How to Choose Open-Source Ecommerce Software

Updated September 2026.

WooCommerce fits a merchant who already has, or can hire, a WordPress developer and wants a theme-and-plugin storefront with no per-order fee. Magento Open Source fits a team with a real engineering budget that needs deep catalog and B2B logic, and can commit to a new major version every few years, because Adobe retires its patches on a clock nobody resets for you. Saleor, Medusa, Vendure, Sylius, and Spree fit a team treating commerce as an API, not a website. PrestaShop, OpenCart, and nopCommerce fit smaller catalogs where an agency or a host runs the server. Shopware sits in between: an open-source core with a commercial cloud edition on top. None of that is a features decision, since every project here can take an order, calculate tax, and send a receipt. The decision turns on one question: who runs this in three years, and what does it cost once the license stops being the expensive line, which for most buyers is on day one?

Open source against the hosted alternative

How to choose an ecommerce platform covers the full field, hosted SaaS included, and the small-business version runs the same decision on a tighter budget. Both treat Shopify, BigCommerce, Wix, and Squarespace as legitimate answers, because for most stores they are. This guide is for buyers who have already decided, or are seriously weighing, that they'd rather own the code than rent the platform.

That decision buys you three things a hosted platform takes off your plate: the servers, the PCI scope a hosted checkout absorbs, and the schedule on which patches ship. It buys back no platform fee, no forced roadmap, and code you can bend into any shape. Whether the trade is worth it depends less on the software than on whether you have, or will pay for, the team to run it.

Key Facts: choosing open-source ecommerce software

• WooCommerce holds 48.1% of the market among sites running a known ecommerce system (8.1% of all websites), more than three times Shopify's 31.7% share on the same measurement (W3Techs, Usage Statistics and Market Share of E-commerce Systems, September 2026).
• A typical WooCommerce store runs 58 active plugins, climbing to 66 on stores doing $1 million or more in revenue, across a sample of over 6,000 stores (Metorik, WooCommerce Plugin Statistics, July 2026).
• 39.1% of compromised content management systems were running an outdated version at the point of infection, the single largest factor behind a hack that self-hosting makes entirely the store owner's job (Sucuri, 2023 Hacked Website & Malware Threat Report).

What "free" actually costs

None of the numbers below live on a pricing page, because there isn't one. Here's a worked model for a store doing $30,000 a month at roughly 400 orders, comparing self-hosted WooCommerce, self-hosted Magento Open Source, and a hosted Shopify Basic plan for scale. Every figure is a stated assumption, not a vendor quote.

Read that last row again: a small WooCommerce store can land within a few hundred dollars of a hosted plan once developer time is priced honestly, and Magento Open Source routinely costs more than the SaaS platform it was supposedly cheaper than. That's an argument for pricing self-hosting first, the discipline our software total cost of ownership guide applies to any category where sticker price isn't real price.

What to look for

Score every project on these six criteria: the first three decide whether the software stays safe to run; the second three decide whether your team can operate it.

PCI scope deserves plain language: the checkout setup decides how much of the standard applies to you.

See our security checklist for software buyers for the fuller version, and check your integration requirements if stock syncs across a warehouse and a marketplace: sync extensions break easiest on a major upgrade.

Key questions to ask before you buy

1. What's the exact date my chosen version stops receiving patches? Get it from the vendor's own lifecycle page, not a forum post.
2. Who on my team, or which agency, can actually operate this stack? Price a real engagement before assuming "we'll figure it out."
3. Does card data ever touch our own server? If yes, budget the PCI assessment now, not after a processor flags you.
4. What did the last major-version upgrade actually cost, for a store our size? Ask an agency that's done one.
5. How many required extensions still get updates for the current version? Audit before you buy, not after an upgrade breaks half of them.
6. What's our real hosting spec at peak traffic, not average traffic?
7. If we're building headless, who owns the frontend once the original developer leaves?
8. What happens to our data, theme, and extensions if we leave this platform? Ask for the export format before you sign.

Shortlist: platforms you install

These six are monolithic in the sense that matters: install the software, pick a theme, and the storefront and backend ship together.

