Skip to content
● Grav 2.2 is out: 2x faster cold starts and 96% less memory on big sites. Read the announcement →
Downloads

Everything Grav

Download Grav

Grav Core is the base package with core functionality and a few essential starting pages. Grav Core + Admin also includes the Administration Panel plugin. Both are easy to get started with — check out our Basic Tutorial and Guide to the Administration Panel.

STABLE · v2.2.9 · updated 1 day ago

Latest stable release

Production-ready. The version we recommend for every new site and every upgrade of an existing one.

Grav Core Grav Core + Admin2 plugin
Demo GitHub Repo Changelog

Get Started

1

Quick installation

  1. Download either the Grav Core or Grav Core + Admin2 plugin installation package.
  2. Extract the zip file into your webroot.
  3. Point your browser at your local webserver: http://yoursite.com
2

How to install the Admin2 plugin

If you have not already installed the admin plugin, you can do so easily with GPM:

$

This will install the admin plugin plus its dependencies (api & login). After this is complete, point your browser to your Grav installation and you will be prompted to create a new admin user.

Read the Documentation

Changelog

v2.2.9 Latest 1 day ago
    • Adding an environment folder such as user/env/<host>/ no longer creates a new security key for that host, which broke forms and sessions signed with the old one. The key stays in user/config, and a copy an earlier version put in an environment folder is moved there
    • A plugin or theme zipped from inside its own folder, or a zip made on macOS with a __MACOSX folder, now installs with bin/gpm direct-install and the admin's install-from-zip instead of failing with "Not a valid Grav package". Thanks @wakqasahmed #2688 #4357
    • Sites on PHP-FPM pools that disable getmypid() (a common hardening) no longer fail when the page index is rebuilt: its temporary database file is named with a random string instead of the process id. The scheduler's whoami() also checks for get_current_user() before calling it
v2.2.8 4 days ago
    • Plugins can react when an image is loaded with the new onImageMediumReset event, for example to queue a watermark or other action on every image from its own metadata
    • Setting only watermark_all for images in system.yaml no longer removes the watermark image, position and scale settings, and the watermark settings can now be edited in the Admin under Images
v2.2.7 4 days ago
    • The scheduler log no longer gets two lines written every minute when no job was due; runs that do work still log their full detail. Thanks @onetrev #4355
    • The compiled config, blueprints and languages caches are written to a temporary file and moved into place, and a damaged one is rebuilt, so a request arriving while the cache is being rewritten no longer fails with a blank error page. Thanks @omega8cc #4356
    • The scheduler's run summary in scheduler.log counted each successful job twice
v2.2.6 1 week ago
    • With the logs or cache folder moved by GRAV_LOG_PATH or GRAV_CACHE_PATH, the cache and backup jobs write their output to the moved logs folder, a job's output: can be a log:// path, and bin/grav cache-cleanup and the GPM permission check find the moved cache folder. Thanks @onetrev #4344
    • Scheduler history files older than the retention_days setting are now deleted, instead of collecting forever #4344
v2.2.5 2 weeks ago
    • Twig in page content can use the guard tag to check that a function, filter or test exists before calling it #4341
    • Folder settings in a .env file, such as GRAV_BACKUP_PATH and GRAV_TMP_PATH, now apply on hosts that turn off PHP's putenv() for web requests, and no longer write an error to the log on every request #4344
    • An SVG with only a viewBox now reports its real width and height, a viewBox separated by commas is understood, and a relative width such as 100% is no longer read as 100 pixels #4347
    • A redirect with a status code followed by a query string, such as /new[301]?a=1&b=2, is now sent with that status code and without the [301] in the address, instead of as a 302 to an address containing it #3320 #4343
    • A page's group permissions now deny every letter after a - up to the next +, so -c+r-ud, which the Admin saves for create, update and delete denied, no longer allows delete #4340
    • Query parameters reach the Admin and API on web servers that rewrite to index.php without passing the query string on, such as an nginx try_files line missing ?$query_string, so switching the editor to another language no longer loads the default language's page #4338
    • A form field directive written in page frontmatter can now only check whether its Flex object exists; directives in blueprint files are unchanged
    • The current page address no longer includes the visitor's HTTP Basic username and password when it is printed or turned into an array, and Uri::user() and Uri::password() are empty for the current request
v2.2.4 2 weeks ago
    • A page's Markdown version (<route>.md) and llms-full.txt include the full page again on sites running the Archives plugin, instead of only a title and navigation links #4339
    • An uploaded SVG whose doctype declares entities is no longer emptied by the sanitizer (rhukster/dom-sanitizer 1.0.19)
