Drupal Is Not "Light-Years Ahead"
Drupal's creator says the platform is "light-years ahead of its reputation." The numbers paint a different picture.
Dries Buytaert, Drupal's creator, published a post claiming the platform is "light-years ahead of its reputation." But Drupal has spent the last decade burning goodwill with the people who built their businesses on it, and the data shows a platform in freefall, not a comeback story.
1. A 74% Market Share Collapse
W3Techs tracked Drupal at 2.3% of all websites in January 2018. By October 2026, that number had fallen to 0.6%.
| Year | Drupal % of all websites |
|---|---|
| 2015 | 2.0% |
| 2018 | 2.3% (peak) |
| 2020 | 1.7% |
| 2022 | 1.3% |
| 2024 | 1.1% |
| 2026 (Oct) | 0.6% |
WordPress held around 43% over the same period. Shopify grew from 0.9% to 5.3%. Wix from 0.4% to 4.2%. Squarespace from 0.7% to 2.4%. Every major CMS outside Drupal and Joomla either grew or held steady.
W3Techs' June 2025 summary puts it bluntly: "Joomla and Drupal, two open source tools that ranked 2nd and 3rd in the years before 2020, are now declining."
BuiltWith tracks 457,053 live Drupal websites alongside 1,213,840 that used Drupal and left. For every site still running it, nearly three have walked away.
2. The Rewrite That Killed a Community
Drupal 8 was the inflection point.
The Drupal team didn't release an upgrade. They shipped a new CMS. They replaced the procedural, hook-based PHP architecture with an object-oriented system built on Symfony. About 25% of D7's code survived. They swapped PHPTemplate for Twig, made Composer mandatory, and forced every contributed module to be rewritten from scratch. If you ran a Drupal 7 site, you had to rebuild from zero.
D6 to D7 upgrades took weeks. D7 to D8 migrations ran 6 to 18 months for comparable sites. One user in Drupal's own issue queue reported: "A very large organization updated their Drupal 6 to 7, in three months. Doing the exact same task to Drupal 8 took them 18 months."
Pantheon co-founder Josh Koenig analyzed BuiltWith data covering 800,000+ Drupal 7 sites:
| Destination | Sites |
|---|---|
| WordPress | ~300,000 |
| Modern Drupal (8/9/10/11) | ~50,000 |
| Still on Drupal 7 | ~230,000 |
| Other (hundreds of platforms) | Remainder |
For every site that upgraded to modern Drupal, six left for WordPress. NASA, the White House, CERN, Capgemini, Her Campus Media all moved to WordPress. Torchbox, one of the UK's leading Drupal agencies after 11 years with the platform, dropped it in 2018. All eight of their full-time Drupal developers were offered the chance to retrain on a different stack.
As Koenig wrote: "Since people had to go through a total rebuild anyway, it created a decision point for every D7 adopter."
Most of them decided to leave.
Backdrop CMS, a fork built by respected core contributors Nate Haug and Jen Lampton to preserve the D7 philosophy, has attracted only 4,200 sites after more than a decade. Haug and Lampton had asked Dries to keep it as "Drupal Classic" within the official project. He refused. "The outcome of that meeting was 'Drupal is Drupal 8.'"
Earl Miles, the developer behind Views and CTools (the two most popular Drupal modules ever written), said in 2022: "I prefer Drupal 7 to Drupal 9. I feel like one particular community was listened to, and another community was ignored. That ignored community is still using Drupal 7."
As of October 2026, roughly 29% of all Drupal sites still run version 7, which hit end-of-life in January 2025 after three deadline extensions (originally November 2021, pushed to November 2022, then November 2023, then finally January 2025). The Drupal Association kept pushing the date because so many site owners could not migrate, or refused to.
3. The Fourth "Make Drupal Easy" Initiative
Drupal CMS (originally called Starshot) was announced in May 2024 as the fix for everything. Dries promised delivery in eight months. He called it a way to make Drupal "radically easier."
It shipped as 1.0 on January 15, 2025. The decline didn't stop.
W3Techs had Drupal at 0.9% when Drupal CMS launched. By October 2026, it was 0.6%. The market share drop accelerated after launch, not before.
