Drupal Is Not "Light-Years Ahead"
Drupal's creator says the platform is "light-years ahead of its reputation." The numbers paint a different picture.
Dries Buytaert, Drupal's creator, published a post claiming the platform is "light-years ahead of its reputation." But Drupal has spent the last decade burning goodwill with the people who built their businesses on it, and the data shows a platform in freefall, not a comeback story.
1. A 74% Market Share Collapse
W3Techs tracked Drupal at 2.3% of all websites in January 2018. By October 2026, that number had fallen to 0.6%.
| Year | Drupal % of all websites |
|---|---|
| 2015 | 2.0% |
| 2018 | 2.3% (peak) |
| 2020 | 1.7% |
| 2022 | 1.3% |
| 2024 | 1.1% |
| 2026 (Oct) | 0.6% |
WordPress held around 43% over the same period. Shopify grew from 0.9% to 5.3%. Wix from 0.4% to 4.2%. Squarespace from 0.7% to 2.4%. Every major CMS outside Drupal and Joomla either grew or held steady.
W3Techs' June 2025 summary puts it bluntly: "Joomla and Drupal, two open source tools that ranked 2nd and 3rd in the years before 2020, are now declining."
BuiltWith tracks 457,053 live Drupal websites alongside 1,213,840 that used Drupal and left. For every site still running it, nearly three have walked away.
2. The Rewrite That Killed a Community
Drupal 8 was the inflection point.
The Drupal team didn't release an upgrade. They shipped a new CMS. They replaced the procedural, hook-based PHP architecture with an object-oriented system built on Symfony. About 25% of D7's code survived. They swapped PHPTemplate for Twig, made Composer mandatory, and forced every contributed module to be rewritten from scratch. If you ran a Drupal 7 site, you had to rebuild from zero.
D6 to D7 upgrades took weeks. D7 to D8 migrations ran 6 to 18 months for comparable sites. One user in Drupal's own issue queue reported: "A very large organization updated their Drupal 6 to 7, in three months. Doing the exact same task to Drupal 8 took them 18 months."
Pantheon co-founder Josh Koenig analyzed BuiltWith data covering 800,000+ Drupal 7 sites:
| Destination | Sites |
|---|---|
| WordPress | ~300,000 |
| Modern Drupal (8/9/10/11) | ~50,000 |
| Still on Drupal 7 | ~230,000 |
| Other (hundreds of platforms) | Remainder |
For every site that upgraded to modern Drupal, six left for WordPress. NASA, the White House, CERN, Capgemini, Her Campus Media all moved to WordPress. Torchbox, one of the UK's leading Drupal agencies after 11 years with the platform, dropped it in 2018. All eight of their full-time Drupal developers were offered the chance to retrain on a different stack.
As Koenig wrote: "Since people had to go through a total rebuild anyway, it created a decision point for every D7 adopter."
Most of them decided to leave.
Backdrop CMS, a fork built by respected core contributors Nate Haug and Jen Lampton to preserve the D7 philosophy, has attracted only 4,200 sites after more than a decade. Haug and Lampton had asked Dries to keep it as "Drupal Classic" within the official project. He refused. "The outcome of that meeting was 'Drupal is Drupal 8.'"
Earl Miles, the developer behind Views and CTools (the two most popular Drupal modules ever written), said in 2022: "I prefer Drupal 7 to Drupal 9. I feel like one particular community was listened to, and another community was ignored. That ignored community is still using Drupal 7."
As of October 2026, roughly 29% of all Drupal sites still run version 7, which hit end-of-life in January 2025 after three deadline extensions (originally November 2021, pushed to November 2022, then November 2023, then finally January 2025). The Drupal Association kept pushing the date because so many site owners could not migrate, or refused to.
3. The Fourth "Make Drupal Easy" Initiative
Drupal CMS (originally called Starshot) was announced in May 2024 as the fix for everything. Dries promised delivery in eight months. He called it a way to make Drupal "radically easier."
It shipped as 1.0 on January 15, 2025. The decline didn't stop.
W3Techs had Drupal at 0.9% when Drupal CMS launched. By October 2026, it was 0.6%. The market share drop accelerated after launch, not before.
The product itself tells you why. Drupal CMS 1.0 shipped with zero Site Templates, the marquee feature Dries described as a replacement for distributions. They were announced later at DrupalCon Atlanta in March 2025 as a future concept. A marketplace was being "explored." The 1.0 release included roughly 30 recipes, which are one-time configuration scripts, not ongoing functionality. WordPress has 60,000+ plugins and 12,000+ themes. That gap isn't closing.
Installing Drupal CMS locally still requires Docker, DDEV, and Composer via CLI. There's a "one-line installer" that runs bash <(curl -fsSL ...) in a terminal, not something a non-developer would recognize. The official hosting guide still says: "Command line access via SSH to run Composer commands is required to run Drupal, and Drush is also indispensable." When a user asked in the issue queue how to install on shared hosting without Composer, a core contributor replied: "I do not think there is another possible way."
WordPress runs on $3/month shared hosting with one-click installs. No CLI. No Docker. No terminal. That hasn't changed.
The UX Manager role was created in May 2025, four months after 1.0 shipped. The announcement acknowledged that "UX input has often arrived late, focusing on small usability tweaks rather than shaping the overall experience." A DrupalCon Vienna 2025 session titled "No more steep learning curve!" promised to share UX research findings, meaning the research wasn't done before launch. The session title tells you where they are: still steep.