    • A multisite that keeps each site in user/env/<host>/ loads its theme, plugin and media files again. The bundled server configs protect config/, accounts/ and data/ inside each env folder the same way they protect them in user/, and the upgrade updates an existing .htaccess, and the user/env/.htaccess an earlier upgrade added, to match. Sites on nginx, Caddy, lighttpd or IIS need to copy the new rules from webserver-configs/ by hand #4335
    • Saving a page whose blueprint has a list containing only an elements field no longer fails with an error, and the fields inside each element now belong to their list item instead of the top of the blueprint, where they could clash with a field of the same name (rockettheme/toolbox 2.0.1) #4337
Full changelog on GitHub →
v2.2.9 Latest 1 day ago
    • Adding an environment folder such as user/env/<host>/ no longer creates a new security key for that host, which broke forms and sessions signed with the old one. The key stays in user/config, and a copy an earlier version put in an environment folder is moved there
    • A plugin or theme zipped from inside its own folder, or a zip made on macOS with a __MACOSX folder, now installs with bin/gpm direct-install and the admin's install-from-zip instead of failing with "Not a valid Grav package". Thanks @wakqasahmed #2688 #4357
    • Sites on PHP-FPM pools that disable getmypid() (a common hardening) no longer fail when the page index is rebuilt: its temporary database file is named with a random string instead of the process id. The scheduler's whoami() also checks for get_current_user() before calling it
v2.2.8 4 days ago
    • Plugins can react when an image is loaded with the new onImageMediumReset event, for example to queue a watermark or other action on every image from its own metadata
    • Setting only watermark_all for images in system.yaml no longer removes the watermark image, position and scale settings, and the watermark settings can now be edited in the Admin under Images
v2.2.7 4 days ago
    • The scheduler log no longer gets two lines written every minute when no job was due; runs that do work still log their full detail. Thanks @onetrev #4355
    • The compiled config, blueprints and languages caches are written to a temporary file and moved into place, and a damaged one is rebuilt, so a request arriving while the cache is being rewritten no longer fails with a blank error page. Thanks @omega8cc #4356
    • The scheduler's run summary in scheduler.log counted each successful job twice
v2.2.6 1 week ago
    • With the logs or cache folder moved by GRAV_LOG_PATH or GRAV_CACHE_PATH, the cache and backup jobs write their output to the moved logs folder, a job's output: can be a log:// path, and bin/grav cache-cleanup and the GPM permission check find the moved cache folder. Thanks @onetrev #4344
    • Scheduler history files older than the retention_days setting are now deleted, instead of collecting forever #4344
v2.2.5 2 weeks ago
    • Twig in page content can use the guard tag to check that a function, filter or test exists before calling it #4341
    • Folder settings in a .env file, such as GRAV_BACKUP_PATH and GRAV_TMP_PATH, now apply on hosts that turn off PHP's putenv() for web requests, and no longer write an error to the log on every request #4344
    • An SVG with only a viewBox now reports its real width and height, a viewBox separated by commas is understood, and a relative width such as 100% is no longer read as 100 pixels #4347
    • A redirect with a status code followed by a query string, such as /new[301]?a=1&b=2, is now sent with that status code and without the [301] in the address, instead of as a 302 to an address containing it #3320 #4343
    • A page's group permissions now deny every letter after a - up to the next +, so -c+r-ud, which the Admin saves for create, update and delete denied, no longer allows delete #4340
    • Query parameters reach the Admin and API on web servers that rewrite to index.php without passing the query string on, such as an nginx try_files line missing ?$query_string, so switching the editor to another language no longer loads the default language's page #4338
    • A form field directive written in page frontmatter can now only check whether its Flex object exists; directives in blueprint files are unchanged
    • The current page address no longer includes the visitor's HTTP Basic username and password when it is printed or turned into an array, and Uri::user() and Uri::password() are empty for the current request
v2.2.4 2 weeks ago
    • A page's Markdown version (<route>.md) and llms-full.txt include the full page again on sites running the Archives plugin, instead of only a title and navigation links #4339
    • An uploaded SVG whose doctype declares entities is no longer emptied by the sanitizer (rhukster/dom-sanitizer 1.0.19)
    • A multisite that keeps each site in user/env/<host>/ loads its theme, plugin and media files again. The bundled server configs protect config/, accounts/ and data/ inside each env folder the same way they protect them in user/, and the upgrade updates an existing .htaccess, and the user/env/.htaccess an earlier upgrade added, to match. Sites on nginx, Caddy, lighttpd or IIS need to copy the new rules from webserver-configs/ by hand #4335
    • Saving a page whose blueprint has a list containing only an elements field no longer fails with an error, and the fields inside each element now belong to their list item instead of the top of the blueprint, where they could clash with a field of the same name (rockettheme/toolbox 2.0.1) #4337
Full changelog on GitHub →