The product itself tells you why. Drupal CMS 1.0 shipped with zero Site Templates, the marquee feature Dries described as a replacement for distributions. They were announced later at DrupalCon Atlanta in March 2025 as a future concept. A marketplace was being "explored." The 1.0 release included roughly 30 recipes, which are one-time configuration scripts, not ongoing functionality. WordPress has 60,000+ plugins and 12,000+ themes. That gap isn't closing.
Installing Drupal CMS locally still requires Docker, DDEV, and Composer via CLI. There's a "one-line installer" that runs bash <(curl -fsSL ...) in a terminal, not something a non-developer would recognize. The official hosting guide still says: "Command line access via SSH to run Composer commands is required to run Drupal, and Drush is also indispensable." When a user asked in the issue queue how to install on shared hosting without Composer, a core contributor replied: "I do not think there is another possible way."
WordPress runs on $3/month shared hosting with one-click installs. No CLI. No Docker. No terminal. That hasn't changed.
The UX Manager role was created in May 2025, four months after 1.0 shipped. The announcement acknowledged that "UX input has often arrived late, focusing on small usability tweaks rather than shaping the overall experience." A DrupalCon Vienna 2025 session titled "No more steep learning curve!" promised to share UX research findings, meaning the research wasn't done before launch. The session title tells you where they are: still steep.
This pattern isn't new. Drupal has tried this before:
| Initiative | Years | Outcome |
|---|---|---|
| Lightning (Acquia) | 2014–2021 | Abandoned. 39 sites remaining. |
| Thunder (Hubert Burda Media) | 2016–declining | Declining from 0.2% to 0.1% of Drupal sites |
| Acquia CMS | 2021–? | Replaced Lightning. Acquia-specific, not a community solution. |
| Drupal CMS | 2024–present | Market share still falling |
Dries acknowledged this history by saying Site Templates "could replace Drupal distributions, a concept that has been part of Drupal for nearly 20 years." Twenty years of trying. The track record is: launch with fanfare, decline, abandon.
Meanwhile, the agencies that built their businesses on Drupal are diversifying. weKnow Inc, a Drupal agency, moved its own website to WordPress and Elementor in March 2024. Their CEO wrote that "a small corporate website turns out to be an overkill for Drupal." CrucianPoint migrated 100+ managed Drupal sites to Laravel and WordPress. Agiledrop, a 70-person company where 90% of revenue came from Drupal, moved its own site to Storyblok. Their CEO said: "At DrupalCon, I talked to other agency owners. Everyone sees it. There's less demand for Drupal coming from the market."
When Drupal's own agencies are leaving, the problem isn't reputation.
4. A CMS That Can't Generate a List of Its Own URLs
WordPress added native XML sitemap support in version 5.5 (August 2020). You visit /wp-sitemap.xml and it works. No plugin. No terminal commands. No configuration.
In 2026, Drupal core still cannot do this. You install a contributed module (Simple XML Sitemap or XML Sitemap, two competing options for this one basic function), configure it, run cron or Drush to generate it, and then troubleshoot when it breaks on Views paths, unrouted URIs, or module upgrade conflicts. The Simple XML Sitemap issue queue is full of users whose sitemaps silently stopped generating, returned 404s, or crashed on menu links.
The module maintainer's response to one such bug: "Apparently barely anybody indexes menu links, otherwise this should not have stayed unreported for so long."
A content management system whose purpose is to manage and publish content, and it cannot produce a machine-readable list of that content without third-party help.
5. Death by a Thousand Modules
Getting Layout Builder, a core module, to work in Drupal 10 or 11 without Single Directory Components requires at least 8 contributed modules. That figure comes from a Drupal instructor who has taught 50,000+ students over 15 years.
The most-installed modules on drupal.org read like a list of features that should ship with any CMS: Token (placeholder variables), Pathauto (automatic URL aliases), Metatag (SEO tags), Admin Toolbar (a usable admin menu), Redirect (URL redirects), CAPTCHA (spam protection), Webform (forms), Paragraphs (structured content editing). Each one means a separate install, a separate maintainer to depend on, and a separate breakage risk on the next major version.
Of the 14,090 projects tracked by drupalreleases.com, 41% are dormant, collectively representing 6.3 million reported installs. Among projects claiming "actively maintained" status on drupal.org, only 4.5% had a commit in the last four weeks. Narrow that to "actively maintained" projects with 500+ installs: still only 15% with recent activity. A curated list of abandoned modules with no Drupal 11 path includes projects with over 100,000 installs.