This pattern isn't new. Drupal has tried this before:
| Initiative | Years | Outcome |
|---|---|---|
| Lightning (Acquia) | 2014–2021 | Abandoned. 39 sites remaining. |
| Thunder (Hubert Burda Media) | 2016–declining | Declining from 0.2% to 0.1% of Drupal sites |
| Acquia CMS | 2021–? | Replaced Lightning. Acquia-specific, not a community solution. |
| Drupal CMS | 2024–present | Market share still falling |
Dries acknowledged this history by saying Site Templates "could replace Drupal distributions, a concept that has been part of Drupal for nearly 20 years." Twenty years of trying. The track record is: launch with fanfare, decline, abandon.
Meanwhile, the agencies that built their businesses on Drupal are diversifying. weKnow Inc, a Drupal agency, moved its own website to WordPress and Elementor in March 2024. Their CEO wrote that "a small corporate website turns out to be an overkill for Drupal." CrucianPoint migrated 100+ managed Drupal sites to Laravel and WordPress. Agiledrop, a 70-person company where 90% of revenue came from Drupal, moved its own site to Storyblok. Their CEO said: "At DrupalCon, I talked to other agency owners. Everyone sees it. There's less demand for Drupal coming from the market."
When Drupal's own agencies are leaving, the problem isn't reputation.
4. A CMS That Can't Generate a List of Its Own URLs
WordPress added native XML sitemap support in version 5.5 (August 2020). You visit /wp-sitemap.xml and it works. No plugin. No terminal commands. No configuration.
In 2026, Drupal core still cannot do this. You install a contributed module (Simple XML Sitemap or XML Sitemap, two competing options for this one basic function), configure it, run cron or Drush to generate it, and then troubleshoot when it breaks on Views paths, unrouted URIs, or module upgrade conflicts. The Simple XML Sitemap issue queue is full of users whose sitemaps silently stopped generating, returned 404s, or crashed on menu links.
The module maintainer's response to one such bug: "Apparently barely anybody indexes menu links, otherwise this should not have stayed unreported for so long."
A content management system whose purpose is to manage and publish content, and it cannot produce a machine-readable list of that content without third-party help.
5. Death by a Thousand Modules
Getting Layout Builder, a core module, to work in Drupal 10 or 11 without Single Directory Components requires at least 8 contributed modules. That figure comes from a Drupal instructor who has taught 50,000+ students over 15 years.
The most-installed modules on drupal.org read like a list of features that should ship with any CMS: Token (placeholder variables), Pathauto (automatic URL aliases), Metatag (SEO tags), Admin Toolbar (a usable admin menu), Redirect (URL redirects), CAPTCHA (spam protection), Webform (forms), Paragraphs (structured content editing). Each one means a separate install, a separate maintainer to depend on, and a separate breakage risk on the next major version.
Of the 14,090 projects tracked by drupalreleases.com, 41% are dormant, collectively representing 6.3 million reported installs. Among projects claiming "actively maintained" status on drupal.org, only 4.5% had a commit in the last four weeks. Narrow that to "actively maintained" projects with 500+ installs: still only 15% with recent activity. A curated list of abandoned modules with no Drupal 11 path includes projects with over 100,000 installs.
You install a Drupal module, and you're betting the maintainer will still be around in two years when the next major version lands. The track record on that bet is poor, and the abandoned modules list keeps growing.
6. Catching Up, Not Leaping Ahead
Drupal Canvas (formerly Experience Builder) is Drupal's answer to the page builder problem. Dries presented it at DrupalCon Rotterdam as a major leap forward. But at its 1.0 launch in December 2025, he wrote something different:
"I also want to set expectations. Drupal Canvas 1.0 helps us catch up with other page builders more than it helps us leap ahead. We had to start there." – Dries Buytaert, December 4, 2025
Ten months later, he told a conference audience Drupal is "light-years ahead of its reputation."
Canvas 1.0 shipped without multilingual support, without migration paths from Layout Builder or Paragraphs, and without full support for entity types beyond nodes. Translation only stabilized in Canvas 1.8 around mid-2026. Product lead Lauri Timmanee confirmed on Talking Drupal #518: "On 1.0, not gonna have translation capability... it's not gonna have all of the capabilities that people can expect to have from using layout builder or paragraphs."
Canvas is not part of Drupal core. It's a contributed module that requires Drupal 11.3+. It reports 14,608 sites using it. WordPress Gutenberg, which shipped in December 2018 and has had eight years of iteration, reports 87.2 million active installations. Elementor, a third-party WordPress page builder, has 10 million+. Canvas is at 0.017% of Gutenberg's install base.
Canvas also landed in an ecosystem that already couldn't settle on a layout system. Drupal ships the legacy Block module in core, Layout Builder in core, and now recommends Canvas from contrib. A fourth option, Display Builder, lives in contrib too.
DrupalHelps, a respected Drupal educator, wrote: "If you build Drupal sites without writing much custom code, the current direction of Drupal site building is confusing." They asked the question Drupal hasn't answered: "What exactly are we supposed to build with?"
