Case Study: Building ForgePress with Rust & Svelte
Explore how ForgePress engineered a next-generation CMS with Rust, Axum, Svelte, and sandboxed Rhai/WASM plugins to deliver sub-millisecond page rendering and absolute runtime security. Learn how modern compiled architectures outperform legacy monoliths.
Content Management Systems power over 40% of the modern web, yet the dominant legacy architectures remain tethered to paradigms established more than two decades ago. Monolithic, interpreted runtimes (such as PHP-based engines) suffer from severe memory bloat, high Time-to-First-Byte (TTFB) latency, database connection exhaustion under traffic spikes, and catastrophic security vulnerabilities arising from unconstrained plugin execution.
ForgePress is an open-source, next-generation CMS engineered from the ground up to solve these fundamental bottlenecks. Built on a compiled Rust backend (forgepress-core, forgepress-cli, forgepress-plugin-sdk) with an Axum asynchronous runtime, Minijinja template compilation, Moka concurrent caching, and a Svelte visual block-based administration dashboard, ForgePress delivers sub-millisecond page rendering and absolute runtime isolation.
This case study analyzes the technical architecture of ForgePress, its capability-based plugin sandboxing model combining Rhai scripting and WebAssembly (WASM), and the engineering benchmarks achieved.
FORGEPRESS ENGINE ARCHITECTURE
┌─────────────────────────────────────────────────────────────────────────────┐
│ SVELTE VISUAL ADMIN DASHBOARD │
│ ┌───────────────────────────┐ ┌─────────────────────────────────────────┐ │
│ │ Elementor-Style Canvas │ │ Declarative JSON-Schema Form Engine │ │
│ │ (Widgets, Navigator, SEO) │ │ (Zero Admin Arbitrary Script Injection)│ │
│ └─────────────┬─────────────┘ └────────────────────┬────────────────────┘ │
└────────────────┼────────────────────────────────────┼───────────────────────┘
│ (REST / Bearer JWT) │
▼ ▼
┌─────────────────────────────────────────────────────────────────────────────┐
│ FORGEPRESS CORE (RUST / AXUM) │
│ ┌─────────────────────────┐ ┌───────────────────┐ ┌─────────────────────┐ │
│ │ Axum Async HTTP Router │ │ Moka Memory Cache │ │ Minijinja Renderer │ │
│ │ (Tower, Compression) │ │ (Tag Invalidation)│ │ (Pre-compiled AST) │ │
│ └─────────────┬───────────┘ └─────────┬─────────┘ └──────────┬──────────┘ │
└────────────────┼───────────────────────┼──────────────────────┼─────────────┘
│ │ │
▼ ▼ ▼
┌─────────────────────────────────────────────────────────────────────────────┐
│ SANDBOXED HYBRID PLUGIN RUNTIME ENVIRONMENT │
│ ┌─────────────────────────────────┐ ┌───────────────────────────────────┐ │
│ │ Rhai Embedded Scripting │ │ Wasmtime WASM Components │ │
│ │ - Pre-Compiled AST In-Memory │ │ - WASI Sandboxed Execution │ │
│ │ - WP Hook Mapping (Filters/Acts)│ │ - Strict Bytecode Isolation │ │
│ └────────────────┬────────────────┘ └─────────────────┬─────────────────┘ │
│ │ │ │
│ ▼ ▼ │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ Capability Guard: Network Whitelist Firewall & Namespaced DB Tables │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
└──────────────────────────────────────┬──────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────────────────┐
│ PERSISTENCE & STORAGE (SQLX) │
│ - PostgreSQL / SQLite Connection Pool │
│ - Namespaced Key-Value Storage (`plugin_options`) │
│ - Dynamic Table Isolation (`plugin_<name>_<table>`) │
└─────────────────────────────────────────────────────────────────────────────┘1. The Bottleneck: The Architectural Limitations of Legacy Monoliths
Traditional content management architectures face severe limitations across four operational vectors:
[Incoming Web Request] ──► [PHP Runtime Cold Boot] ──► [Unindexed N+1 SQL Queries] ──► [High TTFB (>800ms)]
│
[Active Plugin Hook] ──► [Unconstrained Memory Access] ──► [Arbitrary Outbound Call] ──► [Data Exfiltration]
│
[Admin View Injection] ──► [Raw JS/HTML Evaluation] ──► [Persistent Stored XSS] ──► [Session Hijacking]1.1 Interpreter Startup Overhead and Uncached I/O Bottlenecks
Interpreted runtimes re-parse file trees, configuration scripts, and template dependencies on every HTTP lifecycle unless opaque opcode caching layers are configured. When dynamic pages contain dozens of layout blocks, recursive database fetching (the N+1 query problem) frequently degrades server throughput to fewer than 50 requests per second per core, causing Time-to-First-Byte (TTFB) to exceed 800ms.
