Drupal CMS

Drupal CMS inherits the core Field API (text, number, list, date, link, entity reference, file, image, email, telephone, JSON via contrib) with UI-built content types that export to YAML config, and the base recipe installs field_ui, field_group, options and taxonomy so marketers can extend models in the browser. Schema-as-code exists through config export and recipes. Not higher because union/polymorphic fields need contrib (Dynamic Entity Reference) and are not bundled.

Core Entity Reference supports many-to-many references to any entity type with autocomplete or Views-based selection, and Views relationships allow reverse traversal; Canvas 1.11+ adds content-entity-reference props for components. Not higher because references are stored one way and reverse lookups need a View or the Corresponding Entity References contrib module.

Canvas ships as the default composition layer with nestable SDC and code components, slots, reusable patterns and content templates that map entity fields into component trees. Not higher because CMS content types rely on CKEditor HTML for body text rather than a portable structured format, and Paragraphs-style nested entities are not bundled.

Core provides required, cardinality, allowed values, length, file extension and size constraints, enforced through the Entity API so they apply to JSON:API writes as well as forms; custom Symfony constraints and the bundled ECA form plugins add cross-field rules. Not higher because there is no UI rule builder for regex or cross-field validation without ECA modelling.

Core revisions keep full history with author attribution and one-click revert, and Drupal CMS adds Trash for soft-deleted content (including Canvas pages) and autosave on all node forms. Not higher because no revision diff UI is bundled (Diff is contrib) and Workspaces-style branching is not part of the product.

Core taxonomy gives unlimited hierarchical vocabularies reusable across any entity type, per-vocabulary permissions to govern who adds terms, and terms exposed via Views and JSON:API; Drupal CMS ships a Tags vocabulary with field_tags and the Tagify widget, plus Metatag defaults on terms. Not higher because synonyms and bulk reclassification need contrib.

Canvas gives live WYSIWYG editing of Canvas pages and content templates with per-viewport preview and a non-default-language preview mode, and core node preview covers other content. Headless draft preview and SDKs for Next, Nuxt, Astro and Angular exist but canvas_headless is marked experimental. Not higher because click-to-edit on an external frontend is not production-ready and shareable preview links are not bundled.

CKEditor 5 in core provides headings, lists, tables, code blocks, media embeds, source editing and Word paste cleanup, and Drupal CMS adds Linkit for internal link autocomplete. Not higher because output is an HTML blob with no portable AST or custom mark annotations.

Drupal CMS preconfigures image, document, local and remote video media types, focal point cropping, responsive image styles with WebP derivatives, SVG support, bulk upload and AI-generated alt text when the AI recipe is applied. Not higher because transforms are predefined image styles rather than arbitrary URL parameters and asset usage tracking (Entity Usage) is not bundled.

Autosave is enabled on all content forms and core blocks concurrent saves of stale revisions, while Canvas conflict detection still sits behind the canvas_dev_cd feature flag. Not higher because there is no co-editing, presence, inline comments or mentions in the product.

Drupal CMS ships a basic editorial workflow (Draft, Published, Unpublished) auto-applied to new content types by an ECA model; core Workflows lets admins add custom states and role-gated transitions with revision log history. Not higher because there is no assignment, due dates or notifications, and the Drupal CMS docs state workflows are not yet available for Canvas pages.

Scheduler plus its content moderation integration are installed and auto-configured for every content type, giving scheduled publish and unpublish through moderation states. Not higher because there are no release bundles for atomic multi-item publishing and no calendar view.

The Multilingual recipe enables core field-level translation with per-field translatability, interface and config translation, a language checklist and Canvas translation support, and Canvas 1.12 adds symmetric translations and a non-default-language preview. Not higher because core has no configurable fallback chains and canvas_translate is still alpha.

Core gives custom roles with several hundred granular permissions including per-content-type and per-workflow-transition control, and Drupal CMS ships Administrator and Content editor roles plus ECA-granted media permissions. Not higher because field-level permissions, SSO and SCIM all require contrib modules that are not bundled.

Core JSON:API offers spec-compliant filtering, sorting, sparse fieldsets, includes and per-language access, with GraphQL 5 as a mature contrib option. Not higher because neither API is enabled in the Drupal CMS install and there is no separate delivery vs management endpoint.

Cache tags and the core recommended performance recipe give precise invalidation that CDNs can consume through Purge contrib, but Drupal CMS ships no CDN and its hosting docs leave delivery to the chosen host. Scored in the self-hosted band per the framework.

The bundled ECA event engine can react to entity create, update, delete and moderation transitions and send HTTP requests, so outbound notifications are possible without code. Not higher because there is no webhook UI with signing, retries or delivery logs; dedicated Webhooks modules are contrib.

Content is entity-based and available via JSON:API, and Canvas offers experimental headless rendering packages for several JavaScript frameworks. Not higher because Drupal CMS is a coupled site product, rich text is HTML and there are no mobile or non-JavaScript SDKs.

No Drupal CMS recipe installs segmentation or a CDP connector; Canvas carries a canvas_personalization submodule with a Segment entity and UTM condition, but it is hidden and not part of the product. Segmentation therefore depends on contrib such as External Personalization or Segment modules, so it sits low in the integration band.

Canvas has switch and case personalization components in a hidden submodule, so marketers cannot author audience variants in the shipped product. Personalization requires contrib or an external engine wired in by developers, which caps it in the integration band at the low end.

Drupal CMS has no experimentation feature; A/B testing comes from small contrib modules or an external tool such as VWO or Optimizely via tag management. Not higher because none provide integrated significance reporting inside Drupal CMS.

No recommendation engine ships; related content is limited to editor-curated references and chronological Views listings. Scored as manual curation only.

The Search recipe installs Search API with the database backend, a content index, a search view, per-type exclusion and indexing of Canvas-rendered content, giving visitors working full-text search out of the box. Not higher because faceting, typo tolerance, autocomplete and analytics need Solr, Elasticsearch or Algolia backends from contrib.

Drupal CMS ships no cart or checkout; Drupal Commerce 3.x is a mature community project with catalog, pricing, cart and checkout that installs on Drupal CMS, but it is not in the recipes or recommended add-ons. Scored as a marketplace capability below the integration ceiling because store setup is a developer project.