From Drupal's own core issue #3533472, a maintainer wrote: "Currently we have [three layout builders] between core and Drupal CMS [and we need to reconcile them] into ideally only having one." That issue is open in 2026. A second issue, #3619180, created August 2026, proposes removing Layout Builder from core entirely. Framework maintainer larowlan responded: "+1 from my point of view as a framework maintainer."
So Canvas is ten months old, not in core, missing features its predecessors had, and the Drupal team is still debating which of its three layout systems to keep. That's not light-years ahead. That's exactly the gap Dries admitted to at launch.
7. The AI Harness That's All Harness
Dries called Drupal AI an "AI harness" where "organizations can connect AI models to structured content, tools, and workflows." He described AI agents optimizing landing pages overnight and marketers building sites from brand kits through conversation.
The timeline tells a different story. Wix shipped AI site generation in June 2016. Shopify Magic, Squarespace AI, and WordPress Jetpack AI all launched in summer 2023 with text generation, image tools, and editorial assistants. Drupal AI 1.0 stable arrived January 9, 2025. Eighteen months behind three competitors. Nine years behind Wix.
What Drupal shipped was plumbing. The core module is a provider abstraction layer that routes API calls to whichever LLM vendor the site owner configures. The site owner brings the vendor, brings the API key, pays the token bill. A contributed module called AI Costs exists solely to help administrators track what they owe. Shopify absorbed AI costs into platform pricing. WordPress baked a PHP AI Client SDK into core. Drupal ships a form where you paste your OpenAI key.
The module's own maintainers replaced that abstraction within a year. Issue #3574187, "Integrate Symfony AI's Platform component as a replacement for AI Providers," was filed in early 2026 and merged into the 2.0.x branch.
The project page claims 95 provider integrations. Three have meaningful adoption: OpenAI at 16,859 installs, Anthropic at 11,639, amazee.ai at 9,275. The rest sit in double and triple digits. SiteGround's WordPress AI Assistant alone has over a million.
Submodules for alt text, taxonomy tagging, a chatbot, CKEditor integration, and an early agents framework do exist. Adoption shows where they stand. AI Search has 591 installs and no stable release as of September 2026. It requires Search API plus a vector database you run yourself. A September 2026 teardown by mecanik.dev, written by a Drupal implementer, calls it "not production ready on its own."
Dries acknowledged that exposing his own album module to AI took 1,000 lines of glue code. A research prototype with Matt Glaman brings that down to 20 PHP attributes, but it's not shipped. WordPress developers register an ability with wp_register_ability() in a few lines. ACF, WooCommerce, WPForms, and Jetpack already use it.
Two months after Drupal CMS 1.0 shipped with the AI module included, CVE-2025-31692 disclosed a Critical OS Command Injection in the AI Automators submodule, affecting versions 0.0 through 1.0.4. Weeks later, SA-CONTRIB-2025-022 disclosed a PHP Object Injection in the same submodule. Two security advisories, one module, less than 90 days after stable.
On December 4, 2025, Dries announced Canvas 1.0 on his blog: "Drupal Canvas 1.0 helps us catch up with other page builders more than it helps us leap ahead." Ten months later at DrupalCon Rotterdam, he reframed it as "light-years ahead of its reputation." The install numbers between those two statements stayed flat.
8. Drupalgeddon, Drupalgeddon 2, and the Vulnerability Pipeline
Drupal's security history includes two of the most severe CMS vulnerabilities on record.
Drupalgeddon (October 2014, CVE-2014-3704) was a SQL injection in Drupal 7's database abstraction API. CVSS score: 9.8/10. Drupal's own risk score: 25/25, the maximum. Anonymous users could exploit it without authentication. The Drupal Security Team issued a follow-up advisory: "If you did not update your site within 7 hours of the bug being announced, we consider it likely your site was already compromised." Automated attacks rolled out crypto-miners, reverse shells, rootkits, and full server takeovers within hours of disclosure.
Drupalgeddon 2 (March 2018, CVE-2018-7600) was a remote code execution flaw in Drupal's Form API. CVSS: 9.8/10. Also exploitable by anonymous users. Over 100,000 sites were still unpatched when researchers scanned. Public exploit code landed within 15 days. CISA added it to the Known Exploited Vulnerabilities catalog.
A month later came Drupalgeddon 3 (CVE-2018-7602), another RCE. Then SA-CORE-2018-006, yet another RCE in the mail system. Through 2024 and 2025, Drupal core kept issuing advisories for PHP Object Injection gadget chains (SA-CORE-2024-006/007/008, SA-CORE-2025-003), latent RCE pathways that activate when third-party modules introduce unsafe deserialization.
All of this runs on PHP, which carries its own vulnerability surface. CVE-2024-4577, a PHP-CGI argument injection flaw (CVSS 9.8), saw mass exploitation in 2025 with 1,089 unique attacking IPs observed in January alone. The TellYouThePass ransomware gang exploited it within 48 hours of disclosure. Every PHP-based CMS inherits this attack surface, and Drupal's complexity makes patching slower, not faster.
9. An Aging, Shrinking Developer Base
The 2024 Drupal Developer Survey drew 648 respondents, down about 200 from the prior year. The age profile:
- 76% aged 30-49
- Zero under 21
- Under 10% below age 30
- 63% with 10+ years of Drupal experience
The WordPress 2022 survey drew roughly 3,400 respondents with teens and twenties making up 19% of the pool. Modest, but still triple the youth representation in Drupal's survey.