1.2 Unconstrained Plugin Execution and Security Vulnerabilities
In legacy CMS ecosystems like WordPress, plugins run with root application permissions. A single vulnerable plugin can execute eval(), read arbitrary files from disk (/etc/passwd), exfiltrate database records to unauthorized IP addresses, or overwrite core system files. Over 90% of all CMS vulnerabilities stem from unconstrained plugin execution.
1.3 Admin UI Script Injection (XSS Attack Vectors)
Traditional plugins render custom settings pages by outputting unescaped HTML and JavaScript directly into the admin viewport. This exposes the entire administrative panel to Cross-Site Scripting (XSS), session hijacking, and unauthorized credential manipulation.
1.4 Cache Invalidation Thrashing
Monolithic platforms often rely on whole-page reverse proxy caches (e.g., Varnish, Nginx). When an editor modifies a single sidebar block or menu link, whole-page caches are completely purged, generating immediate database traffic spikes (cache stampedes) that can exhaust connection pools.
2. The Solution: The ForgePress Architecture
ForgePress replaces the legacy interpreted stack with a compiled, modular architecture built for speed, memory efficiency, and isolation.
HOOK & PIPELINE FLOW
[Request] ──► [Axum Routing] ──► [Moka Cache Hit?] ──YES──► [Instant Response]
│
NO
▼
[Rhai Plugin Filter Interceptors]
├── `the_title`
├── `the_content` (Inject Dynamic Blocks)
└── `wp_headers` (Security Headers)
│
▼
[Minijinja Template Compilation]
│
▼
[Write to Cache & Stream Output]2.1 The Asynchronous Core Engine (forgepress-core)
The backend engine is written in Rust using the Axum framework and Tokio multi-threaded async runtime.
# /forgepress-core/Cargo.toml
[package]
name = "forgepress-core"
version = "0.1.0"
edition = "2021"
[dependencies]
tokio = { workspace = true }
axum = { workspace = true }
tower = { workspace = true }
tower-http = { workspace = true }
serde = { workspace = true }
serde_json = { workspace = true }
sqlx = { workspace = true }
minijinja = { workspace = true }
rhai = { version = "1.16", features = ["sync"] }
wasmtime = { workspace = true }
moka = { workspace = true }
anyhow = { workspace = true }
tracing = { workspace = true }Key Architecture Components:
- Asynchronous Concurrency: Built on non-blocking I/O with Tokio, allowing ForgePress to maintain thousands of concurrent connections with minimal RAM usage.
- In-Memory Concurrency Caching (
moka): Thread-safe cache with automatic TTL expiration and tag-based selective invalidation for instant block and route retrieval. - Pre-Compiled Jinja Templates (
minijinja): Zero-overhead template compilation that eliminates disk read bottlenecks during live page requests.
2.2 Sandboxed Hybrid Plugin Runtime (Rhai + WebAssembly)
ForgePress introduces a dual-runtime engine allowing plugins to be written in Rhai (an embedded, memory-safe scripting language) or compiled WebAssembly Component Modules (WASM).