You install a Drupal module, and you're betting the maintainer will still be around in two years when the next major version lands. The track record on that bet is poor, and the abandoned modules list keeps growing.
6. Catching Up, Not Leaping Ahead
Drupal Canvas (formerly Experience Builder) is Drupal's answer to the page builder problem. Dries presented it at DrupalCon Rotterdam as a major leap forward. But at its 1.0 launch in December 2025, he wrote something different:
"I also want to set expectations. Drupal Canvas 1.0 helps us catch up with other page builders more than it helps us leap ahead. We had to start there." – Dries Buytaert, December 4, 2025
Ten months later, he told a conference audience Drupal is "light-years ahead of its reputation."
Canvas 1.0 shipped without multilingual support, without migration paths from Layout Builder or Paragraphs, and without full support for entity types beyond nodes. Translation only stabilized in Canvas 1.8 around mid-2026. Product lead Lauri Timmanee confirmed on Talking Drupal #518: "On 1.0, not gonna have translation capability... it's not gonna have all of the capabilities that people can expect to have from using layout builder or paragraphs."
Canvas is not part of Drupal core. It's a contributed module that requires Drupal 11.3+. It reports 14,608 sites using it. WordPress Gutenberg, which shipped in December 2018 and has had eight years of iteration, reports 87.2 million active installations. Elementor, a third-party WordPress page builder, has 10 million+. Canvas is at 0.017% of Gutenberg's install base.
Canvas also landed in an ecosystem that already couldn't settle on a layout system. Drupal ships the legacy Block module in core, Layout Builder in core, and now recommends Canvas from contrib. A fourth option, Display Builder, lives in contrib too.
DrupalHelps, a respected Drupal educator, wrote: "If you build Drupal sites without writing much custom code, the current direction of Drupal site building is confusing." They asked the question Drupal hasn't answered: "What exactly are we supposed to build with?"
From Drupal's own core issue #3533472, a maintainer wrote: "Currently we have [three layout builders] between core and Drupal CMS [and we need to reconcile them] into ideally only having one." That issue is open in 2026. A second issue, #3619180, created August 2026, proposes removing Layout Builder from core entirely. Framework maintainer larowlan responded: "+1 from my point of view as a framework maintainer."
So Canvas is ten months old, not in core, missing features its predecessors had, and the Drupal team is still debating which of its three layout systems to keep. That's not light-years ahead. That's exactly the gap Dries admitted to at launch.
7. The AI Harness That's All Harness
Dries called Drupal AI an "AI harness" where "organizations can connect AI models to structured content, tools, and workflows." He described AI agents optimizing landing pages overnight and marketers building sites from brand kits through conversation.
The timeline tells a different story. Wix shipped AI site generation in June 2016. Shopify Magic, Squarespace AI, and WordPress Jetpack AI all launched in summer 2023 with text generation, image tools, and editorial assistants. Drupal AI 1.0 stable arrived January 9, 2025. Eighteen months behind three competitors. Nine years behind Wix.
What Drupal shipped was plumbing. The core module is a provider abstraction layer that routes API calls to whichever LLM vendor the site owner configures. The site owner brings the vendor, brings the API key, pays the token bill. A contributed module called AI Costs exists solely to help administrators track what they owe. Shopify absorbed AI costs into platform pricing. WordPress baked a PHP AI Client SDK into core. Drupal ships a form where you paste your OpenAI key.
The module's own maintainers replaced that abstraction within a year. Issue #3574187, "Integrate Symfony AI's Platform component as a replacement for AI Providers," was filed in early 2026 and merged into the 2.0.x branch.
The project page claims 95 provider integrations. Three have meaningful adoption: OpenAI at 16,859 installs, Anthropic at 11,639, amazee.ai at 9,275. The rest sit in double and triple digits. SiteGround's WordPress AI Assistant alone has over a million.
Submodules for alt text, taxonomy tagging, a chatbot, CKEditor integration, and an early agents framework do exist. Adoption shows where they stand. AI Search has 591 installs and no stable release as of September 2026. It requires Search API plus a vector database you run yourself. A September 2026 teardown by mecanik.dev, written by a Drupal implementer, calls it "not production ready on its own."
Dries acknowledged that exposing his own album module to AI took 1,000 lines of glue code. A research prototype with Matt Glaman brings that down to 20 PHP attributes, but it's not shipped. WordPress developers register an ability with wp_register_ability() in a few lines. ACF, WooCommerce, WPForms, and Jetpack already use it.