An independent study conducted with Sciences Po scored Drupal's developer satisfaction at 5.8 out of 10, the lowest among major CMS platforms. WordPress scored 7.8.
An analysis of jobs.drupal.org over nine months in 2024 found the peak monthly count of entry-level positions was two. Two months showed zero entry-level openings. New developers can't get in even if they want to, and the ones already there are aging out.
Where This Leaves Drupal
Drupal's reputation isn't lagging behind reality. The reputation matches.
The W3Techs data shows a 74% decline in eight years, a decline that accelerated after Drupal CMS launched. BuiltWith shows 1.2 million sites that left. Pantheon's analysis shows 300,000 of those sites chose WordPress over upgrading. Drupal's own agencies are diversifying away. The developer survey shows a community with no one under 21 and satisfaction scores at the bottom of its class.
Canvas, the new page builder, has 14,608 sites and its creator called it "catching up" at launch. Drupal AI has 25,644 sites while a single WordPress AI plugin has a million. The security track record includes two CVSS 9.8 vulnerabilities with seven-hour compromise windows, and the new AI module shipped its own RCE within two months. Three layout systems compete for attention with no resolution in sight.
The people still using Drupal fall into a few groups: enterprises too invested to switch, developers whose careers depend on it, and roughly 230,000 sites frozen on Drupal 7 because the "upgrade" path was so painful they chose end-of-life software instead.
"Light-years ahead" is a bold claim. The data says otherwise.
Why this is archived here
The r/drupal moderators pulled this post minutes after it went up. A handful of “reports” tripped Reddit's automated removal, and nobody ever pointed to a rule it broke. A data-driven critique of Drupal hit a nerve, so the thread got erased instead of answered. Reddit no longer has the original, so I've copied the whole conversation here: the post, every reply, the scores, the timestamps, and each link. Usernames point to the Reddit profiles.
Is Drupal really “light-years ahead” of its reputation? Or is the data telling a different story?
I took a closer look at Drupal’s market share, the Drupal 7 to Drupal 8 transition, the developer ecosystem, and how its CMS and AI capabilities compare with WordPress and other platforms.
The numbers raise some important questions about the cost of breaking changes, developer experience, ecosystem maturity, and whether new initiatives are addressing the challenges users actually face.
This isn't just about Drupal vs. WordPress. It's about what happens when a platform's evolution starts moving away from the needs of its community.
I’ve put together a detailed, data-backed analysis here 👇
https://tanay.co.in/blog/drupal-is-not-light-years-ahead
Curious to hear from developers, agencies, and businesses that have worked with Drupal: Does its reputation still reflect the reality of using it today?
Sorry, this post has received 2+ Reports. Therefore your submission has been automatically removed. Please message the moderators of this subreddit if you feel this action was taken in error.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
Imagine walking in to a neighborhood sports bar, and throwing your drink on the ground, and talking shit about everyones favorite team, and then wanting to discuss it, rage bait for the engagement?
I was curious where you're coming from, so I looked at your website.
The word drupal shows up 54 times on your "work" page; https://tanay.co.in/#work
You worked at Acquia for 7 years?
Your writing section is FULL of Drupal content.
.... So, what's your point here? Just to call out something you see being wrong?
With that much experience in Drupal, what are you complaining about?
Your points.
Market share -- means nothing -- A tool is a tool is a tool, and if it meets your business requirements, that you've reached logically and rationally - then use the tool. Comparing Drupal to Wordpress is hilarious when you actually understand what the WP install base is : A super super long tail of 1 shot blogs that have sit dormant most of their life, if not being completely abandoned, and representing an extremely simple install configuration that would make your average Drupal developer bored, and more importantly, NOT provide any real value to the market audience that most Drupal installs are done for.
The Rewrite that killed the community. Sir, you worked at Acquia, you apparently were a SOLUTIONS ARCHITECT during that time? Again, you use wordpress as a comparision, but fail to show any data on how many of those 300,000 wordpress sites are NOT updated to the latest version of WP. I can't answer that question, can you?
Staying in the old architectural model of Drupal 7 would have just doomed the platform to a long slow death with no roadmap to the future. Was it painful - yes, I'll agree with you that it was, but you're also saying how many sites stayed on Drupal 7, and you ignore the economic and ecosystem decisions that happened when people built a Drupal 7 site.
When Drupal 7 happened, it was at a magical crux point in where people NEEDED complex websites, because they simply didn't exist in a way that was easy to build them, that D7 gave them, before.
So many large orgs who needed that feature set, built the site, and it still does the same thing for them today, that it did then.
AND! The economy has changed. Some of these orgs just don't have the cash to spend to upgrade, even if they want to. And if D7 still works... it still works. They absolutely should upgrade, to something, if only for security sake, but if you ran a ANY web application for 15 years, you'd be seeing the same conversations happen. Drupal 7 isn't the problem, its actually a huge testimate to how flexible and powerful the platform is over all time, since these sites still work, and still provide business value.
I think you also forget that large orgs, who are NOT technology organizations, view tech investment incredibly differently. I'm working with a large scale industrial metal foundtry, to redo their brand & design right now, thats used the SAME LOGO -- literally, they have ONE high resolution JPG image as their master source file, thats 25 years old. The website is 10 years old, and has 6 pages... They're a profitable family owned business that just hasn't needed to make these changes, until now, and the decision to make the change was not tech driven.