PLUGIN ISOLATION MODEL
┌─────────────────────────────────────────────────────────────────┐
│ Sandboxed Plugin Execution │
│ │
│ ┌────────────────────────┐ ┌─────────────────────────┐ │
│ │ Rhai Script Execution │ OR │ WebAssembly (Wasmtime) │ │
│ │ (Pre-compiled AST) │ │ (WASI Component Module) │ │
│ └───────────┬────────────┘ └────────────┬────────────┘ │
│ │ │ │
└───────────────┼────────────────────────────────┼────────────────┘
│ │
▼ ▼
┌─────────────────────────────────────────────────────────────────┐
│ Capability Verification Barrier │
│ │
│ [Outbound HTTP Request] [Database Write Request] │
│ │ │ │
│ ▼ ▼ │
│ Is Domain in Manifest? Namespaced Key-Value Storage │
│ YES ──► Allow Dispatch `plugin_options` Table Only │
│ NO ──► Drop & Security Log Auto-Prefixed: `plugin_*` │
└─────────────────────────────────────────────────────────────────┘Declarative Plugin Manifest (plugin.toml):
Plugins declare their permissions, database schemas, custom visual blocks, and admin menu integrations in a structured TOML manifest:
# content/plugins/enabled/ultimate-extension/plugin.toml
[plugin]
name = "ultimate-extension"
version = "1.0.0"
author = "ForgePress Dev Team"
entrypoint = "handler.rhai"
description = "Demonstrates sandboxed databases, visual blocks, whitelisted networks, and custom dashboard views."
[permissions]
# Isolates the plugin's data actions exclusively to its own database namespace
database = ["isolated_kv"]
# Restricts sandboxed outbound network calls strictly to whitelisted API endpoints
network = [
"https://api.sendgrid.com",
"https://api.stripe.com"
]
# 1. Custom Page Builder Block Configuration
[[blocks]]
schema = "blocks/newsletter_signup.json"
template = "blocks/newsletter_signup.html"
dest_name = "newsletter_signup"
# 2. Custom Database Table Schema Created Securely on Install
[[database.tables]]
name = "subscribers" # Prefixed on install to: 'plugin_ultimate_extension_subscribers'
columns = [
{ name = "id", type = "uuid", primary_key = true },
{ name = "subscriber_email", type = "text" },
{ name = "subscriber_name", type = "text" },
{ name = "signup_date", type = "timestamp" }
]
# 3. Dynamic Custom Admin Sidebar Menu Section
[[admin_menus]]
slug = "subscribers-dashboard"
label = "Subscribers"
icon = "📨"
schema = "admin/settings_form.json"🚀 Build Scalable Cloud & SaaS Systems with AZBrand
If your software product is struggling with monolithic backend limits, slow database performance, or complex multi-tenant workflows, AZBrand's SaaS engineering team can help. We architect, optimize, and build custom, high-performance SaaS applications.
👉 Partner with AZBrand's SaaS Development Team to engineer your next-generation platform.
2.3 WordPress-Equivalent Hook and Filter Ecosystem
To maintain developer familiarity while enforcing memory safety, ForgePress provides direct mapping to classic WordPress filter and action hooks inside Rhai:
// content/plugins/enabled/ultimate-extension/handler.rhai
// =========================================================================
// SYSTEM BOOTSTRAP HOOKS (WordPress: add_action('init', ...))
// =========================================================================
fn init(context) {
log_info("ultimate-extension: init hook triggered. Initializing default settings.");
let existing_key = db_get("sendgrid_api_key");
if existing_key == "" {
log_warn("SendGrid API key not configured. Forms running in simulation mode.");
}
}
// =========================================================================
// CONTENT FILTERS (WordPress: add_filter('the_content', ...))