Community modules connect Shopify and BigCommerce with product sync, but none is maintained by the Drupal Association or offered in Drupal CMS, and there is no commercetools or SAP connector with a product picker. Scored at product-picker depth.

Drupal CMS includes an editorial dashboard, Yoast SEO content analysis, an SEO checklist and Editoria11y accessibility results, which are content health signals rather than performance analytics. Scored low because there is no page or content engagement reporting.

The Google Analytics recipe installs Google Tag with consent management via Klaro and accepts GA4, Ads and GTM container IDs, documented in the Drupal CMS promote guides. Not higher because Adobe Analytics, Segment or Matomo require separate contrib modules.

Core multisite runs many sites from one codebase with separate databases, and Drupal CMS adds site export as a recipe for repeatable builds. Scored in the silo band because content is not shared across sites without the Domain contrib suite.

The Multilingual recipe provides in-platform translation UI and imports interface translations, while TMS connectors (Phrase, Smartling, XTM, DeepL) come through the TMGMT contrib suite, which Canvas now supports for pages and templates. Not higher because TMGMT is not bundled.

Canvas Brand Kit (out of feature flag in 1.12) centralizes design tokens, fonts and brand assets per site, and site templates package a brand starting point. Not higher because there is no cross-brand policy enforcement or shared component library across sites.

Drupal CMS ships the core media library with taxonomy-ready media types, bulk upload and safe file deletion but no rights, expiry, approvals or asset versioning. Enterprise DAM comes only through contrib connectors (Bynder, Cloudinary), which places it in the marketplace connector band.

Local video upload and remote video (YouTube, Vimeo oEmbed) media types are preconfigured, with a Klaro consent gate for remote video. No transcoding, adaptive streaming or captions management, so video at scale is embedded from external services.

Canvas is the default page builder: drag-and-drop composition from a component library, editable patterns, page templates, content templates, multi-value props, Brand Kit tokens and in-browser code components, plus a catalogue of site templates. Not higher because workflows do not yet apply to Canvas pages and headless composition is experimental.

Drupal CMS renders the full site natively with themes (Mercury), Canvas templates and routing, but the Drupal Association does not host it; the hosting guide sends customers to any Drupal host. Scored in the renders-natively, customer-hosts band.

The Forms recipe installs Webform with its UI, a contact form, submission views and ALTCHA, CAPTCHA and Honeypot spam protection; Webform offers conditional logic, multi-step wizards, hidden fields and email or remote-post handlers. Not higher because progressive profiling and lead routing need extra work.

Drupal CMS bundles Easy Email for templated transactional mail with preview and logs, but ESP sync (Mailchimp, HubSpot, Brevo) comes from contrib modules. Scored as a basic connector.

The bundled ECA rules engine can trigger actions on content and form events, but it is not a nurture, scoring or drip tool. Marketing automation needs Mautic or HubSpot modules, so this sits just below the tight-integration band.

Drupal CMS ships Metatag with Open Graph and Twitter cards, SEO title, description and image fields, Pathauto URL patterns, Redirect with 404 tracking, Simple XML Sitemap, Yoast focus-keyword analysis and a guided SEO checklist. Not higher because schema.org JSON-LD and hreflang need contrib (Schema.org Metatag) rather than shipping in the product.

Nothing beyond standard SEO ships: no llms.txt, Markdown endpoints or AI crawler controls in any Drupal CMS recipe. Contrib llms_txt and RobotsTxt modules can add these, so the score stays at the top of the standard-SEO band.

Project Browser is preconfigured with a curated recommended add-ons source and full access to drupal.org's 50,000+ modules, installable from the admin UI, alongside a catalogue of free and premium site templates. Not higher because contrib quality varies and few connectors are vendor-certified.

Core user accounts give visitor registration, login (email or username via the bundled module), roles and permission-gated content, and Klaro handles consent. Not higher because social login, OpenID Connect and CIAM federation are contrib and there are no member portal templates.

Drupal CMS 2.2 (on Drupal 11.4) inherits the spec-compliant core JSON:API v1.1 module with consistent resource naming, relationships, sparse fieldsets, filtering and sorting; the contrib GraphQL module remains maintained. Canvas 1.12 adds a Canvas-owned routed content endpoint for headless apps with its own OpenAPI spec, but it sits in the experimental canvas_headless module. Core JSON:API still has no OpenAPI or interactive playground without contrib, which keeps this below purpose-built API platforms.

No vendor SLA or documented rate limits since Drupal CMS is self-hosted by default. The core engine keeps improving: Drupal 11.4 (July 1, 2026) roughly halves database queries versus 11.3 and adds Brotli compression for aggregated CSS/JS, and Drupal CMS 2.0 sites can adopt the 11.4 core line. Dynamic Page Cache and Internal Page Cache provide layered caching and JSON:API responses can sit behind Varnish/CDN, but there is still no CDN-backed delivery or built-in rate limiting out of the box — which is why this stays below CDN-delivered API platforms.

The Canvas project now publishes an official JavaScript Headless SDK on npm: @drupal-canvas/headless 0.11 (first release 2026-07-22), with adapters for Next.js, Nuxt, Astro, React, Angular and TanStack Start, alongside the official Canvas CLI and Workbench packages. The SDK is pre-1.0, backs an experimental module that Drupal CMS does not enable by default, and gets about 2K monthly downloads against 88K for the community next-drupal client. There are still no official Python, Java, .NET or Go SDKs, so this stays in the community-SDK band.

Drupal CMS can use the full Drupal.org ecosystem of 50,000+ contributed modules across payment, DAM, CRM, search, AI, email and analytics, plus a curated module set vetted for Drupal CMS. Drupal CMS 2.2.0 (2026-09-25) builds out the site template marketplace: partner templates, premium templates unlocked with license keys from third-party Composer repositories, and new bundled templates (Everbright, Mercury Demo, Forma, Lupus Decoupled Starter). Module quality varies and the maintained Drupal 11 subset is smaller, which keeps this below pure-marketplace leaders.

Extensibility is still the platform's strongest dimension. Recipes provide declarative building blocks, OOP hooks via PHP attributes modernize the hook system, and the Plugin API, Symfony DI and event subscribers extend every layer. Drupal Canvas, the default page builder in Drupal CMS, adds code components with npm imports, content entity reference props, editable page variants, external components from decoupled apps, and pluggable Canvas AI agents and tools.