WooCommerce is the default for a reason: it's the plugin on the CMS that already runs a huge share of the web, so a WordPress developer you already have can pick it up fast. What you're really buying is patching core, theme, and every plugin on the same schedule, since one outdated plugin is the most common way these stores get compromised. See the best WooCommerce alternatives for the head-to-head.

Magento Open Source earns its reputation for depth: catalog price rules, multi-website management, and B2B features most SaaS platforms reserve for their top tier. The reputation leaves out the support clock, covered in full further down: Adobe runs a fixed window per major version, and unlike Adobe Commerce, Open Source gets no extended-support add-on once it closes. See the best Magento alternatives if you're weighing whether to stay.

PrestaShop is the platform most buyers outside North America already know: strong multi-language and multi-currency support in the box, plus a large Addons marketplace. Its split license rarely matters day to day, but matters if you redistribute a customized build.

OpenCart is the lightweight option: smaller codebase, lower hosting needs, a smaller extension marketplace. Reasonable for a simple catalog on a budget host, weak for anything Magento-level.

nopCommerce is the .NET option, useful if your team or infrastructure is already Microsoft-stack. One quirk: the free edition keeps a "Powered by nopCommerce" footer link, and removing it costs a one-time fee, a line that never shows up until you're committed.

Drupal Commerce suits one buyer: a team already on Drupal for content that wants commerce woven into the same CMS. Centarro, the company behind it, sells support plans rather than the software.

Shortlist: headless commerce engines

These six treat commerce as an API: there's no theme, because there's no default frontend, and the trade only pays off when your team can build one.

Saleor is the most enterprise-shaped of the six, with cloud pricing that scales by GMV instead of a vague "contact sales." Enterprise still needs a call, but Select and Volume are real, printed numbers. Medusa is the fastest path from zero to a running backend for a Node-first team. Vendure is the flat-fee outlier: a free GPLv3 core plus a flat annual Platform subscription with no per-order or per-GMV fee.

Sylius and Spree have the longest track records here, both older projects still active through multiple major-version rewrites. Spree is worth a flag: its core license briefly moved off BSD-3-Clause between late 2024 and early 2026, then reverted after community pushback, a real example of the risk covered below, since terms can move under you and a reversal isn't guaranteed twice. Bagisto is the newest of the six, most focused on being easy for a Laravel shop that doesn't want to hand-roll infrastructure.

Shopware doesn't sit cleanly in either list: its Community Edition installs like a monolith, but the same core can run API-first if you want a headless frontend. Layered on top is a real cloud business: Rise from 600 euros a month, Evolve from 2,400 euros a month, and a quote-only Beyond tier, all excluding VAT, printed prices rather than a sales call.

Magento Open Source: the version-support story

This is the fact that changes the calculus for anyone running Magento. Adobe publishes a fixed support window per major release, and the extended-support period after it is sold to Adobe Commerce customers only. Open Source gets the same start and standard-support end date, then nothing more.

Confirmed against Adobe's own software lifecycle policy. Three dates are already behind us: 2.4.4 and 2.4.5 have been unsupported on the Open Source track for over a year, and 2.4.6 lost its patches on August 11, 2026, weeks before this update. A store still on those versions isn't theoretically at risk; it's running without vendor patches today. The only currently safe line for a new build is 2.4.7 or later, and that carries its own hard date: May 31, 2027, with no extended-support option to buy past it.

How to choose: a decision framework

Match your situation to a starting point, then trial your top two with real catalog data.

What it actually costs

The license is free below. What you pay for, if anything, is support, a managed cloud tier, or a commercial edition with features the open core lacks.

Adobe Commerce is the only product here whose price never appears on the vendor's own site, so treat any figure you read elsewhere as someone else's estimate. nopCommerce's $50 fee is, genuinely, the only fixed, published price on this list: everything else is free or a conversation.

