheduled office hours
Enhancement
- Discovery call and written scope
- Fixed-bid quote per feature
- Pull request against your fork
- Tests, documentation and migration scripts
- Two rounds of revisions included
Studio Theme
- Brand and typography consultation
- Custom Layout (templates and partials)
- Custom Preset (palette, type, spacing)
- Responsive across every breakpoint
- Source files, yours to keep
USD prices; EUR and GBP equivalents are listed on useinkwell.app. Every engagement starts with a written scope, and quotes come back within two working days.
Release History
Tagged releases since June 2026, each with full notes on GitHub.
-
v1.0.925 Oct 2026
Contact forms with a page-builder Form block; Markdown pages; responsive WebP images; push straight to WordPress or Ghost; accessibility checks in the editors; content calendar; right-to-left sites; headless pages API; a redesigned admin; and a working one-command Docker deployment.
-
v1.0.86 Oct 2026
Newsletter sending over your own SMTP; Markdown authoring for posts; two-factor sign-in; export to WordPress and Ghost; whole-site backup and restore; editorial review; navigation menus; webhooks; custom fields for posts and pages; gallery block; self-hosted cookie consent.
-
v1.0.727 Sep 2026
Hardened Docker deployment (multi-stage, non-root, health-checked) with a compose stack; crawler identity verification; beacon-based page-view counting; irreversible HMAC-SHA256 IP hashes.
-
v1.0.624 Sep 2026
Google Search Console integration; revision history with diffs and restore; self-service password reset; comment spam gate; built-in job scheduler; admin UI and accessibility overhaul with dark theme.
-
v1.0.55 Sep 2026
Pre-publish structured-data validation stops broken schema from shipping; answer-engine readiness scoring; AI-crawler analytics; redirect manager and internal-link suggestions.
-
v1.0.415 Aug 2026
IP Firewall with automatic blocking; Content Health dashboard; WordPress (WXR) and Ghost importers.
-
v1.0.229 Jul 2026
SEO overhaul: scored-roundup content system, IndexNow instant indexing, new Layouts, error-monitoring subsystem.
-
v1.0.127 Jun 2026
Analytics dashboard, immutable audit trail, Layout and Preset theme system, newsletter and subscriber management, structured-data enhancements.
Full notes: github.com/marutisoftwaresolutions/inkwell/releases
Publish on Your Own Terms
Clone Inkwell and run it yourself, or tell us about your publication and we will scope the install, the migration and the theme.