SAML 2.0 (samlauth), OIDC (OpenID Connect), and OAuth2 (Simple OAuth) contrib modules are mature and available to any Drupal CMS install with no plan gating — an advantage over tier-gated SaaS competitors. MFA via the TFA module; API auth via OAuth2 bearer tokens. SSO requires contrib setup rather than turnkey configuration, which keeps this below platforms with built-in enterprise SSO.

Inherited from Drupal 11 core: hundreds of granular permissions, fully custom roles, and the node access grants system for content-instance-level access control. Field-level permissions via the Field Permissions contrib module; Content Moderation gates access by workflow state; the Group module enables audience-based access. Meets the field-level plus instance-level bar for a top-tier score; only the reliance on contrib for field-level control keeps it from higher.

Drupal CMS is open-source; certifications are hosting-provider dependent rather than inherent. Acquia holds FedRAMP + SOC 2 Type 2 + ISO 27001; Pantheon and Platform.sh hold SOC 2; Amazee.io offers ISO 27001-certified Drupal hosting. The GDPR contrib module provides consent management and DSAR tooling. HIPAA eligibility requires appropriate hosting configuration — the platform itself carries no certifications, capping this score.

Drupal core has issued 13 advisories in 2026 so far. They include the exploited highly critical PostgreSQL SQL injection (SA-CORE-2026-004), a Critical PHP object injection (SA-CORE-2026-005, June 17), and eight more moderately or less critical issues from June to September. Components that Drupal CMS bundles added their own: two Canvas improper-validation advisories (July 1) and about seven for the AI, AI Agents and AI translate modules between June and September. Coordinated disclosure, patches across all branches, the HackerOne program and Drupal CMS 2.2 encrypting AI provider keys at rest are genuine strengths, but this volume and severity push the score below the 70+ clean-history band.

Drupal CMS supports self-hosted (any PHP/MySQL environment), managed platforms (Acquia, Pantheon, Platform.sh), Docker via DDEV, and private cloud. Composer-based deployment is portable across environments with no SaaS lock-in — ideal for regulated industries. Maximum flexibility at the cost of operational complexity, which is scored in other items.

No inherent SLA — Drupal CMS is self-hosted by default and the customer owns uptime. Hosting-provider SLAs apply where used: Acquia Cloud Enterprise 99.95%, Pantheon 99.9%. No central status page because there is no central SaaS service. Scores appropriately lower than SaaS platforms per the self-hosted anti-pattern guidance.

Drupal is proven at massive scale (government portals, global media), and the core engine keeps getting leaner — Drupal 11.4 roughly halves database queries versus 11.3, with cold-cache lookups down to about a third of 11.0/10.6. Cache tag-based invalidation enables granular CDN/reverse-proxy management, and horizontal scaling patterns (load balancers, read replicas, Redis/Memcached, Varnish, CDN) are well documented. The ceiling is high but reaching it requires operational expertise rather than vendor-managed auto-scaling.

Configuration Management exports full site configuration as version-controlled YAML, and Drupal CMS 2.2 now keeps config outside the web root by default. Database and file backups use standard MySQL/PostgreSQL tooling or Backup and Migrate, and the Migrate API gives open-format portability without lock-in. The new drush site:export captures a site as a reusable template, not as a backup. RTO/RPO depend on the hosting environment and there is no built-in multi-region failover, so recovery targets are left to operators.

DDEV is still the officially recommended local environment: one command gives a Docker setup close to production, and new.drupal.org has dedicated Drupal CMS install docs. Drush covers config, database and cache work. Drupal CMS 2.2 ships a generic AGENTS.md in the project template for AI coding assistants. The Canvas CLI and @drupal-canvas/workbench give a local, Storybook-style component workflow, now including code components from headless codebases.

Configuration Management is built for CI/CD: all configuration moves through version control as YAML via drush config:export/import, and Drupal 11.4 roughly doubles the speed of recipe-based installs. Drupal CMS 2.2 adds drush recipe:compare, pm:clean, canary tests for recipe config consistency and PHPStan level 7 on its own CI, and Canvas adds a canvas:doctor health check and CLI push/pull for code components. Branch-based environments come from hosts such as Pantheon Multidev and Platform.sh, not from the platform itself.

Drupal CMS documentation at new.drupal.org covers getting started, DDEV installs, recipes and site building, and Drupal Canvas has its own docs site for code components, now extended with Canvas Headless guides such as multilingual sites. The api.drupal.org reference is thorough but auto-generated and not beginner-friendly. There is no interactive API playground and contrib module docs are uneven.

The official Canvas Headless SDK ships TypeScript declarations with framework adapters for Next.js, Nuxt, Astro, React, Angular and TanStack Start, and the Canvas compiler and CLI handle TSX code components. The SDK is pre-1.0 and experimental, and it does not generate types from the Drupal content model. Content-model types still depend on community tools such as the TypeScript Definition Generator and next-drupal, so this stays below the typed-SDK band.

Drupal CMS shipped 2.1.4 (Sept 1), 2.1.6 (Sept 23) and the 2.2.0 minor (Sept 25, 2026) with premium site templates, AI key encryption and a project-level AGENTS.md, while bundled Canvas released 1.8 through 1.12 between July and September and core shipped 11.4.0 through 11.4.8 since July 1. Held at 78 rather than 80 because the distribution itself went three months between 2.1.3 (June 2) and 2.1.4, and Drupal 12 has only reached alpha1 (Sept 2) with beta1 still untagged past its mid-September target.

drupal.org/project/cms/releases provides per-release notes, and the underlying history uses conventional-commit prefixes (feat/fix/chore/task) scoped to each sub-project with linked issue numbers, so 2.2.0 changes such as premium template licensing, config outside the web root and SA-2026-004 dependency floors are traceable. Core change records flag API changes with migration steps. Not 80+ because the distribution's published notes remain lighter than core's and do not consistently call out breaking changes separately.