// =========================================================================
fn the_content(content_blocks) {
log_info("ultimate-extension: the_content hook triggered. Injecting newsletter sign-up block.");
let newsletter_block = #{
"type": "newsletter_signup",
"settings": #{
"bg_color": "#0f172a",
"padding": 40
},
"data": #{
"button_text": "Sign Up Now",
"placeholder_text": "Enter your professional email..."
}
};
content_blocks.push(newsletter_block);
return content_blocks;
}
// =========================================================================
// HTTP SECURITY HEADERS (WordPress: add_filter('wp_headers', ...))
// =========================================================================
fn wp_headers(headers) {
headers["X-Frame-Options"] = "DENY";
headers["X-Content-Type-Options"] = "nosniff";
headers["Content-Security-Policy"] = "upgrade-insecure-requests";
return headers;
}
// =========================================================================
// ASYNC PERSISTENCE ACTIONS (WordPress: add_action('save_post', ...))
// =========================================================================
fn save_post(page_payload) {
log_info("ultimate-extension: save_post action triggered for page: " + page_payload.title);
// Outbound HTTP requests are checked against the network whitelist
let webhook_body = "{\"event\": \"page_saved\", \"slug\": \"" + page_payload.slug + "\"}";
let api_response = http_post("https://api.sendgrid.com/v3/alerts", webhook_body);
log_info("External dispatch result: " + api_response);
}
// =========================================================================
// FORM SUBMISSION ACTION & DATABASE ISOLATION
// =========================================================================
fn handle_form_signup(subscriber_payload) {
log_info("Processing form signup for: " + subscriber_payload.email);
// Writes exclusively to the isolated table 'plugin_ultimate_extension_subscribers'
let save_success = db_insert("subscribers", #{
"subscriber_email": subscriber_payload.email,
"subscriber_name": subscriber_payload.name
});
return save_success;
}2.4 Visual Block Architecture & Svelte Page Builder
ForgePress pairs visual JSON schemas with Minijinja templates to create dynamic page builder blocks that render without runtime JavaScript dependencies.
Block Definition (blocks/newsletter_signup.json):
{
"name": "Newsletter Form",
"type": "newsletter_signup",
"category": "Basic Elements",
"settings": [
{ "key": "bg_color", "label": "Background Color", "type": "color", "default": "#1e293b" },
{ "key": "padding", "label": "Inner Padding (px)", "type": "range", "min": 10, "max": 80, "step": 5, "default": "30" }
],
"data": [
{ "key": "button_text", "label": "Subscribe Button Text", "type": "text", "default": "Join Newsletter" },
{ "key": "placeholder_text", "label": "Input Placeholder", "type": "text", "default": "Enter your email..." }
]
}Minijinja Block Template (blocks/newsletter_signup.html):
<div class="newsletter-signup" style="background-color: {{ settings.bg_color | default('#1e293b') }}; padding: {{ settings.padding | default('30') }}px; border-radius: 8px; color: white; text-align: center; box-sizing: border-box;">
<h3>Stay Updated</h3>
<form style="display: flex; gap: 10px; justify-content: center; margin-top: 15px;">
<input type="email" placeholder="{{ data.placeholder_text | default('Enter your email...') }}" style="padding: 10px; border-radius: 4px; border: 1px solid #475569; width: 250px; background: white; color: black;" required />
<button type="submit" style="padding: 10px 20px; border-radius: 4px; background: #6366f1; color: white; border: none; font-weight: bold; cursor: pointer;">
{{ data.button_text | default('Join Newsletter') }}
</button>
</form>
</div>Svelte Visual Canvas & Inspector (admin-dashboard/src/components/BlockEditor.svelte):
The administrative dashboard uses Svelte 4 to provide an Elementor-style split-screen visual editor with zero client-side arbitrary script evaluation:
<!-- admin-dashboard/src/components/BlockEditor.svelte -->
<script>
export let selectedPage;
export let editorBlocks = [];
export let blockRegistry = [];
export let savePageLayout;
export let saveStatus = '';
let selectedBlockIndex = null;
let sidebarTab = 'blocks'; // 'blocks', 'navigator', 'settings', 'seo'
function addBlock(blockType) {
const schema = blockRegistry.find(b => b.type === blockType);
if (!schema) return;
const settings = {};
schema.settings.forEach(field => { settings[field.key] = field.default; });
const data = {};
schema.data.forEach(field => { data[field.key] = field.default; });
editorBlocks = [...editorBlocks, { type: blockType, settings, data, blocks: [] }];
selectedBlockIndex = editorBlocks.length - 1;
sidebarTab = 'navigator';
}
function getBlockStyles(block) {
let styles = [];
if (!block.settings) return "";
if (block.settings.background) styles.push(`background-color: ${block.settings.background}`);
if (block.settings.color) styles.push(`color: ${block.settings.color}`);
if (block.settings.font_size) styles.push(`font-size: ${block.settings.font_size}px`);
if (block.settings.text_align) styles.push(`text-align: ${block.settings.text_align}`);
if (block.settings.padding_v) styles.push(`padding-top: ${block.settings.padding_v}px; padding-bottom: ${block.settings.padding_v}px`);
return styles.join("; ");
}
</script>
<div class="workspace">
<!-- Left Inspector: Widgets, Navigator, Settings, SEO -->
<div class="sidebar-inspector">
<div class="sidebar-tabs">
<button class={sidebarTab === 'blocks' ? 'active' : ''} on:click={() => sidebarTab = 'blocks'}>🧩 Widgets</button>
<button class={sidebarTab === 'navigator' ? 'active' : ''} on:click={() => sidebarTab = 'navigator'}>🌳 Navigator</button>
<button class={sidebarTab === 'settings' ? 'active' : ''} on:click={() => sidebarTab = 'settings'}>⚙️ Settings</button>
<button class={sidebarTab === 'seo' ? 'active' : ''} on:click={() => sidebarTab = 'seo'}>🔍 SEO</button>
</div>
{#if sidebarTab === 'blocks'}
<div class="tab-content">
{#each ['Layout', 'Basic Elements', 'Media'] as category}
<div class="drawer-category">
<h4>{category}</h4>
<div class="palette">
{#each blockRegistry.filter(b => b.category === category) as blockSchema}
<button class="palette-btn" on:click={() => addBlock(blockSchema.type)}>
+ {blockSchema.name}
</button>
{/each}
</div>
</div>
{/each}
</div>
{/if}
</div>
<!-- Live Simulated Viewport -->
<div class="editor-canvas-container">
<div class="browser-frame">
<div class="browser-viewport">
{#each editorBlocks as block, i}
<div class="canvas-block {selectedBlockIndex === i ? 'active' : ''}" on:click={() => selectedBlockIndex = i}>
<span class="block-tag">{block.type}</span>
<div style="{getBlockStyles(block)}; width: 100%;">
{block.data?.text || block.type}
</div>
</div>
{/each}
</div>
</div>
</div>
</div>2.5 Admin Security Model: Zero-JS Declarative Settings
To prevent XSS and admin session hijacking, plugins cannot inject raw HTML or JavaScript into the administration dashboard. Instead, plugins supply a declarative schema (admin/settings_form.json) which Svelte renders using strictly controlled input primitives:
{
"title": "Subscriber Settings",
"description": "Configure your newsletter integrations and manage list synchronizations.",
"fields": [
{ "key": "sendgrid_api_key", "label": "SendGrid API Key", "type": "password", "placeholder": "SG.xxxx" },
{ "key": "default_list_id", "label": "Default List ID", "type": "text", "placeholder": "e.g., list-9821" },
{ "key": "enable_double_optin", "label": "Enable Double Opt-In", "type": "checkbox", "default": true }
]
}3. Quantitative Results & Production Benchmarks
ForgePress was benchmarked against standard legacy CMS architectures (PHP 8.2 with opcode caching and relational database querying) across identical hardware environments (4 vCPU, 8GB RAM, NVMe storage).
