Flarum

Flarum is a modern open-source forum platform engineered for communities that demand both elegance and performance. Built on a PHP backend with Laravel-inspired architecture and a reactive Mithril.js frontend, it delivers the responsive, real-time discussion experience users expect without the configuration overhead of legacy forum systems like phpBB or vBulletin.

What sets Flarum apart is its composable extension system: every feature — from tags and sticky posts to private messages and GDPR compliance — ships as a first-party Composer package that can be installed, updated, or removed independently. The v2.x release, currently in release candidate stage, bundles over 19 first-party extensions including realtime WebSocket notifications, user mentions, emoji support, and audit logging.

Flarum is designed for self-hosters who want forum software that doesn’t punish them for caring about design. The admin panel provides a clean interface for managing extensions, themes, and permissions without touching configuration files. A JSON:API-compliant REST API and robust extension hooks make it straightforward to integrate Flarum with existing websites, authenticate against external user databases, or build entirely custom frontend experiences.

What You Get

• Bundled Extension Suite - Ships with 19 first-party extensions including tags, mentions, private messages, emoji, GDPR tools, audit logs, and realtime WebSocket notifications — no separate installs required.
• Mithril.js Reactive Frontend - A performant, lightweight JavaScript frontend with a minimal footprint that renders fast on mobile and desktop without heavy dependencies like Vue or React.
• JSON:API-Compliant REST API - Every resource endpoint follows the JSON:API specification, enabling predictable integrations with external apps, custom frontends, and mobile clients.
• Granular Permission System - User groups with per-category, per-action permissions that extension authors can register additional controls into, supporting complex moderation hierarchies.
• Extension Admin Panel - Install, update, configure, and toggle extensions directly from the browser with no CLI required for day-to-day administration.
• Real-Time Notifications - WebSocket or SSE-powered live updates for replies, mentions, and likes without page reloads, powered by the bundled realtime extension.
• GDPR Compliance Tools - Built-in data export, right-to-erasure workflows, and consent management through the bundled flarum/gdpr extension.
• Composer-Based Extensibility - The extension ecosystem spans hundreds of community packages installable via Composer, covering social login, polls, Q&A voting, badges, and more.

Common Use Cases

• Self-hosted developer community - A software team replaces GitHub Discussions with a branded Flarum instance, using tags for feature requests vs bug reports and the API to sync GitHub logins.
• Gaming guild or clan forum - A multiplayer game community uses Flarum’s sticky posts, user badges, and custom themes to create a branded home for strategy discussions and event coordination.
• Customer support community - A SaaS company deploys Flarum with Q&A voting and approval-based posting to let customers help each other while moderators surface verified answers.
• Academic or research group - A university lab uses Flarum’s private messaging and tag permissions to coordinate internal project discussions while keeping a public area for external collaborators.
• Niche enthusiast community - An audiophile site uses Flarum with BBCode support, subscription notifications, and custom extensions to host in-depth product review threads.

Under The Hood

Architecture Flarum employs a cleanly separated two-tier architecture: a PHP backend following a service-oriented design with explicit middleware pipelines, and a Mithril.js frontend consuming a JSON:API-compliant REST API. The extension system is the central architectural concept — extensions register bindings into a dependency injection container, subscribe to event hooks, and declare frontend component overrides through typed PHP extender objects, all without modifying core files. This composable model means adding capabilities like realtime notifications or GDPR tooling is purely additive. The backend layers are distinctly separated across HTTP routing, middleware, controllers, serializers, and repositories, with each extension injecting into any layer through the extender API. The skeleton repository is intentionally thin — its sole role is declaring which extensions compose the installation, making deployments reproducible and version-controllable through Composer.

Tech Stack The backend runs PHP 8.1+ with a Laravel-influenced service container and routing system from the flarum/framework package, with Eloquent ORM handling database access against MySQL or PostgreSQL. The frontend uses Mithril.js — a lightweight virtual-DOM framework deliberately chosen for startup performance on shared hosting environments rather than heavier options. Asset bundling adopts Vite in v2 for faster development builds. The bundled realtime extension integrates Mercure or native WebSockets for server-sent events. Installation follows standard PHP deployment conventions with Apache or Nginx pointing at the public directory, and all PHP dependencies managed through Composer’s strict version constraints. Notable first-party packages cover social features including likes, mentions, subscriptions, tags, moderation flags, sticky posts, content approval, private messages, and GDPR compliance.

Code Quality The skeleton repository is intentionally a configuration layer with no executable application logic — the actual framework maintains comprehensive PHPUnit test coverage across its service, repository, and API layers. The skeleton’s PHP files carry clear inline documentation explaining each bootstrapping step, and the extend.php customization entrypoint follows the typed extender pattern cleanly. Composer’s strict version constraints ensure reproducible installations and prevent silent upgrades across the extension graph. The underlying framework enforces PSR-12 coding standards and uses PHPStan for static analysis, providing strong type safety guarantees despite PHP’s dynamic nature. Community extensions vary in quality, but the first-party suite maintains consistent standards.

What Makes It Unique Flarum’s primary innovation is its typed extender pattern: rather than hooking into arbitrary events or overriding template files, extensions declare their modifications through strongly-typed PHP objects that the core service container validates and applies. This creates a self-documenting, IDE-friendly extension API that surfaces conflicts at installation time rather than runtime. The bundled realtime extension uses Mercure — a modern SSE-over-HTTP/2 standard — rather than raw WebSocket infrastructure, giving self-hosters a standards-aligned real-time stack that works through reverse proxies without special server configuration. The combination of this extender-based API, a deliberately lightweight Mithril frontend, and a fully self-hostable feature set makes Flarum the most architecturally coherent option in the PHP forum space.

Self-Hosting

Flarum is released under the MIT License, which is one of the most permissive open-source licenses available. This means you can use, modify, and distribute Flarum for any purpose — including commercial deployments — without paying licensing fees or sharing your customizations. There are no copyleft obligations: if you fork Flarum or build a product on top of it, you are not required to open-source your changes. The only requirement is preserving the copyright notice in the source files, which is a trivial condition. The first-party extensions bundled in the standard installation are similarly MIT-licensed.

Running Flarum yourself requires a PHP 8.1+ environment with Composer, a MySQL or PostgreSQL database, and a web server such as Nginx or Apache. The initial installation is straightforward via Composer, and the admin panel handles extension management without requiring SSH access for routine tasks. However, you remain responsible for all operational concerns: server provisioning, SSL certificate management, database backups, PHP and extension upgrades, and responding to security advisories. The v2.x line (currently in release candidate) introduces breaking changes from v1.x, so upgrading between major versions requires careful extension compatibility checks. Community extensions vary in maintenance quality, and finding compatible versions can add friction during upgrades.

Flarum does not currently offer an official managed cloud hosting service or paid enterprise tier — the project is fully community and foundation-funded. This means you give up managed upgrades, SLA-backed support, and professional onboarding that commercial alternatives provide. Community support is available through the official Flarum discussion forum and Discord server, but there are no paid support contracts. Some third-party hosting providers offer Flarum-specific managed hosting. For teams evaluating trade-offs, the absence of an enterprise tier is actually an advantage for cost-sensitive deployments, but organizations needing guaranteed response times or high-availability infrastructure will need to build and maintain that themselves.