The Drupal 12 plan is tracked in a public meta-issue that now states an early-December 2026 release, with public sub-issues for alpha1 (done), beta1 requirements, 12.0/11.5 beta targets and 12.0.0 release notes. The AI Initiative publishes a 2026 roadmap with named workstream leads, and all Drupal CMS work happens in public issue queues. Not higher because there is no community voting portal comparable to Canny.

Core deprecates APIs for at least a minor cycle with change records, has adopted a policy deferring disruptive 11.3 deprecations until Drupal 13, and ships 11.5 as an LTS alongside 12.0 so sites are not forced onto the new major. Drupal CMS manages transitions itself: 2.x shipped a Content-create menu shim and converted the Starter template to a monolith ahead of 11.4, and added canary tests for recipe config consistency. Not higher because Drupal 12 drops update paths below 11.3 and removes six core modules, so cross-major upgrades still need manual work.

Drupal remains one of the largest open-source CMS communities: 800+ Slack channels, tens of thousands of registered contributors on drupal.org, roughly 1% of all tracked websites and a strong position among top-traffic sites. Two annual DrupalCons (Chicago March 2026, Rotterdam September 2026) draw global participation. Not 90 because GitHub-star and npm-style signals are less prominent for a PHP platform than for JS ecosystems.

The AI Initiative drew 31 contributing agencies by DrupalCon Chicago 2026, with 28+ organizations pledging 23+ FTE contributors, and Drupal CMS 2.2.0 incorporated templates and fixes from many outside maintainers. DrupalCon Rotterdam 2026 ran a full program including specialized summits. Not higher because commentators have questioned DrupalCon attendance counting, and developer surveys show almost no participants under 21.

Drupal CMS 2.2.0 turned the installer into a template marketplace: about two dozen agency-built site templates are listed with 'Created by' attribution, and premium templates can be sold with license-key validation (Dripyard's Meridian Charter School lists at $899), alongside Varbase, Convivial Gov and Provus EDU starters. This sits on the tiered Drupal Certified Partner program and the AI Initiative workstreams led by QED42 and 1xINTERNET. Not 85+ because major global SIs such as Accenture and Deloitte are not Drupal Certified Partners.

Decades of tutorial content: thousands of YouTube videos, Udemy and LinkedIn Learning courses, DrupalCon session archives and extensive drupal.org documentation. Agencies (Droptica, Annertech, Stone Circle, 1xINTERNET, PreviousNext) publish steady 2026 coverage of Drupal 11.4, Drupal 12 and Drupal CMS 2.x, and trade press (TheDropTimes, CMSWire, CMSCritic) covers each release. Near the top of this metric among open-source CMSs; Drupal CMS-specific material on Canvas is still thinner than core coverage.

Drupal Jobs remains active and Drupal developers are available in volume across North America, Europe and South Asia, backed by Acquia certification and a deep agency bench. The generational pipeline is narrowing, with developer surveys showing no respondents under 21 and few with under a year of experience. Near-term availability is strong, so not lower.

Momentum is bifurcated. Drupal CMS keeps shipping and 2.2.0 widened vertical coverage (charter schools, healthcare, government, insurance, nonprofits) through partner templates, but aggregate Drupal share has declined from about 7% of CMS sites in 2013 to roughly 1.1 to 1.2% in 2026 and Shopify has passed it overall. Enterprise position holds at 6 to 7% of the top 10,000 sites. Not higher while aggregate share erodes and there are no published Drupal CMS install-growth figures.

The AI Initiative met its $1M goal in five months and grew to $1.5M with 31 contributing agencies by DrupalCon Chicago 2026, backed by the Drupal Association's Vision Fund. Non-profit governance plus Acquia as commercial anchor insulates the project from VC pressure, and the paid template channel in 2.2.0 opens a new revenue path for contributors. Not higher because the Association has itself flagged financial sustainability challenges.

Drupal CMS positions as the accessible, AI-ready open-source alternative to proprietary DXPs and site builders, with Canvas, bring-your-own-model AI and a growing site template catalogue giving it a clear story against WordPress and commercial DXPs. No current Gartner MQ names Drupal CMS, and aggregate market share keeps eroding. Clear differentiation keeps it above 60; lack of analyst recognition keeps it below 70.

G2 last showed 3.9/5 from roughly 445 to 470 reviews in mid-2026; it could not be re-verified this pass, so confidence drops to MEDIUM. Under the formula, sub-4.0 with fewer than 500 reviews lands in the 45 to 60 band. Reviews praise flexibility and customization and criticize the learning curve, coding requirements and hosting cost, which Drupal CMS 2.x targets but has not yet moved in aggregate.

Drupal CMS is free, open-source software, so there is no license cost to find out. Drupal CMS 2.2.0 added premium site templates, and their USD price is shown right in the installer's template picker ($899 for the one paid template listed), so the new paid option is transparent too. It stops short of the ceiling because total cost still means researching hosting and implementation separately, and both have wide price ranges.

With no license there is no API metering, no seat count and no vendor bandwidth overage, and hosting is priced on its own. The optional bundled amazee.ai provider moves to flat monthly plans after its trial, and bring-your-own-key AI means model spend goes through the buyer's own provider account. The main unpredictability is implementation: 3-year TCO commonly runs 1.7 to 2.6 times the initial build.

Every Drupal CMS feature, including Canvas, recipes, the AI tooling and 21 of the 22 site templates in the installer, is free with no tiers. Two paid add-ons now appear in the default path, though both are optional: the bundled amazee.ai AI provider is a 30-day trial that becomes a paid plan (bring-your-own-key avoids it), and 2.2.0 added license-key-gated premium partner templates. Neither locks a core production capability.

There is no software contract, so a team can stop using Drupal CMS at any time without penalty. Hosting contracts are with third parties and many bill monthly (Pantheon from ~$50/mo per site). Only enterprise managed hosts such as Acquia impose annual negotiated terms, and that is a hosting choice, not a platform requirement.

Drupal CMS is free forever for any use, including commercial, with no capability limits or time limits. The free Drupal CMS Launcher desktop app runs the full platform locally with no hosting spend and no command-line setup, and budget hosting starts around $5/month.

The free Launcher gets a working local site running in minutes, and the installer now offers 22 site templates across SaaS, nonprofit, education, government, healthcare, events, insurance and news, plus a Nuxt decoupled starter. Drupal CMS 2.2.0 added a command to export a Launcher-built site, which shortens the step from local prototype to hosted site. Production still needs hosting to be provisioned, which keeps it short of the sub-hour SaaS ceiling.

