Skip to content
● Grav 2.2.19 and 1.7.53.8 are out with security fixes found by Anthropic's OSS Scanner: update your sites. Read more →
Downloads

Everything Grav

Download Grav

Grav Core is the base package with core functionality and a few essential starting pages. Grav Core + Admin also includes the Administration Panel plugin. Both are easy to get started with — check out our Basic Tutorial and Guide to the Administration Panel.

STABLE · v2.2.24 · updated 17 hours ago

Latest stable release

Production-ready. The version we recommend for every new site and every upgrade of an existing one.

Grav Core Grav Core + Admin2 plugin
Demo GitHub Repo Changelog

Get Started

1

Quick installation

  1. Download either the Grav Core or Grav Core + Admin2 plugin installation package.
  2. Extract the zip file into your webroot.
  3. Point your browser at your local webserver: http://yoursite.com
2

How to install the Admin2 plugin

If you have not already installed the admin plugin, you can do so easily with GPM:

$

This will install the admin plugin plus its dependencies (api & login). After this is complete, point your browser to your Grav installation and you will be prompted to create a new admin user.

Read the Documentation

Changelog

v2.2.24 Latest 17 hours ago
    • Running a plugin's test suite against a Grav checkout no longer leaves a user/config/security-private.php in the plugin's folder, where a git add -A could commit it into the plugin's release. Grav now creates the key file only in a real Grav install, and code that loads Grav's classes from anywhere else gets a key that lasts for that process
v2.2.23 3 days ago
    • When a cache file can't be deleted, the cache purge job and bin/grav clear now name the file and the reason (such as "Permission denied") instead of "Unknown error", and carry on with the rest of the cache instead of stopping at the first one (#4384)
    • [security] The svg_image() Twig function now escapes the classes it adds to the SVG. Thanks @manus-pi
    • [security] The svg_image() Twig function only inlines real .svg files, so a theme that takes the image path from a page header can no longer be pointed at other files on the server
v2.2.22 4 days ago
    • On servers with the PHP yaml extension, a YAML file with a plain y, yes, on, off, n or no key keeps that key instead of turning it into 1 or 0, so settings such as an image's y: size and the YES/NO language strings load the same as on servers without the extension
    • An asset added by the site's own full URL, such as url('theme://css/custom.css', true), or by a link that starts with the site's subfolder, no longer renders with the host or subfolder twice
v2.2.21 5 days ago
    • A plugin that adds a scheduler job as a class method (such as [$this, 'method']) without an id, or with its id where the job's arguments go, no longer crashes every scheduler run and empties the admin's job list #4380
v2.2.20 6 days ago
    • Updating or reinstalling a plugin swaps the new copy in all at once, so the site never runs with the plugin missing or half copied, and the old copy is put back if the new one cannot be moved in
    • JSON sent to the site is now checked against size limits before it is read, so an oversized request is turned away quickly instead of tying up the server (limits are under request.json in system.yaml)
    • Sites behind a proxy that ends HTTPS (such as Cloudflare in front of a server on port 80) no longer redirect visitors to the address with :80 added, for example when reloading the admin
v2.2.19 6 days ago
    • A number field given a value too large for an integer no longer causes a warning on PHP 8.5
    • The bundled lighttpd.conf loads on current lighttpd releases again, serves /.well-known/ files such as ACME challenges, and keeps Markdown source files and the same folders and file types private as the Apache rules do (lighttpd sites copy the updated rules from webserver-configs/ by hand)
    • The bundled Caddyfiles also keep JSON files under system/, vendor/ and user/, Markdown source files such as CHANGELOG.md, the webserver-configs/ folder and hidden files inside /.well-known/ private (Caddy sites copy the updated rules from webserver-configs/ by hand)
    • The bundled nginx.conf also keeps Markdown source files such as CHANGELOG.md and the webserver-configs/ folder private, and matches root files such as composer.json in any letter case (nginx sites copy the updated rules from webserver-configs/ by hand)