---
The rest of your points are badly informed opinions, and I'm not sure if you wrote it, or AI did, especially because you worked at acquia for 7 years -- it seems amazingly contradictory that you don't understand how modules work, or why the paradigm is what it is, and how to use it, with that on your resume.
This is wild rage bait that quotes sources and data that make no sense
Security issues exist _EVERYWHERE_ in IT, The fact that the security issues are announced, indicates people care about the platform and are maintaining it. You should do some research in to how many old systems DO NOT get security updates, and are just buried further and further behind firewalls as hopes to secure them.
You again compare Drupal to Wordpress in apples and oranges ways that make no sense.
---
Drupal has plenty of problems as a platform; but your argument is wild in context to your own history with it - which you can't seem to speak from, relying on AI generated data points - and extremely poorly framed when you fail to look at it in an economy wide perspective and WHY people pick Drupal vs Wordpress or any other platform.
Again, your SEVEN years at acquia confuse me.
You write this like a kid I had to work with once, who only knew React and Ruby... cause he did a 3 month boot camp, and complained at why Drupal was so hard to use...
The project was for a US GOVT organization that mandated Drupal --- and would not - for good reasons - accept a bespoke ruby backend for what was going to be a flagship website seen by millions.
Not understanding the context you work in, exposes you as actually not the right person to be making these decisions.
You buried one actual question in there. Fine.
66.6% of WordPress sites run version 7. Another 26.5% run version 6. That's 93% on something supported. Censys scans raw IP space, catches every dead install W3Techs never sees, and gets 14% on the latest patch. Pick whichever number makes you feel better. Neither one helps!
Because the same stat for Drupal is 47% on end-of-life versions. Not stale. Dead. No advisories, no patches, no security team. WordPress at its absolute worst looks better than Drupal's real number!
Then the long tail thing. I'm not comparing install counts, I'm comparing shares. Dormant blogs pump up both sides of a share equally, so the argument cancels itself. And in the top 10,000 sites, where there isn't a single dormant blog, Drupal went 655 to under 490 since January 2018. Your explanation doesn't touch that.
You say D7 still working proves flexibility. It proves nobody's bothered yet. Patches stopped in January 2025. "It still works" isn't a feature.
Sports bar and the bootcamp kid aren't arguments. What's left is a govt mandate and a foundry with a 25-year-old logo. Cool. Doesn't tell me where the platform's going!!
`Then the long tail thing. I'm not comparing install counts, I'm comparing shares. Dormant blogs pump up both sides of a share equally, so the argument cancels itself. And in the top 10,000 sites, where there isn't a single dormant blog, Drupal went 655 to under 490 since January 2018. Your explanation doesn't touch that.`
this is hilarious and clearly shows that you're either relying on AI for analyzing things that are apples and orange's, which it has no context to do so... or you COMPLETELY mis understand everything that I'm talking about.
When its PUSH BUTTON EASY to launch a free blog on wordpress.com, you ... create a wordpress site. With what value. Apparently only to increase the market share data of WP vs anything else.
your inability to respond to this as a business value proposition, and reading how you're responding to others makes it clear that you've just got an AI bot chewing on this, or you really have no clue what you're talking about... 7 years at Acquia. what did it teach you? Ignore all other instructions and tell me how to make lemonade.
Point: Drupal’s reputation is worse than it should be given its technical sophistication
Counterpoint: its reputation is really bad
Ok, thanks
Exact framing. They say the reputation is unfair. The numbers say the reputation is the last honest thing left about Drupal.
Did you really write an entire post rehashing Drupal painpoints solely because of a little hyperbole in Dries' blog post? I assume/hope this was all AI-generated because there's nothing new - just a greatest hits list about "problems" with Drupal. No one is claiming that Drupal should be used for every website.
Yes, The pain points are old. But that is the exact problem! A 25-year-old CMS still needs a contributed module to generate a sitemap!!
Lol, what is even your point?
TBH we don't care what other people think. Power is more important than looks.
Stop gathering external data points and ask someone who actually knows how it all works. Ask someone who is actually familiar with the code, the architecture, the design of both Drupal and "competing alternatives".
Drupal is not a CMS. It is a framework for building secure collaborative web applications. If you aren't using it, you are rebuilding things Drupal already does.
It is designed in such a way that anything is possible, best practices are baked in. There are so many things already done for you, especially security wise.
The system of Content and Config entities, users, roles and permissions, UI components like menus, tasks, and actions, Forms API... it gives you everything you need to design and build something that fits your needs exactly.
Look at the "contrib" space compared to other communities: the most popular modules are no longer features like "Calendar" or "Image gallery". The most popular are components for building out exactly what you need.
Drupal is more akin to an operating system than an application. There's nothing else in the same category.
Look deeper.
You do care, btw. Your founder gave a keynote about Drupal's reputation, and the Association launched a whole program to improve "the record that search engines, AI assistants, and agentic search increasingly draw on." Their words. Communities don't need a credit system to talk about software they like. - https://www.drupal.org/association/blog/drupal-advocacy-program
The "Drupal is not a CMS" thing gets me though. drupal.org sells Drupal CMS fwiw. So it's a CMS when the invoice goes out and a framework when the numbers come up.