Site templates and the Canvas visual builder bring simple marketing sites down to days rather than weeks, and the template library now covers most common verticals from agencies such as Kanopi, Vardot, Annertech, Promet and Zoocha. Real custom projects still run long, though: small sites 4 to 8 weeks, content-led marketing sites 6 to 14 weeks, mid-size builds 3 to 6 months and enterprise builds 5 to 9 months.

Drupal expertise still costs noticeably more than general web development. 2026 North American rates run $80 to $250/hour, and top-tier partners bill $150 to $250/hour against $80 to $120 for general PHP developers, roughly a 25 to 50% premium. The talent pool is smaller than WordPress's, though offshore and hybrid teams ($35 to $85/hour) bring blended costs down.

Hosting is never included, so every deployment adds infrastructure spend. Small sites run on budget shared hosting ($5 to $50/mo), and Drupal CMS ships a cPanel project template aimed at that market, but most production sites use managed Drupal hosting ($50 to $500/mo) or self-managed cloud servers with a CDN. Large enterprise portals can pass $50,000/year.

Running Drupal CMS still takes steady maintenance: core and module security updates, PHP version changes and database upkeep. September 2026 alone brought three Drupal CMS patch releases and a raised core minimum for a security advisory. Automatic updates help smaller sites, but 2026 guidance still budgets 15 to 25% of build cost per year, and self-hosted sites need at least a part-time ops person.

Drupal CMS is open source and stores data in standard MySQL or PostgreSQL databases, so there is little platform lock-in. Content leaves via Views Data Export, JSON:API/REST or a database dump, and configuration exports as YAML. Moving to another platform still takes ETL work, and Canvas page layouts are stored in a Drupal-specific component structure that other systems cannot read directly.

Drupal CMS 2.0 (2026-01-28) makes Canvas the default no-code page builder in a new user's first five minutes, and an AI admin chatbot can now create content types, taxonomy terms, and fields conversationally — both lowering the entry surface. However, custom development still requires the full entity/field/hook/Views/services stack (nodes, blocks, Views, entities), keeping concept density well above the <5-concept ideal; 2026 guides still call Drupal's the steepest learning curve of any major CMS. Held at 50 because the underlying concept model is unchanged for developers doing real work.

Drupal CMS has a dedicated getting-started hub (new.drupal.org/docs/drupal-cms) with a pre-configured DDEV path, plus the official Drupal CMS Launcher, a standalone Windows/macOS/Linux desktop app that installs and opens a working Drupal CMS site with no Docker, Composer or external dependencies (v1.0.9, Mar 2026). Drupal CMS 2.2 adds a generic AGENTS.md to the project template for AI-assisted development. Not higher because there is still no in-app guided tour or structured first-party learning path; docs remain spread across new.drupal.org, project.pages.drupalcode.org and Drupalize.me, and the Launcher is positioned for evaluation and site building rather than production.

Canvas is built on Single Directory Components (Twig/JS/CSS packaged per component) and now has a first-party Canvas Headless SDK with framework adapters for Next.js, Astro, Nuxt, TanStack Start and Angular (@drupal-canvas/headless-next 0.8.0, Sept 2026), alongside JSON:API in core and next-drupal. Custom backend work still requires Drupal's Symfony/PHP entity, service and hook model, which takes a PHP developer months to reach proficiency. Up +2 for the headless adapters; capped because they are 0.x and the canvas_headless module is still flagged experimental.

The Drupal CMS 2.2 installer now offers 22 site templates from a canonical list, 21 of them free: Starter, Byte, the new Everbright and Mercury Demo templates, and partner templates from Kanopi, Vardot, OpenSense Labs, Annertech, Promet, QED42 and others, including decoupled options (Lupus Decoupled Starter, drunomics Nuxt Starter). A site template starter kit and `drush site:export` let teams package their own. Not higher because there is no vendor-maintained Next.js starter with CI/deployment config, and quality across partner templates is uneven.

Drupal CMS ships pre-configured for DDEV (.ddev/config.yaml bundled), so local setup is effectively configure drupal11 project type, `ddev start`, and `composer create-project drupal/cms`. Production still requires Composer dependency management, database config, settings.php/settings.local.php environment handling, and Drush for many admin operations — a config surface far heavier than SaaS platforms — and non-DDEV setup remains poorly documented per community reports.

Drupal's entity/field system has no field count limits, and Configuration Management (config export/import) provides version-controlled schema deployment. Field type changes on populated content still require migration scripts via the migrate API, but tooling support makes schema evolution lower-risk than platforms without migration paths. No material changes in Drupal CMS 2.0 to this layer.

Canvas is the default editing experience in new Drupal CMS installs, with drag-and-drop, live preview and responsive previews and no setup for traditional deployments. For decoupled builds, the new Canvas Headless SDK lets Canvas embed the frontend app with draft-aware preview sessions and drag-and-drop on the app's own registered components, configured largely through env vars (CANVAS_SITE_URL, CANVAS_EDITOR_ORIGINS); next-drupal 2.1.0 remains the other route. Up +2; not higher because headless visual editing is 0.x/experimental and still requires frontend code changes.

Canvas, Site Templates, and Single Directory Components mean site builders and frontend implementers need less bespoke Drupal theming knowledge — SDC's Twig/JS/CSS packaging is familiar to frontend devs. Custom module development still demands Drupal-specific PHP (entity API, services, OO hooks — still proprietary patterns) requiring 1–3 months of ramp-up, so generalist React/TypeScript developers cannot be productive on backend work without significant investment. No certification is required.

Drupal CMS 2.0's launch messaging claims marketing teams can 'launch fully branded, professional websites in days instead of weeks' using templates and Canvas, and Byte proves a solo builder can ship a production template-based site in minutes. Production implementations with custom functionality still typically need 2–3 roles (Drupal backend, frontend, DevOps/hosting), and enterprise builds more. The floor has dropped meaningfully; the ceiling for custom work has not.