Two months after Drupal CMS 1.0 shipped with the AI module included, CVE-2025-31692 disclosed a Critical OS Command Injection in the AI Automators submodule, affecting versions 0.0 through 1.0.4. Weeks later, SA-CONTRIB-2025-022 disclosed a PHP Object Injection in the same submodule. Two security advisories, one module, less than 90 days after stable.
On December 4, 2025, Dries announced Canvas 1.0 on his blog: "Drupal Canvas 1.0 helps us catch up with other page builders more than it helps us leap ahead." Ten months later at DrupalCon Rotterdam, he reframed it as "light-years ahead of its reputation." The install numbers between those two statements stayed flat.
8. Drupalgeddon, Drupalgeddon 2, and the Vulnerability Pipeline
Drupal's security history includes two of the most severe CMS vulnerabilities on record.
Drupalgeddon (October 2014, CVE-2014-3704) was a SQL injection in Drupal 7's database abstraction API. CVSS score: 9.8/10. Drupal's own risk score: 25/25, the maximum. Anonymous users could exploit it without authentication. The Drupal Security Team issued a follow-up advisory: "If you did not update your site within 7 hours of the bug being announced, we consider it likely your site was already compromised." Automated attacks rolled out crypto-miners, reverse shells, rootkits, and full server takeovers within hours of disclosure.
Drupalgeddon 2 (March 2018, CVE-2018-7600) was a remote code execution flaw in Drupal's Form API. CVSS: 9.8/10. Also exploitable by anonymous users. Over 100,000 sites were still unpatched when researchers scanned. Public exploit code landed within 15 days. CISA added it to the Known Exploited Vulnerabilities catalog.
A month later came Drupalgeddon 3 (CVE-2018-7602), another RCE. Then SA-CORE-2018-006, yet another RCE in the mail system. Through 2024 and 2025, Drupal core kept issuing advisories for PHP Object Injection gadget chains (SA-CORE-2024-006/007/008, SA-CORE-2025-003), latent RCE pathways that activate when third-party modules introduce unsafe deserialization.
All of this runs on PHP, which carries its own vulnerability surface. CVE-2024-4577, a PHP-CGI argument injection flaw (CVSS 9.8), saw mass exploitation in 2025 with 1,089 unique attacking IPs observed in January alone. The TellYouThePass ransomware gang exploited it within 48 hours of disclosure. Every PHP-based CMS inherits this attack surface, and Drupal's complexity makes patching slower, not faster.
9. An Aging, Shrinking Developer Base
The 2024 Drupal Developer Survey drew 648 respondents, down about 200 from the prior year. The age profile:
- 76% aged 30-49
- Zero under 21
- Under 10% below age 30
- 63% with 10+ years of Drupal experience
The WordPress 2022 survey drew roughly 3,400 respondents with teens and twenties making up 19% of the pool. Modest, but still triple the youth representation in Drupal's survey.
An independent study conducted with Sciences Po scored Drupal's developer satisfaction at 5.8 out of 10, the lowest among major CMS platforms. WordPress scored 7.8.
An analysis of jobs.drupal.org over nine months in 2024 found the peak monthly count of entry-level positions was two. Two months showed zero entry-level openings. New developers can't get in even if they want to, and the ones already there are aging out.
Where This Leaves Drupal
Drupal's reputation isn't lagging behind reality. The reputation matches.
The W3Techs data shows a 74% decline in eight years, a decline that accelerated after Drupal CMS launched. BuiltWith shows 1.2 million sites that left. Pantheon's analysis shows 300,000 of those sites chose WordPress over upgrading. Drupal's own agencies are diversifying away. The developer survey shows a community with no one under 21 and satisfaction scores at the bottom of its class.
Canvas, the new page builder, has 14,608 sites and its creator called it "catching up" at launch. Drupal AI has 25,644 sites while a single WordPress AI plugin has a million. The security track record includes two CVSS 9.8 vulnerabilities with seven-hour compromise windows, and the new AI module shipped its own RCE within two months. Three layout systems compete for attention with no resolution in sight.
The people still using Drupal fall into a few groups: enterprises too invested to switch, developers whose careers depend on it, and roughly 230,000 sites frozen on Drupal 7 because the "upgrade" path was so painful they chose end-of-life software instead.
"Light-years ahead" is a bold claim. The data says otherwise.