Open-source classifieds software, tested side by side
We installed three self-hosted classifieds platforms on the same server, gave each the same 50 listings, and measured them the same way. The results include where our own software lost.
Disclosure: we maintain ShopClass. To keep this fair, every app ran on an identical stack, was installed from its official release with its shipped defaults, and was measured by the same script. Speed was measured on 20 October 2026. The method is at the bottom of the page.
What we tested, and what we could not
- ShopClass 7.0.0, by Mindstellar, GPLv3. The renamed continuation of Mindstellar's Osclass 5.x.
- Osclass 8.4.0, by OsclassPoint, Apache 2.0. The other line of Osclass, separate since 2020.
- HivePress 1.7.31 with the free ListingHive theme, on WordPress 7.1.2. GPLv3.
- OpenClassify 4.2: not tested. It cannot be installed as published today: it needs a package,
a909m/filament-statefusion, whose source repository was deleted, socomposer installfails. It also runs only on PostgreSQL. - Yclas: not tested. Its source is no longer published on GitHub; only unofficial copies remain.
- LaraClassifier: not tested. It is commercial software under a CodeCanyon licence, not open source.
Performance
Server response is time to first byte, 100 requests per page after a warm-up. Pages a second is 10 users at once for 30 seconds, shown against HivePress with no cache, the slowest, which is 1×. Lighthouse is the mobile preset, median of three runs; single runs varied by up to 18 points.
- Home page
- Listing page
- Search page
| ShopClass 7.0.0 | Osclass 8.4.0 | HivePress 1.7.31 | |
|---|---|---|---|
| Server response, home (median) | 11 ms | 19 ms | 69 ms |
| Server response, listing (median) | 15 ms | 16 ms | 59 ms |
| Server response, search (median) | 14 ms | 21 ms | 73 ms |
| Pages a second, home, 10 users | 9.6× | 4.6× | 1× |
| Pages a second, listing, 10 users | 6.6× | 4.2× | 1× |
| Pages a second, search, 10 users | 8.5× | 3.8× | 1× |
| Lighthouse performance, home | 100 | 97 | 61 |
| Lighthouse performance, listing | 100 | 95 | 80 |
| Lighthouse performance, search | 100 | 90 | 83 |
| Main content shown (LCP), home | 1.7 s | 2.3 s | 3.9 s |
| Home page weight | 133 kB, 15 requests | 464 kB, 31 requests | 996 kB, 63 requests |
| PHP memory per page (peak) | 0.85 MB | 1.0 MB | 6.0 MB |
- With no cache at all, ShopClass served about twice as many home and search pages as Osclass, and 1.6 times as many listing pages.
- Memory is what PHP itself reported at the end of each request, median of 30 requests per page.
- HivePress is slower because WordPress does more work per page. Most WordPress sites add a caching plugin; these numbers are without one, as shipped.
Raw pages a second on the test droplet, home / listing / search, no cache: ShopClass 172 / 139 / 144, Osclass 83 / 88 / 65, HivePress 18 / 21 / 17. These depend on the machine; the ratios above are what carries over.
Caching
A classifieds site is mostly anonymous visitors reading the same pages, so a proxy or CDN cache is usually the biggest speed-up you can get. It only works if the app says which pages are safe to store, and clears them when a listing changes.
Speed with a cache turned on
The same load test, with each app's own memcached support switched on, then ShopClass with Valkey and its per-worker copy, then an nginx page cache in front. Every figure is against HivePress with no cache, which is 1×.
| ShopClass 7.0.0 | Osclass 8.4.0 | HivePress 1.7.31 | |
|---|---|---|---|
| Pages a second with memcached: home, listing, search | 12.2×, 7.9×, 12.4× | 8.6×, 5.5×, 6.2× | Not tested: WordPress has no memcached support of its own |
| Pages a second with Valkey and the per-worker copy: home, listing, search | 14.8×, 8.4×, 13.7× | Not possible: no Redis or Valkey support | Not tested |
| Pages a second with an nginx page cache: home, listing, search | 103×, 74×, 95× | Not possible: every page is sent as no-store | Not tested |
| Server response with an nginx page cache | 1 ms | Not possible | Not tested |
Raw pages a second, home / listing / search. memcached: ShopClass 219 / 166 / 211, Osclass 154 / 115 / 106. ShopClass with Valkey and the per-worker copy: 266 / 177 / 233. ShopClass with the nginx page cache: 1,854 / 1,558 / 1,608.