Canvas gives marketers drag-and-drop page building with live preview and the Mercury component library, and the Drupal CMS 2.0 AI admin chatbot now handles structural site-building tasks — creating content types, defining taxonomy terms, adding fields, plus AI-assisted alt text — reducing developer dependency beyond just page assembly. Recipes and Site Templates further let admins add features without code. Bumped +1 as the chatbot moves structural changes (not only content) into non-developer reach; capped because custom components and third-party integrations still route through developers.

Once installed, Drupal CMS is a standard Drupal site updated the usual way, and the 2.x line has shipped as small point releases (2.1.1 through 2.1.6, then 2.2.0 on 2026-09-25) with no required migration steps. Automatic Updates handles core patch releases, and Canvas's Automatic Component Instance Updates keep prop and slot changes from breaking content. Not higher because recipes still have no update path, and the Drupal 12 upgrade (stable planned for the week of 2026-12-07, only 12.0.0-alpha1 tagged so far) is Composer-driven and drops update paths below 11.3.

The process is still exemplary: PSAs pre-announce critical release windows (PSA-2026-09-21 before the 2026-09-23 contrib batch), and Drupal CMS 2.1.6 shipped the same day to raise minimum Webform and Project Browser versions after critical RCE and CSRF advisories. The volume is the issue: 13 core advisories in 2026 (SA-CORE-2026-005 Critical, 2026-06-17) plus a steady stream against bundled modules, including Canvas (two in July), the AI module family, AI CKEditor, Editoria11y, Webform and Project Browser. Lowered because Automatic Updates only covers core patch releases, so operators still have to patch the wide contrib set Drupal CMS bundles by hand, often within tight exploit windows.

Drupal 11.5.0 ships alongside 12.0.0 as a long-term support release supported into mid to late 2028, so Drupal CMS operators can skip the next major rather than being forced onto it. Drupal 12 pushes disruptive API deprecations to Drupal 13, Drupal CMS 2.x already runs on 11.3+ so the Drupal 10 EOL (2026-12-09) does not touch it, and the 1.x to 2.0 move needed no action. Not higher because Drupal 12 still removes six core modules and update paths below 11.3, and recipes offer no upgrade path at each major step.

Drupal CMS runs the full Composer-managed PHP/Symfony stack (PHP 8.3+, MySQL/MariaDB/PostgreSQL, Twig, Guzzle) and layers on Canvas, the Mercury component library, the AI module family with provider modules, Webform, Project Browser and a long list of recipe-installed contrib. The 2026 advisory record shows how much of that tree needs patching: the bundled AI, Canvas, Webform and Project Browser modules all had advisories between June and September. Lowered slightly because the added surface is now visibly producing security churn.

The status report and Automatic Updates readiness checks remain the main built-in operational signals. Drupal CMS ships no APM, alerting or observability dashboard, so production monitoring needs external tools (New Relic, Datadog, uptime checks) or a managed host's instrumentation. Unchanged.

Drupal CMS bundles the Editoria11y accessibility checker and curated SEO tooling, and Canvas component instance updates reduce breakage when components change. Automated hygiene such as orphan detection, broken reference alerts and content expiry still needs extra contrib or manual editorial discipline. Unchanged.

Core 11.3 and later deliver the large throughput gains drupal.org describes (26 to 33 percent more requests on the same setup), which buys headroom before tuning. Cache tags and contexts, Varnish or CDN setup and database tuning remain operator work on self-hosted installs, while managed Drupal hosts absorb much of it. Unchanged.

The Drupal Association offers no support SLA for Drupal CMS; formal support comes from Drupal hosts (Pantheon, Upsun and others) or contracted agencies. That is a notable gap for a product aimed at marketers and site builders. Good support requires a paid hosting or agency arrangement. Unchanged.

Dedicated #drupal-cms-support and #drupal-cms-development Slack channels are active with Drupal Association staff taking part, and the drupal_cms and canvas issue queues move quickly. Slightly below classic Drupal because Canvas and recipe-specific answered questions are still thinner than core's two-decade archive. Unchanged.

Velocity is visibly strong: Canvas went from 1.2 to 1.12 in 2026, Drupal CMS shipped 2.1.5 to fix a fatal Starter install error and 2.1.6 on the day of the September critical contrib advisories, and 2.2.0 followed two days later. Security fixes land on pre-announced dates with clear advisories. Raised from 48 on this record; not higher because there is no SLA for non-security bugs and Drupal CMS relies on a smaller maintainer team than core.

Drupal CMS 2.0 (launched January 28, 2026) ships Canvas 1.0 — a drag-and-drop visual page builder that is now the default editing experience, offering live preview, component-based layout design, and AI-assisted page generation ('Build me a landing page'). The Byte site template provides a preconfigured B2B SaaS marketing site out of the box, and the Mercury component library supplies common building blocks. Marketers can compose pages from hero banners, card grids, and CTA blocks without touching code. Not quite 80+ because Canvas is new and the component library is still maturing.

Drupal CMS provides content scheduling (publish/unpublish dates) and content moderation workflows but has no native campaign management module — no multi-channel coordination, campaign analytics dashboard, or campaign lifecycle tooling out of the box. Contrib modules (Campaign Monitor, Mailchimp recipe) extend this but do not constitute a campaign management system. Scores above headless CMS (30–35) only because of scheduling and moderation.

Drupal CMS's base recipe, which every site template builds on, installs a full SEO stack at install time: Metatag with Open Graph and Twitter Cards, Pathauto, Redirect plus Redirect 404 tracking, Simple XML Sitemap, dedicated SEO title/description/image fields on content, the SEO Checklist, and Yoast SEO for real-time on-page analysis stored in a per-node SEO analysis field. The previous score held back because real-time SEO feedback was thought to be contrib only; Yoast SEO actually ships preconfigured. Schema.org structured data still needs an add-on, which keeps it below the high 80s.

The Forms recipe installs Webform and Webform UI with ALTCHA, CAPTCHA and Honeypot spam protection, so marketers get a real form builder and lead capture with submission views out of the box, and site templates such as Byte ship newsletter sign-up blocks. ECA (installed in the base recipe) can react to form submissions for simple follow-up automation. There is no UTM-aware content, CTA performance tracking or conversion reporting inside the CMS; conversion measurement lives in GA4 via the Google Analytics recipe.