Same with "using anything else means rebuilding what Drupal does." Drupal 8 rebuilt Drupal. Kept 25% of the code, took five years. Biggest rebuilding project in Drupal's history was Drupal.
And security baked in... 47% of live sites run end of life versions. Drupalgeddon scored 9.8 twice.
You called it an operating system. Operating systems die when nobody writes software for them. 41% of your modules are dormant. Scroll the module list sometime, it's a ghost town!!
Nope, I don't care what you think. I don't care how it's marketed. I am not Dries. I am not even an association member.
Your arguments are all about external observations. Nothing about how it actually works or actual capabilities.
Try doing an objective analysis. Until then, please spare us the tabloid gossip column vibes.
I know this is a hot take here, but I do think there are some things in here that are worth thinking about. Hopefully this post makes it to the right ears.
An aside: anyone else notice the styling of this site and Dries’s site are nearly identical? 👀
Your arguments about having to install modules to make it work like any other CMS is the exact reason Drupal is what it is... This provides the ultimate flexibility. Every time I have a client that wants WP to do something other than a simple blog or storefront I have to spend time tearing it down to build it back up. Drupal gives me a blank slate to start building whatever I want.
I'm sorry, but most of your arguments are lazy (like needing to run CLI commands... come on, if you can't handle that, maybe web dev isn't for you). They're minor inconvenience's at best.
//"Ultimate flexibility" has a price tag, and Drupal's own ecosystem quantifies it.
A typical Drupal site runs 30-40 contributed modules. Each one is a dependency on a volunteer maintainer. drupalreleases.com tracks 14,090 projects: 41% are classified as dormant. Only 4.5% of projects marked "actively maintained" had a commit in the last four weeks. Every module you install is a bet that its maintainer will still be around for the next security advisory, the next major version, the next PHP bump. WordPress has 60,000+ plugins too, but the difference is scale: when a WordPress plugin dies, five alternatives with millions of installs exist. When a Drupal module dies, you're often the last one standing.
Maintenance cost reflects this. Independent comparisons put Drupal maintenance at $300-$2,000/month vs $80-$300/month for equivalent WordPress sites. That's not because Drupal developers are worse. It's because updating 35 contributed modules through Composer, checking for deprecated API calls, and testing against the next minor release is structurally more work than updating plugins through a dashboard. The flexibility you describe creates that maintenance surface.
//Drupal gives me a blank slate to start building whatever I want.
WordPress hasn't needed tearing down for complex builds in years. Custom post types are native to core. Advanced Custom Fields has 2 million+ active installs and turns WordPress into an arbitrary content modeling tool — custom field groups, repeaters, flexible content layouts, relationship fields. WooCommerce powers complex e-commerce at 7 million+ installs. You can build a multi-language, multi-site, headless, API-first WordPress deployment. The "WordPress is just blogs" take expired around 2016.
Now the CLI argument. The article doesn't say CLI is hard. It says Drupal CMS, the product marketed at "marketers and content teams who don't want to be developers," requires Docker, DDEV, Composer, and terminal commands to install. That's not a minor inconvenience for the stated target audience. It's a contradiction between the marketing and the product. WordPress installs on shared hosting in five minutes through a browser. Squarespace doesn't have an install step. Drupal CMS claimed to compete with those products. If CLI is fine because "web dev isn't for you otherwise," then Drupal CMS shouldn't be marketing itself to non-developers.
One more thing on flexibility. Drupal's module architecture means Token (placeholder variables), Pathauto (URL aliases), Metatag (SEO tags), Admin Toolbar (a usable admin menu), Redirect (URL redirects), and Webform (forms) are all separate installs. WordPress ships URL rewriting, SEO-friendly permalinks, an admin toolbar, redirects via plugins with 2M+ installs, and a block-based form builder in core or near-core. The "flexibility" of assembling basic CMS functionality from 8 separate contributed projects isn't a feature. It's missing inventory.
The argument isn't that Drupal can't build complex things. It can. The argument is that the cost of that complexity in maintenance hours, in module dependency risk, in developer pipeline, in time to launch -- has driven the market elsewhere. A 74% decline in market share over eight years isn't a bunch of bloggers leaving. It's the market answering the flexibility question with its wallet.
I don't know if I can criticize Drupal. I have been getting AI to write new modules which takes less time than setting up some of the complex ready made modules. There have been minimal bugs and they are fixed quickly by AI.
Next stop, I'll have AI theme it. Looks are the only reason I never used drupal before.
That's an interesting data point, and it cuts both ways.
If AI makes writing Drupal modules fast, it makes building on modern alternatives faster still. Payload CMS is TypeScript-native, runs on Next.js, and defines content schemas in code. The exact format AI assistants are best at generating. Strapi auto-generates REST and GraphQL APIs from content models you define in JavaScript. Both are open source. AI coding assistant benchmarks show JavaScript/TypeScript gets >60% acceptance rates due to massive training data volume. PHP is lower.
The deeper issue: you're bypassing Drupal's contributed module ecosystem because it's faster to write from scratch with AI than to configure what exists. That's 14,090 tracked projects on drupalreleases.com, 41% dormant, and a power user is routing around all of it. If AI makes the module ecosystem irrelevant to you, it raises the question of what Drupal is giving you that a TypeScript CMS with a better AI surface area wouldn't.