What each app tells a cache
| ShopClass 7.0.0 | Osclass 8.4.0 | HivePress 1.7.31 | |
|---|---|---|---|
| Cache-Control on public pages | public, s-maxage=30, so a proxy or CDN may store them (caching contract) | no-store, no-cache on every page | None sent |
| Personal pages marked never-cache | Yes (private, no-store) | Every page is no-store | No |
| nginx cache, cleared when a listing changes | Free plugin: nginx Cache (setup) | None found | Free plugin: Nginx Helper |
| Cloudflare cache, cleared when a listing changes | Free plugin: Cloudflare | None found | Free official Cloudflare plugin; full-page caching is easiest with APO, $5/month |
| Other page cache | None needed | Paid Cache plugin (€27.99) that saves pages as files in PHP | Many WordPress caching plugins |
- The nginx page cache used ShopClass's own reference settings, the same ones the free nginx Cache plugin builds on. The plugin adds clearing a page the moment its listing changes.
- Osclass sends every page as no-store, so a page cache cannot keep it without ignoring what the app asks for. We did not do that.
- The Cloudflare and WordPress plugin rows come from each plugin's own description; we did not benchmark them.
- Osclass also sets a session cookie on every first visit, which most CDN cache rules treat as "do not cache".
- On WordPress, cache rules must skip logged-in cookies by hand, because core does not mark personal pages.
Accessibility
Lighthouse runs axe-core checks. A high score does not prove a site is accessible, but a failed check is a real fault.
| ShopClass 7.0.0 | Osclass 8.4.0 | HivePress 1.7.31 | |
|---|---|---|---|
| Lighthouse accessibility, home | 100 | 84 | 82 |
| Lighthouse accessibility, listing | 100 | 85 | 74 |
| Lighthouse accessibility, search | 100 | 84 | 86 |
| Pinch-zoom on phones | Allowed | Blocked (maximum-scale=1) | Allowed |
| Failed checks | None | Colour contrast; zoom blocked; unlabelled links | Colour contrast; unlabelled buttons and links; heading order |
ShopClass passed every check Lighthouse runs on these pages. Osclass and HivePress fail colour contrast in their default themes.
Security
Read from each app's source code and checked against the running site. CVE counts are from the NVD; library advisories from composer audit on the bundled versions.
| ShopClass 7.0.0 | Osclass 8.4.0 | HivePress 1.7.31 | |
|---|---|---|---|
| How SQL queries get user input | Placeholders, with values escaped into the query by the driver; real prepared statements with one setting (database docs) | String escaping only; no prepared statements | WordPress $wpdb->prepare(), which escapes values into the SQL string |
| Password hashing | bcrypt, cost 12 | bcrypt, cost 15 | bcrypt |
| CSRF token on the login form | Yes | Yes | No, on neither wp-login.php nor the HivePress login form |
| CSRF token on the post-listing form | Yes | Yes | Yes |
| Login throttling, on by default | Per IP and per account (settings) | Per account | None |
| CAPTCHA options (off until keys set) | Turnstile or reCAPTCHA | reCAPTCHA | reCAPTCHA |
| Security headers on public pages | None | None | None |
| Cookies for a first-time visitor | None | 3, kept for 3 years | None |
| Upload checks | Extension and real file type; images re-encoded | Extension and real file type; images re-encoded | Extension and real file type; JPG and PNG only |
| CVEs published 2021–2026 (NVD) | 1: CVE-2024-27515 in Osclass 5.1.2, its predecessor; admin-only, fixed | ? None published. Its public repository opened in August 2026, with no earlier history and issues switched off, so outside review has only just started | 0 in HivePress; 3 in separate add-ons |
| Known advisories in bundled libraries | 0 | 0 | 0 |
- None of the three sends security headers such as Content-Security-Policy on public pages. Add them at your web server whichever you choose; our security guide shows how.