Drupal CMS ships no personalization. Canvas has a canvas_personalization submodule, but as of Canvas 1.12.0 it is still marked hidden (a feature flag, not a supported feature), and no Drupal CMS recipe or site template enables it. Rule-based targeting requires adding the Smart Content contrib module through Project Browser. Acquia's commercial personalization products are out of scope for this entry. Scores at the top of the no-native-personalization band because a contrib path exists and Canvas personalization is actively in development.

The Server-side A/B Testing module provides a genuine Drupal-native experimentation framework: server-side variant execution to eliminate flicker, content-based experiments using existing Drupal entities as variants, SEO-safe canonical handling, and GA4/GTM integration (experiment data exposed via drupalSettings, analytics events triggered). A/B Paragraphs 1.0.0-beta3 (February 2026) enables paragraph-level content variant testing, and the stable Kameleoon module offers a third option. Statistical analysis and winner selection still live in GA4 or external tools — no native stat-sig reporting or auto-winner in core. Scores in the 'experimentation via tight integration' band rather than the no-capability floor.

Canvas is the default editor and has kept accelerating page production: content templates render node types through Canvas, page variants (Canvas 1.12) give editable full-page templates, autosave and Trash protect drafts, Media Library bulk upload and focal point cropping speed asset handling, and Scheduler with content moderation integration handles timed publishing. The AI recipe adds a Canvas page builder agent that places components from a prompt. Reaches 70 because marketers can clone, assemble and schedule pages without a developer; not higher because approval shortcuts and bulk page operations are basic.

Drupal CMS provides RESTful and GraphQL JSON:API for headless/decoupled delivery to web, mobile, and other digital channels. Content structured in Drupal can be served to multiple front-end applications, IoT devices, and digital touchpoints via APIs. However, multi-channel is API-driven requiring front-end development per channel — no native social push, email, or SMS delivery from the CMS. Scores above purely headless CMS peers because Drupal's web-first experience is mature, and API delivery to additional channels is well-documented.

Drupal CMS 2.0 includes one-click Google Analytics 4 and Google Tag Manager recipe integrations — no technical setup required. Matomo and other analytics platforms have contrib modules. However, content performance metrics (engagement data, content decay, top-performing pages) remain in external analytics tools — no native analytics dashboard within the CMS. Scores above 45 because GA4 and GTM are genuinely one-click in CMS 2.0, a meaningful improvement over manual tag installation.

Canvas 1.11 to 1.12 added Brand Kit, a site-level store of brand colors and fonts exposed as CSS variables and colour props, with usage tracking before deletion. Combined with the Mercury component library and theme-defined component props, marketers pick from approved components and brand colours rather than free-form styling. It is still guidance more than enforcement: there is no hard lock preventing an editor from choosing an off-brand layout, and code components can bypass the kit. Moves into the lower 60s on the strength of a platform-level brand token store.

The SEO Tools recipe provides OG and Twitter/X card meta tag management for social preview cards. Contrib modules exist for social sharing widgets, social feed embeds (Twitter, Facebook), and basic social media integration. No native social scheduling or push-to-social workflow exists in Drupal CMS 2.0 — social distribution requires external tools (Buffer, Hootsuite). Scores at the standard 'OG plus social sharing' tier for traditional CMS platforms.

The base recipe configures a Media Library with image, document, local video, remote video and SVG media types, bulk upload, focal point cropping, responsive image styles and media file cleanup on delete. That is a working marketing asset store with transforms, but rights management, expiry and usage reporting across pages are not included, and enterprise DAM requires an integration module. Acquia DAM is an Acquia product and does not count here.

Drupal CMS has one of the strongest multilingual frameworks in open-source CMS: core Language, Content Translation, Interface Translation, and Configuration Translation modules provide field-level translation, locale-specific content scheduling, and per-language URL structures. The Translation Management Tool (TMGMT) contrib module adds translation workflow, professional translation service integrations, and transcreation workflows. Regional cookie consent and compliance can be managed per locale via contrib. Not 65+ because transcreation UI and market-level scheduling are contrib rather than recipe-ready.

Out of the box Drupal CMS 2.x offers the Google Analytics recipe (GA4 and Google Tag Manager) and ECA, a no-code event-condition-action engine that can fire on content and form events for orchestration. The curated recommended add-ons list no longer includes a Mailchimp recipe, so email/MAP, CRM (HubSpot, Salesforce) and CDP connections all come from contrib modules added through Project Browser. Mid-band: generic event triggers plus one preconfigured MarTech category.

Drupal CMS ships no commerce: none of its recipes or its 22 installer site templates include Drupal Commerce. Commerce 3.x can be added through Composer or Project Browser and brings product types, attribute-based variations, per-variation media and taxonomy, and the redesigned 3.3 order management UI, all on the same entity system Drupal CMS uses. The capability is real and mature, but it is an add-on rather than something Drupal CMS preconfigures, and Canvas has no product-specific components, so this sits below the Drupal core entry.

Drupal Commerce provides category management, promotion and discount engines, and scheduled pricing — reasonable for an open-source commerce layer. However, there are no native search result merchandising tools, AI-driven cross-sell/upsell content blocks, or visual merchandising interfaces. Category management and promotional content scheduling exist but require custom development for advanced merchandising. Scores above 35 because Commerce's promotion engine is real.

Drupal Commerce is the natural commerce layer, but it is not bundled, and there is no maintained first-party connector for Shopify, commercetools or BigCommerce in Drupal CMS. External commerce platforms connect through contrib modules or custom JSON:API work, with no product picker in Canvas. Scores in the lower mid band: an integration path exists but is not a product capability.

With Drupal Commerce added, product entities can be referenced inside Canvas pages and editorial content, so buying guides and shoppable articles are possible. Canvas does not ship product card or add-to-cart components, and no site template demonstrates editorial commerce, so the pattern has to be built by a developer before marketers can compose it. Lands in the 'possible but not first-class' band.

Drupal Commerce provides some CMS-manageable elements in the checkout flow — trust badges, promotional messaging, and upsell blocks can be placed on cart and checkout pages via Drupal's block system. However, there is no dedicated CMS-controlled content injection layer for transactional flows — checkout templates are primarily Commerce-controlled and require developer changes to introduce CMS-managed content blocks. Scores above the floor because the underlying Drupal block architecture technically enables content in checkout, but it's not a turnkey feature.