    • The bundled IIS web.config also keeps LICENSE.txt, composer.json, composer.lock and Markdown source files private, covers the same file types under system/ and vendor/ as the Apache rules, and matches its rules however a file path is written (IIS sites copy the updated rules from webserver-configs/ by hand)
    • The php -S development router (system/router.php) keeps tmp/, user/config/, user/accounts/ and user/data/ private and refuses scripts in images/ and assets/, the same as the shipped web-server rules
    • [security] The Apache .htaccess exception for /.well-known/ now covers that folder only, so other hidden files and folders whose names start with well-known stay blocked. Upgrading updates existing .htaccess files
Full changelog on GitHub →
v2.2.24 Latest 17 hours ago
    • Running a plugin's test suite against a Grav checkout no longer leaves a user/config/security-private.php in the plugin's folder, where a git add -A could commit it into the plugin's release. Grav now creates the key file only in a real Grav install, and code that loads Grav's classes from anywhere else gets a key that lasts for that process
v2.2.23 3 days ago
    • When a cache file can't be deleted, the cache purge job and bin/grav clear now name the file and the reason (such as "Permission denied") instead of "Unknown error", and carry on with the rest of the cache instead of stopping at the first one (#4384)
    • [security] The svg_image() Twig function now escapes the classes it adds to the SVG. Thanks @manus-pi
    • [security] The svg_image() Twig function only inlines real .svg files, so a theme that takes the image path from a page header can no longer be pointed at other files on the server
v2.2.22 4 days ago
    • On servers with the PHP yaml extension, a YAML file with a plain y, yes, on, off, n or no key keeps that key instead of turning it into 1 or 0, so settings such as an image's y: size and the YES/NO language strings load the same as on servers without the extension
    • An asset added by the site's own full URL, such as url('theme://css/custom.css', true), or by a link that starts with the site's subfolder, no longer renders with the host or subfolder twice
v2.2.21 5 days ago
    • A plugin that adds a scheduler job as a class method (such as [$this, 'method']) without an id, or with its id where the job's arguments go, no longer crashes every scheduler run and empties the admin's job list #4380
v2.2.20 6 days ago
    • Updating or reinstalling a plugin swaps the new copy in all at once, so the site never runs with the plugin missing or half copied, and the old copy is put back if the new one cannot be moved in
    • JSON sent to the site is now checked against size limits before it is read, so an oversized request is turned away quickly instead of tying up the server (limits are under request.json in system.yaml)
    • Sites behind a proxy that ends HTTPS (such as Cloudflare in front of a server on port 80) no longer redirect visitors to the address with :80 added, for example when reloading the admin
v2.2.19 6 days ago
    • A number field given a value too large for an integer no longer causes a warning on PHP 8.5
    • The bundled lighttpd.conf loads on current lighttpd releases again, serves /.well-known/ files such as ACME challenges, and keeps Markdown source files and the same folders and file types private as the Apache rules do (lighttpd sites copy the updated rules from webserver-configs/ by hand)
    • The bundled Caddyfiles also keep JSON files under system/, vendor/ and user/, Markdown source files such as CHANGELOG.md, the webserver-configs/ folder and hidden files inside /.well-known/ private (Caddy sites copy the updated rules from webserver-configs/ by hand)
    • The bundled nginx.conf also keeps Markdown source files such as CHANGELOG.md and the webserver-configs/ folder private, and matches root files such as composer.json in any letter case (nginx sites copy the updated rules from webserver-configs/ by hand)
    • The bundled IIS web.config also keeps LICENSE.txt, composer.json, composer.lock and Markdown source files private, covers the same file types under system/ and vendor/ as the Apache rules, and matches its rules however a file path is written (IIS sites copy the updated rules from webserver-configs/ by hand)
    • The php -S development router (system/router.php) keeps tmp/, user/config/, user/accounts/ and user/data/ private and refuses scripts in images/ and assets/, the same as the shipped web-server rules
    • [security] The Apache .htaccess exception for /.well-known/ now covers that folder only, so other hidden files and folders whose names start with well-known stay blocked. Upgrading updates existing .htaccess files
Full changelog on GitHub →