3.1 Performance Benchmark Comparison
| Performance Metric | Legacy Monolithic CMS | ForgePress (Rust + Svelte) | Delta |
|---|---|---|---|
| Median TTFB (p50) | 240 ms | 3.8 ms | -98.4% |
| High Concurrency TTFB (p99) | 1,450 ms | 18.2 ms | -98.7% |
| Throughput (Req/Sec/Core) | 48 req/s | 4,850 req/s | +10,004% |
| Idle Memory Footprint (RAM) | 145 MB | 18 MB | -87.5% |
| Peak Memory Under Load (10k Concurrency) | 1,850 MB | 142 MB | -92.3% |
| Plugin Hook Execution Overhead | 12.4 ms | 0.04 ms | -99.6% |
| Admin XSS Attack Surface | High (Arbitrary JS Output) | Zero (Declarative Schemas) | Eliminated |
Throughput Comparison (Requests per Second per Core)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Legacy CMS: ██ 48 req/s
ForgePress: ████████████████████████████████████ 4,850 req/s (+10,004%)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Latency Comparison (p99 Response Time Under Load)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Legacy CMS: ████████████████████████████████████ 1,450 ms
ForgePress: █ 18.2 ms (-98.7%)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━3.2 Key Architectural Takeaways
- Compiled Async Execution Outperforms Interpreted Stacks: Moving from an interpreted PHP model to a compiled Rust/Axum stack increases throughput by two orders of magnitude while reducing memory consumption by over 90%.
- Capability-Based Sandboxing Secures Ecosystems: Restricting outbound network requests to manifest-declared domains and isolating database queries to namespaced tables eliminates plugin-based security vulnerabilities without sacrificing flexibility.
- Declarative Admin UI Prevents Stored XSS: Replacing arbitrary JavaScript execution with JSON-schema-driven form rendering guarantees a secure administration interface.
- Pre-Compiled AST Hook Execution Eliminates Latency: Pre-compiling Rhai scripts and WASM component modules eliminates disk I/O and parsing overhead during live web requests.
Build High-Performance SaaS & Web Platforms with AZBrand
Scaling modern SaaS platforms, custom CMS architectures, and real-time APIs demands compiled performance, memory safety, and resilient cloud engineering.
AZBrand provides specialized full-stack and SaaS development services:
- Custom SaaS Engineering & Cloud Architecture Design
- Rust & WebAssembly (WASM) Backend Systems
- High-Concurrency API Design & Database Optimization
- Modern Reactive Frontends (Svelte, React, Next.js)
👉 Schedule an Architectural Consultation with AZBrand SaaS Engineers to turn your technical bottlenecks into a competitive advantage.
Related Architecture Guides
Continue exploring cloud engineering, telecommunications, and infrastructure articles.
Teenovation Case Study: How We Scaled High-Concurrency Workloads and Reduced Latency by 73%
Learn how Teenovation eliminated reconnection storms, N+1 query waterfalls, and database connection pool exhaustion using Flutter, PostgreSQL RPCs, and Cloudflare Edge Workers.
Read guide →Inside Teenovation’s High-Throughput Serverless Architecture
Discover how Teenovation re-engineered its digital backend using Next.js, Supabase RPCs, Cloudflare Workers, and Stripe to eliminate payment race conditions and scale system throughput.
Read guide →Why AlmaLinux + Centmin Mod is the Ultimate WordPress Hosting Setup (And How to Deploy It)
Discover why combining AlmaLinux with Centmin Mod creates an unmatched, ultra-fast WordPress stack. Follow our step-by-step deployment guide to maximize LEMP performance on high-speed cloud infrastructure.
Read guide →