keystonejs.com — Traffic, Worth & Safety

KeystoneJS is an open-source headless CMS and GraphQL API framework built with TypeScript by Thinkmill (an Australian software consultancy). The platform provides a schema-first approach where developers define content models in TypeScript and KeystoneJS generates a GraphQL API, admin UI, and database schema automatically. KeystoneJS 6 (current version) is built on Prisma ORM and supports PostgreSQL and SQLite. The project has 8,500+ GitHub stars and is used by organizations including the Australian Government and Westpac.

Based on our analysis, keystonejs.com does not appear to use HTTPS and scores 0% on security headers. There is room for improvement in security configuration.

keystonejs.com is missing 5 of 5 recommended security headers (Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, X-XSS-Protection). This leaves visitors more exposed to browser-based attacks.

KeystoneJS provides built-in authentication with session management, access control lists definable per field and operation, and input validation. The platform uses Prisma for database access, which provides parameterized queries preventing SQL injection. The open-source codebase is publicly auditable. Self-hosted deployments inherit the customer's security posture. The admin UI supports custom authentication strategies and session configuration.

All values are estimates based on publicly available traffic data.

KeystoneJS competes with Payload (similar TypeScript-first approach), Strapi (more popular, JavaScript), and Directus (database-first). The platform's strength is its clean TypeScript API and Prisma integration — developers familiar with the Prisma ecosystem feel immediately at home. KeystoneJS is less commercially aggressive than Strapi or Payload (no VC funding, maintained by a consultancy), which means slower feature development but also no pressure to monetize aggressively.

KeystoneJS is maintained by Thinkmill, the consultancy that also created Changesets (versioning tool used by thousands of monorepos) and contributes to the React ecosystem. The platform's "document field" provides a structured rich-text editor that outputs JSON (not HTML), enabling portable content rendering across platforms. KeystoneJS 6 was a complete rewrite focusing on TypeScript-first development with Prisma for database access. The admin UI is automatically generated from the schema definition with zero configuration.