Migration and lock-in

Open source is sold on removing vendor lock-in, and it removes one kind: you're never one acquisition away from a shutdown notice, since you hold the code. What replaces it is implementation lock-in, and for most stores that's the stickier version. A typical WooCommerce store runs 58 active plugins, climbing to 66 at seven-figure revenue, and each one is a dependency your next developer has to understand first. Losing a vendor is a bad afternoon; losing the one person who knew why twelve custom plugins were wired together in a specific order is a bad quarter. The Spree episode above shows the same risk differently: even a permissive license can move under you, and a community reversal isn't guaranteed twice.

Three moves reduce the damage regardless of platform.

If stock syncs across a warehouse and a storefront, pick inventory management software that survives the same upgrade cycle, and price an in-house developer hire properly with our payroll for startups guide.

Frequently asked questions

Is Magento Open Source actually dead?

No, and that's part of why it's dangerous. Adobe still ships new major versions, most recently 2.4.9 in May 2026, and the software works the same the day its support window closes as the day before. What ends is the patches, on a fixed calendar Magento Open Source can't buy its way past. A live store running dead code looks identical to one running supported code, until it doesn't.

What's the real difference between a monolithic platform and a headless commerce engine?

A monolithic platform ships a theme and admin panel together, so a merchant launches by picking a template. A headless engine ships only the backend and an API; your team builds the storefront and calls the API to render every page. Monolithic launches faster for a non-technical merchant; headless gives a technical team more control, at the cost of building the frontend a theme would give away.

Do I need a PCI compliance audit if I self-host?

It depends on whether card data touches your server. A checkout that redirects to, or embeds an iframe from, your processor keeps your burden small. If your own code touches card data at any point, you're in a much heavier tier, often needing a Qualified Security Assessor. Pick the checkout integration before the theme.

How many developers does it take to run WooCommerce versus Magento Open Source?

A single WordPress developer working a few hours a month keeps a modest WooCommerce store patched. Magento Open Source, at similar catalog size, typically needs someone Magento-specific working closer to part-time, since its complexity and smaller, pricier hiring pool both push that way. Price a real quote before assuming either number.

Is nopCommerce actually free, or is that $50 fee a licensing cost?

The core is free under the nopCommerce Public License, and the $50 is a one-time fee to remove the "Powered by nopCommerce" footer link, not a license to use the software. A separate commercial license exists for ISVs who want to redistribute without the public license's terms, and that one is quote-only.

When does a hosted SaaS platform beat any open-source option, even for a technical team?

When your team's time is worth more building the product than building infrastructure. A team building a genuinely novel storefront has real reason to go headless; a team building a fairly standard store is better served starting with our ecommerce platform guide and revisiting self-hosting once growth justifies it.

What happens if the open-source project I pick changes its license?

Usually nothing for a version already deployed, since changes apply going forward. What can change is your ability to take future updates, fork it, or redistribute a customized build. Spree's brief move away from its license and back is the clearest recent example: read the license file, not the marketing page, before depending on anything for years.

Buy the runway, not the free tag

The license price is the only number in this category that's genuinely zero, and also the smallest number in the total. Everything that determines whether an open-source project was the right call (hosting, patching, extension maintenance, PCI scope, the eventual major-version upgrade) lands on a bill with your company's name on it, not the vendor's. That's not a reason to avoid this category: plenty of businesses running WooCommerce, PrestaShop, or a headless Medusa build get real value from money spent deliberately. It's a reason to price the three-year picture before you install anything, and pick the platform your team can actually patch, not the one with the longest feature list. If you can answer who patches this in 2029 and what it costs, you're ready to choose.

Related reading

• How to Choose an Ecommerce Platform: the full field, SaaS included
• How to Choose an Ecommerce Platform for Small Business: the same decision, tighter budget
• How to Choose a Payment Processor: the gateway behind the checkout
• Software Security Checklist for Buyers: the fuller PCI checklist
• Software Total Cost of Ownership Guide: the same TCO discipline, any category
• Software Integration Requirements Checklist: before an extension-heavy stack
• How to Choose Inventory Management Software: stock synced across channels
• Best WooCommerce Alternatives: the head-to-head against its rivals
• Best Magento Alternatives: if the version clock is the deciding factor
• How to Choose Payroll for Startups: budgeting the in-house hire