Open-source classifieds software, tested side by side
We installed three self-hosted classifieds platforms on the same server, gave each the same 50 listings, and measured them the same way. The results include where our own software lost.
Disclosure: we maintain ShopClass. To keep this fair, every app ran on an identical stack, was installed from its official release with its shipped defaults, and was measured by the same script. The method is at the bottom of the page.
What we tested, and what we could not
- ShopClass 6.4.0, by Mindstellar, GPLv3. The renamed continuation of Mindstellar's Osclass 5.x.
- Osclass 8.4.0, by OsclassPoint, Apache 2.0. The other line of Osclass, separate since 2020.
- HivePress 1.7.31 with the free ListingHive theme, on WordPress 7.1.2. GPLv3.
- OpenClassify 4.2: not tested. It cannot be installed as published today: it needs a package,
a909m/filament-statefusion, whose source repository was deleted, socomposer installfails. It also runs only on PostgreSQL. - Yclas: not tested. Its source is no longer published on GitHub; only unofficial copies remain.
- LaraClassifier: not tested. It is commercial software under a CodeCanyon licence, not open source.
Performance
Server response is time to first byte, 100 requests per page after a warm-up. Requests per second is 10 users at once for 30 seconds. Lighthouse is the mobile preset, median of three runs; single runs varied by up to 18 points.
| ShopClass 6.4.0 | Osclass 8.4.0 | HivePress 1.7.31 | |
|---|---|---|---|
| Server response, home (median) | 5 ms | 7 ms | 40 ms |
| Server response, listing (median) | 6 ms | 8 ms | 33 ms |
| Server response, search (median) | 6 ms | 10 ms | 42 ms |
| Requests/sec, home, 10 users | 541 | 327 | 41 |
| Requests/sec, listing, 10 users | 377 | 301 | 49 |
| Requests/sec, search, 10 users | 474 | 231 | 39 |
| Lighthouse performance, home | 100 | 97 | 61 |
| Lighthouse performance, listing | 100 | 95 | 80 |
| Lighthouse performance, search | 100 | 90 | 83 |
| Main content shown (LCP), home | 1.7 s | 2.3 s | 3.9 s |
| Home page weight | 132 kB, 15 requests | 464 kB, 31 requests | 996 kB, 63 requests |
| PHP memory per page (peak) | 0.8 MB | 1.0 MB | 6.0 MB |
| PHP server memory after load, 8 workers | 38 MB | 53 MB | 106 MB |
- With no cache at all, ShopClass handled 1.7 times the home page traffic of Osclass, and twice its search traffic.
- Memory is what PHP itself reported at the end of each request, median of 30 requests per page.
- HivePress is slower because WordPress does more work per page. Most WordPress sites add a caching plugin; these numbers are without one, as shipped.
Caching
A classifieds site is mostly anonymous visitors reading the same pages, so a proxy or CDN cache is usually the biggest speed-up you can get. It only works if the app says which pages are safe to store, and clears them when a listing changes.
Speed with a cache turned on
The same load test, first with each app's own memcached support switched on, then with an nginx page cache in front.
| ShopClass 6.4.0 | Osclass 8.4.0 | HivePress 1.7.31 | |
|---|---|---|---|
| Requests/sec with memcached: home, listing, search | 555, 408, 501 | 449, 320, 274 | Not tested: WordPress has no memcached support of its own |
| Requests/sec with an nginx page cache: home, listing, search | 7,584, 6,292, 6,492 | Not possible: every page is sent as no-store | Not tested |
| Server response with an nginx page cache | 0.5 ms | Not possible | Not tested |
What each app tells a cache
| ShopClass 6.4.0 | Osclass 8.4.0 | HivePress 1.7.31 | |
|---|---|---|---|
| Cache-Control on public pages | public, s-maxage=30, so a proxy or CDN may store them (caching contract) | no-store, no-cache on every page | None sent |
| Personal pages marked never-cache | Yes (private, no-store) | Every page is no-store | No |
| nginx cache, cleared when a listing changes | Free plugin: nginx Cache (setup) | None found | Free plugin: Nginx Helper |
| Cloudflare cache, cleared when a listing changes | Free plugin: Cloudflare | None found | Free official Cloudflare plugin; full-page caching is easiest with APO, $5/month |
| Other page cache | None needed | Paid Cache plugin (€27.99) that saves pages as files in PHP | Many WordPress caching plugins |
- The nginx page cache used ShopClass's own reference settings, the same ones the free nginx Cache plugin builds on. The plugin adds clearing a page the moment its listing changes.
- Osclass sends every page as no-store, so a page cache cannot keep it without ignoring what the app asks for. We did not do that.
- The Cloudflare and WordPress plugin rows come from each plugin's own description; we did not benchmark them.
- Osclass also sets a session cookie on every first visit, which most CDN cache rules treat as "do not cache".
- On WordPress, cache rules must skip logged-in cookies by hand, because core does not mark personal pages.
Accessibility
Lighthouse runs axe-core checks. A high score does not prove a site is accessible, but a failed check is a real fault.
| ShopClass 6.4.0 | Osclass 8.4.0 | HivePress 1.7.31 | |
|---|---|---|---|
| Lighthouse accessibility, home | 100 | 84 | 82 |
| Lighthouse accessibility, listing | 100 | 85 | 74 |
| Lighthouse accessibility, search | 100 | 84 | 86 |
| Pinch-zoom on phones | Allowed | Blocked (maximum-scale=1) | Allowed |
| Failed checks | None | Colour contrast; zoom blocked; unlabelled links | Colour contrast; unlabelled buttons and links; heading order |
ShopClass passed every check Lighthouse runs on these pages. Osclass and HivePress fail colour contrast in their default themes.