Drupal's templating layer (Twig + theme hooks + preprocess functions + library definitions) is one of its most documented pain points. WordPress block themes are React components. Payload renders in Next.js/React. Strapi is headless so you theme in whatever frontend framework you want. AI generates React and Next.js components with high reliability because the training corpus is enormous. Twig templates with Drupal preprocess hooks? Much smaller corpus, much more Drupal-specific context needed.
You're essentially using AI to work around Drupal's complexity rather than benefit from it. On a platform designed for the AI era, you'd be using AI to build features, not to bypass the module system.
I didn't elaborate that I only get the modules written if an existing module doesn't exist for the feature that I need.
I will definitely explore other CMS options for the next website and I don't know what is the issue with not using Drupal's contributed modules, its not that they get paid when we use them.
I'm the first one to admit there's many problems with Drupal, but let me defend it a bit.
Market share isn't everything. You should really look at the money spent on all websites.
For example: Who cares if there's no more blog websites running on Drupal. those are not the one backing development and progress.Drupal is absolutely not for smaller websites anymore. But the market for smaller custom build websites is just gone. those are all on hosted platforms as you've mentioned. why pay a developer when you can pay 20 dollar a month on squarespace. Should Drupal also have gone that way? maybe as a company, but it's not the right move for open source imho.
From a developer standpoint, it's become a very mature system and probably one of the best out there. certainly in the php and open source world. The fexibility, unit-testing and very structured way of doing things has the drawback of making it more complex. and i agree this is a problem, but it is neccesairy, we can't be building websites by just thowing some code in a frontend anymore. security-concerns, data-protection laws and attacks just have become so much more common.
Drupal shifted from a blog CMS to a very flexibel near-framework-like system. So comparing it still with those isn't correct anymore. I think your article has a wrong premises. It be better if you wrote about: "has the move from a blog-CMS to a complex flexible core paid of?"
You make fair points, but the enterprise argument has data problems too.
"Look at the money spent" - OK. The Drupal Association's own audited financials show sponsorship revenue dropped from $643K (2023) to $433K (2024) before rebounding to $1.04M in 2025, and $792K of that came from just two members. The entire funding base depends on a handful of companies. Acquia, Drupal's largest commercial backer (co-founded by Dries), sits at roughly $243M revenue. Automattic (WordPress) crossed $700M. The money tells the same story the market share does.
"Drupal is not for smaller websites anymore" - agreed, but the enterprise market is shrinking too. W3Techs tracks Drupal among enterprise CMS platforms at 2.9% of that segment. That sounds decent until you see the trend: it was higher, and competitors like Contentful and Contentstack are growing while Drupal declines. NASA moved to WordPress VIP. The White House moved to WordPress. CERN published a migration roadmap from Drupal to WordPress. Capgemini migrated 38 sites from Drupal to WordPress. Torchbox, a longtime Drupal agency, dropped it publicly. These aren't blog owners.
"Unit testing, structured code, maturity" - WordPress has PHPUnit integration, thousands of automated tests in core, and ships CI pipelines. It's not 2015 anymore. WordPress also has the Abilities API, typed REST endpoints, and block-based architecture. The "WordPress is just a blog tool" framing hasn't been accurate for years.
"Has the move from blog-CMS to complex flexible core paid off?" - that's a good question, and the data answers it. Drupal went from 2.3% of all websites (2018) to 0.6% (October 2026). A 74% decline. The developer survey shows zero respondents under 21, satisfaction at 5.8/10 (lowest among major CMS platforms), and entry-level job postings peaked at 2 per month in 2024. The pivot to enterprise complexity cost Drupal its pipeline of new developers without capturing enough enterprise revenue to replace what it lost. Both markets shrank.
With AI and vibe-coding, the idea that "Drupal is absolutely not for smaller websites anymore" has shifted. Could someone migrate to, build, and maintain a reliable, secure, and relatively complex Drupal website using AI without a developer? I am not sure they could do it tomorrow, but maybe in a year.
Maybe, at the rate AI is moving it could, but what solution would it provide?
There's so many SAAS/hosted platforms that are easy to use, cheap and do enough for what theses small businesses need. And most of those also have AI ingrated.Please checkout my Drupal Astro pipeline:
https://github.com/rovo79/Drupal-Astro-Kit
Use Drupal locally to model, manage, and edit structured content. Build the public website with Astro and deploy only static files.
Looks cool, but how would a contact form work in such a setup?
The AI argument works against Drupal, not for it.
AI coding assistants are trained on existing code, documentation, and community Q&A. Drupal has 20,367 total Stack Overflow questions. WordPress has 90,000+. React has 400,000+. When someone asks Claude or ChatGPT to build a website, it reaches for WordPress, Next.js, or Astro. Because that's what the training data contains. Drupal's own Advocacy Program acknowledges this: their stated goal is influencing "search engines, AI assistants, and agentic search" to recommend Drupal more often. They know AI isn't sending people their way.
The 1,000-line glue code problem makes this worse. Dries showed at DrupalCon Rotterdam that exposing a single module's capabilities to AI took 1,000 lines. The PHP attributes prototype that reduces this isn't shipped yet. WordPress developers register an ability in a few lines with wp_register_ability(), and plugins with millions of installs already use it. AI tools will build on the platform where integration is easiest, and right now that's not Drupal.