- The HivePress CVE count covers HivePress itself, not WordPress core, which has its own history.
- A CVE count only shows what outsiders found and reported. ShopClass and HivePress have developed in public for years, so anyone can read every change. OsclassPoint opened a public repository only in August 2026, so few outsiders have had the chance to check its code, and zero may simply mean nobody has looked yet.
Extensibility
For ShopClass and Osclass, hook counts are distinct names in the source. For HivePress they are call sites, because many of its hook names are built at runtime. HivePress also inherits WordPress's thousands of hooks.
| ShopClass 7.0.0 | Osclass 8.4.0 | HivePress 1.7.31 | |
|---|---|---|---|
| Licence | GPLv3+ (inherited Osclass code: Apache 2.0) | Apache 2.0 | GPLv3 (WordPress: GPLv2+) |
| Plugins and themes | Yes | Yes | Yes, as WordPress plugins and themes |
| Hooks and filters | 297 hooks, 208 filters (developer docs) | 447 hooks, 445 filters | 186 hook calls, plus all of WordPress |
| REST API in core | Yes: listings, users, comments and admin, with webhooks (API docs) | No | Yes: WordPress, plus 18 HivePress routes |
| Command-line tool | Built in (oc-cli.php) | None; cron runs by URL | WP-CLI, a separate download |
| Extension catalogue | 14 plugins, 4 themes in the built-in catalogue | osclasspoint.com, mostly paid | ~20 HivePress extensions (5 free), plus the WordPress directory |
| Built-in price and location fields | Yes | Yes | No, added as custom attributes |
Which one fits you
ShopClass
The fastest and lightest here, with or without a cache, and the only one that passed every accessibility check. Login throttling, Turnstile and a command-line tool are built in, and free plugins clear the nginx or Cloudflare cache when a listing changes. Its catalogue of extensions is small.
Osclass (OsclassPoint)
Fast, and memcached helps it a lot. It has the most hooks and a large paid market of themes and plugins at osclasspoint.com. It blocks zoom on phones by default, and a page cache needs a paid plugin.
HivePress
The pick if you already run WordPress: a REST API and the whole WordPress plugin world. Slowest and heaviest here, with no login throttling unless you add it.
To try ShopClass, open the live demo, read the install guide, or get the code on GitHub. Running Osclass already? See how the two Osclass lines differ.
How we tested
- Date: speed, memory and server response on 2026-10-20, all three apps in one session, two rounds each. Lighthouse scores for Osclass and HivePress are from 2026-10-02; their versions have not changed since.
- Machine: a DigitalOcean CPU-Optimized droplet with 2 dedicated vCPUs. The load tool ran on the same droplet, which is why we show speed against HivePress, not as raw numbers.
- Containers, identical for all:
php:8.4-fpmwith OPcache, limited to 2 CPU cores and 1 GB of memory, 8 static workers;nginx:1.27-alpinewith gzip;mariadb:11.4, limited to 1 GB with a 256 MB buffer pool; memcached and Valkey, where used, limited to 128 MB. Each app ran alone in Docker; the others were stopped. - Install: the latest stable release from each official source, production mode, shipped defaults. ShopClass and Osclass used their bundled theme; HivePress used ListingHive, its free official theme, installed separately. The main tables use no cache.
- Cache runs: memcached 1.6 with 64 MB, and the same PHP image plus the memcached extension for both apps, each switched on in its own config. Valkey 8 with 64 MB for ShopClass, through phpredis, with and without
OSC_CACHE_LOCAL(APCu). The page cache is nginx's FastCGI cache with ShopClass's reference settings. - Data: the same 5 categories and 50 listings, each with one 1200×800 JPEG, created through each app's own code so thumbnails were made the normal way.
- Changes from defaults: ShopClass and Osclass needed "allow listings in top-level categories" switched on to accept the flat category list, and both got the same site description. HivePress needed price and city added as attributes, and a front page built from its blocks as its docs describe.
- Tools: Python timing loop for response time,
heyfor load, Lighthouse 12.8 for page scores, PHP's own peak memory at the end of each request,composer auditfor libraries.
These numbers come from one test setup. Your hosting, theme and plugins will change them.