Security
Read from each app's source code and checked against the running site. CVE counts are from the NVD; library advisories from composer audit on the bundled versions.
| ShopClass 6.4.0 | Osclass 8.4.0 | HivePress 1.7.31 | |
|---|---|---|---|
| How SQL queries get user input | Prepared statements with bound parameters; a few older queries still escape strings | String escaping only; no prepared statements | WordPress $wpdb->prepare(), which escapes values into the SQL string |
| Password hashing | bcrypt, cost 12 | bcrypt, cost 15 | bcrypt |
| CSRF token on the login form | Yes | Yes | No, on neither wp-login.php nor the HivePress login form |
| CSRF token on the post-listing form | Yes | Yes | Yes |
| Login throttling, on by default | Per IP and per account (settings) | Per account | None |
| CAPTCHA options (off until keys set) | Turnstile or reCAPTCHA | reCAPTCHA | reCAPTCHA |
| Security headers on public pages | None | None | None |
| Cookies for a first-time visitor | None | 3, kept for 3 years | None |
| Upload checks | Extension and real file type; images re-encoded | Extension and real file type; images re-encoded | Extension and real file type; JPG and PNG only |
| CVEs published 2021–2026 (NVD) | 1: CVE-2024-27515 in Osclass 5.1.2, its predecessor; admin-only, fixed | ? None published. Its public repository opened in August 2026, with no earlier history and issues switched off, so outside review has only just started | 0 in HivePress; 3 in separate add-ons |
| Known advisories in bundled libraries | 0 | 0 | 0 |
- None of the three sends security headers such as Content-Security-Policy on public pages. Add them at your web server whichever you choose; our security guide shows how.
- The HivePress CVE count covers HivePress itself, not WordPress core, which has its own history.
- A CVE count only shows what outsiders found and reported. ShopClass and HivePress have developed in public for years, so anyone can read every change. OsclassPoint opened a public repository only in August 2026, so few outsiders have had the chance to check its code, and zero may simply mean nobody has looked yet.
Extensibility
For ShopClass and Osclass, hook counts are distinct names in the source. For HivePress they are call sites, because many of its hook names are built at runtime. HivePress also inherits WordPress's thousands of hooks.
| ShopClass 6.4.0 | Osclass 8.4.0 | HivePress 1.7.31 | |
|---|---|---|---|
| Licence | GPLv3+ (inherited Osclass code: Apache 2.0) | Apache 2.0 | GPLv3 (WordPress: GPLv2+) |
| Plugins and themes | Yes | Yes | Yes, as WordPress plugins and themes |
| Hooks and filters | 287 hooks, 183 filters (developer docs) | 447 hooks, 445 filters | 186 hook calls, plus all of WordPress |
| REST API in core | No (import API as a plugin) | No | Yes: WordPress, plus 18 HivePress routes |
| Command-line tool | Built in (oc-cli.php) | None; cron runs by URL | WP-CLI, a separate download |
| Extension catalogue | 12 plugins, 3 themes in the built-in catalogue | osclasspoint.com, mostly paid | ~20 HivePress extensions (5 free), plus the WordPress directory |
| Built-in price and location fields | Yes | Yes | No, added as custom attributes |
Which one fits you
ShopClass
The fastest and lightest here, with or without a cache, and the only one that passed every accessibility check. Login throttling, Turnstile and a command-line tool are built in, and free plugins clear the nginx or Cloudflare cache when a listing changes. Its catalogue of extensions is small.
Osclass (OsclassPoint)
Fast, and memcached helps it a lot. It has the most hooks and a large paid market of themes and plugins at osclasspoint.com. It blocks zoom on phones by default, and a page cache needs a paid plugin.
HivePress
The pick if you already run WordPress: a REST API and the whole WordPress plugin world. Slowest and heaviest here, with no login throttling unless you add it.
To try ShopClass, open the live demo, read theinstall guide, or get the code onGitHub. Running Osclass already? See how the two Osclass lines differ.
How we tested
- Date: 2026-10-02.
- Machine: Intel Core i3-12100, 16 GB RAM, Docker 29. Each app ran alone; the others were stopped.
- Stack, identical for all:
php:8.4-fpmwith OPcache (2 CPUs, 1 GB limit, 8 static workers),nginx:1.27-alpinewith gzip,mariadb:11.4. - Install: the latest stable release from each official source, production mode, shipped defaults. ShopClass and Osclass used their bundled theme; HivePress used ListingHive, its free official theme, installed separately. The main tables use no cache.
- Cache runs: memcached 1.6 with 64 MB, and the same PHP image plus the memcached extension for both apps, each switched on in its own config. The page cache is nginx's FastCGI cache with ShopClass's reference settings.
- Data: the same 5 categories and 50 listings, each with one 1200×800 JPEG, created through each app's own code so thumbnails were made the normal way.
- Changes from defaults: ShopClass and Osclass needed "allow listings in top-level categories" switched on to accept the flat category list, and both got the same site description. HivePress needed price and city added as attributes, and a front page built from its blocks as its docs describe.
- Tools: Python timing loop for response time,
heyfor load, Lighthouse 12.8 for page scores, PHP's own peak memory at the end of each request,composer auditfor libraries.
These numbers come from one machine. Your hosting, theme and plugins will change them.