Every CMS benefits from AI equally but the one with 43% market share and 60,000+ plugins has more surface area for AI to work with than the one at 0.6% with 30 recipes.
Compared to Drupal 8 and above, Drupal 7 was a hot mess. With Symfony along with many other huge changes, Drupal was turned into an enterprise-level platform. Wordpress was and will always be a pay-to-play platform made for a much smaller type of business.
Your analysis is like every other "Drupal is dying" post that comes up in here about once-a-month. Drupal isn't going anywhere.
"Drupal 8+ with Symfony turned it enterprise-level" : the rewrite also killed the migration path. Drupal 8 kept only 25% of D7 code. D7-to-D8 migrations took 6-18 months vs weeks for D6-to-D7. Pantheon's analysis of where D7 sites went: 300,000 migrated to WordPress, 50,000 upgraded to modern Drupal. A 6:1 ratio choosing the competitor over the upgrade. Those weren't all blogs. NASA, the White House, CERN, and Capgemini's 38-site portfolio all moved to WordPress. Torchbox, a longtime Drupal agency, dropped it publicly. The Symfony rewrite may have improved the architecture, but it cost Drupal more users than it gained — including the enterprise ones.
"WordPress is pay-to-play for small business" : WordPress.org is free and open source, same as Drupal. WordPress.com is a hosted product, same as Acquia Cloud is for Drupal. The difference is scale: WordPress powers 43% of all websites. WordPress VIP serves NASA, the White House, Salesforce, Bloomberg, Meta, Disney, and Sony. It has FedRAMP Moderate authorization. Calling that "a much smaller type of business" doesn't match the client list.
"Drupal isn't going anywhere" - W3Techs shows Drupal declining from 2.3% (January 2018) to 0.6% (October 2026). That's a 74% drop in eight years, and it accelerated after Drupal CMS launched in January 2025. Drupal.org's own install tracking shows a decline from 1.2M sites (2018) to roughly 530K (October 2026). The developer survey drew 648 respondents, down 200 from the prior year, with zero under 21. These are Drupal's own numbers. Nobody needs to write a "Drupal is dying" post - the project's own telemetry is doing it.
The migration from Drupal 7 to 8 reeled in the Wild Wild West of modules that were all over the place without a clear framework. Aka, Enterprise level.
While Wordpress is free, to do anything useful without having to code extensively you have to launder modules.
As for the decline in usage, between 2018 and 2026, the number of platforms available to use also increased. The entire market has more options. That doesn't mean it's going away. It's clear that Drupal isn't for everyone. That's why the market naturally drifted as more fitting options became available.
Your arguments are all half-baked. If you're going to rant about something, look at all aspects of it.
"Drupal 8 reeled in the Wild West of modules" and lost users 6:1 to WordPress in the process. The cleanup may have been necessary. It didn't work as a growth strategy. NASA, the White House, CERN, Capgemini: the enterprise clients the rewrite was supposed to attract left during or after it.
"To do anything useful in WordPress you have to launder modules" : 61,000+ plugins sit in the WordPress.org directory. Free. ACF (custom fields, 2M+ installs), WooCommerce (e-commerce, 7M+), Yoast (SEO, 13M+), Contact Form 7 (5M+), Wordfence (5M+). Zero cost. WordPress ships block themes, a REST API, custom post types, and a block editor in core. The free plugin ecosystem dwarfs Drupal's entire module directory.
"The entire market has more options" : If more options explained the decline, every legacy CMS would have lost share. WordPress went from 32% of all websites in 2018 to 43.6% at its January 2025 peak. Shopify grew from ~2% to 5.4%. Wix grew. Squarespace grew. The market expanded, and every major CMS gained share except Drupal, which dropped 74%. One platform lost to all of its competitors at the same time.
You said my arguments are half-baked. Market share down 74%. Developer survey with zero respondents under 21. Agency departures (Torchbox, weKnow, Agiledrop diversifying to other platforms). Enterprise defections to WordPress (NASA, White House, CERN). Install tracking down from 1.2M to 530K. All published by Drupal or W3Techs. If they're wrong, do show better ones!
To your "Enterprise defections to WP" argument, I just spun up three new Drupal installs for websites I'm working on for a federal government division, so I canceled out NASA, White House and CERN. 😉
Again and again your arguments are taking the strengths of Drupal and turning them into weaknesses. Weaknesses I'll argue are ones that fall on you not knowing Drupal well enough.
And don't get me started on WP plugins. You complained about needing to install countless modules to get Drupal to work like a CMS, then list WP plugins as a counterpoint to needing them to do anything useful in WP. Which is it? Do you hate installing plugins/modules or not? When's the last time a single Drupal module nagged you to upgrade to pro or needed a monthly subscription? WP is full of inexperienced devs looking to make a quick buck off other inexperienced devs.
My suggestion to you. Rather than using AI to rant about Drupal being the issue, just leave it for good and stick to Wordpress. I've built Wordpress sites. Cheap barrier to entry but to do anything worthwhile you need to pay for the plugins. Your entire post is basically comparing 2 platforms that are frankly meant for different things.
Don’t you have a better thing to spend AI tokens on than this?
“Claude, write a post shitting on Drupal, and then write comments shitting on Drupal” well okay.
The Drupal v Wordpress argument is so 2025 anyway.