Drupal Commerce provides a customer dashboard where order history, address book, and payment management are accessible — and CMS content can be surfaced in this area via Drupal's block/view system. Order confirmation emails are templated and can include CMS-managed content. However, CMS-managed post-purchase sequences tied to order events (delivery tracking, review solicitation, loyalty content) require custom development or contrib modules. Scores above the floor because the Commerce customer portal exists.

Drupal's role and access system handles gated documentation and account-based content, and Commerce plus the Commerce Pricelist and B2B contrib modules add customer-specific pricing and quote flows. None of this is preconfigured in Drupal CMS, which slightly lowers the score versus the previous round, but B2B builds on Drupal are well established.

Drupal Search API with Solr or Elasticsearch backend enables faceted product and content search, taxonomy-driven filtering, and search result blending of editorial and product content. Commerce-specific search landing pages are achievable via Views and Search API. Synonym management and search result merchandising require contrib customization. Scores at mid-range because Search API is powerful but requires significant configuration and no native blended content-product search UI exists out of the box.

Drupal Commerce ships with a promotion engine supporting time-based activation, percentage/fixed discounts, promo codes, tiered pricing, and scheduled pricing rules. Sale banners and countdown timers can be managed via Drupal's block and scheduling system. Channel-specific targeting requires additional configuration. The promotion engine is genuinely capable for an open-source platform. Not 60+ because channel-specific content targeting and countdown timer components require contrib.

Multiple storefronts are achievable through Drupal Commerce's multi-store support or Drupal multisite, with shared product entities and per-store editorial content. It requires Commerce plus architectural setup, and Drupal CMS adds nothing specific for storefront separation, so it sits in the 'possible with some duplication' band.

Drupal's media library supports image galleries, video embedding, and basic image transforms. Product images with multiple angles are manageable. However, there is no native 360-degree product viewer, AR/3D model support, or image hotspot functionality in Drupal Commerce or Drupal CMS 2.0. These advanced visual commerce features require third-party integrations (Cloudinary, Viuer) or custom development. Scores above the floor because multi-image galleries and video on product pages are achievable without custom code.

Drupal Commerce marketplace capability exists via contrib (Commerce Marketplace module, custom multi-vendor setups) but is not a first-class out-of-the-box feature. Seller profiles, seller-contributed product descriptions, and content moderation at marketplace scale are achievable but require significant developer configuration. No turnkey marketplace content management solution ships with Drupal CMS 2.0. Scores in the 30s — not at the floor because the Drupal ecosystem has documented B2B marketplace deployments.

The Multilingual recipe adds content, config and interface translation plus Canvas translation, which applies to Commerce product and variation entities once Commerce is installed; Commerce itself handles currencies and translatable store emails. Locale-specific product copy and regional legal blocks are therefore achievable, but market-specific promo calendars and regulatory content types must be built.

Drupal Commerce integrates with GA4 via the Google Analytics module, enabling basic ecommerce tracking (product views, add-to-cart, purchases). However, there is no native content-to-revenue attribution within the CMS — connecting which editorial pages assisted conversions requires GA4 or external analytics configuration. No content performance dashboard within Drupal CMS surfaces commerce conversion data. Scores at 35 as a CMS with GA4 ecommerce tracking available but no native content-commerce analytics.

Drupal CMS inherits core's granular access control (per-bundle and per-operation permissions, content moderation states, unpublished access) and preconfigures Administrator and Content Editor roles. Department- or team-level audience visibility needs the Group or a node-access contrib module, and SSO needs a SAML or OpenID Connect module, neither of which Drupal CMS installs. Still well above simple public/private, but the audience-based piece is an add-on.

Revisions, content moderation workflows, Scheduler, Trash for recoverable deletes, taxonomy with Tagify, and the Search recipe (Search API with a database backend) give Drupal CMS a sound base for a knowledge site. There is no review-date or expiry lifecycle, and the default database search is basic. The previous score leaned on Open Intranet's RAG search, which belongs to a separate distribution and is not part of Drupal CMS.

Drupal CMS is aimed at public marketing sites, and none of its 22 site templates is an intranet or employee portal. What exists natively is login, user pictures, an admin dashboard and comments. News feeds, employee directories, notifications and personalized dashboards must be built with Views and contrib. Mature Drupal intranet products (Open Intranet, Open Social) are separate distributions with their own install profiles, so they are not credited to Drupal CMS. Scores above headless peers because Drupal's authenticated-user model and Views make a portal buildable without a custom frontend.

Internal news can be published as articles with scheduling and moderation, and audience targeting is possible with access-control modules, but Drupal CMS has no announcement targeting, read receipts or acknowledgment tracking. The SMS and messenger features cited previously come from Open Intranet, a separate distribution. Basic news publishing with some targeting.

User accounts with pictures and fields plus Views allow a basic staff directory to be built, but Drupal CMS ships no directory, org chart or HR integration. The Healthcare template's provider directory shows the pattern for public listings, not employee directories.

Drupal provides revision history on all content, content moderation workflows (draft/review/publish), and scheduled content review via the Content Planner module. Document publishing with version control is achievable. However, there is no native mandatory-acknowledgment tracking, policy expiry reminders, or formal SOP management workflow in Drupal CMS 2.0 or Open Intranet. Policy management is possible via Drupal's content structures but requires custom configuration to match dedicated policy management tools.

Onboarding pages can be assembled from content types, Canvas pages and role-restricted menus, but Drupal CMS has no role-specific paths, checklists or progressive disclosure. The Courses recipe credited previously belongs to Open Intranet, not Drupal CMS.

The Search recipe preconfigures Search API with a database backend, indexes Canvas pages and all content types, and supports per-item exclusion; Solr or Elasticsearch backends and facets are contrib additions. There is no federation to SharePoint, Confluence or Drive and no AI relevance in the default install. Adequate internal search with basic faceting once facets are added.

Mercury and the site templates are responsive, and the Gin admin theme works on mobile, so staff can read and edit from phones. There is no native app, push notification or offline support, and the SMS reach credited previously came from Open Intranet rather than Drupal CMS.

Training content can be hosted as pages and documents, but Drupal CMS has no course, completion-tracking or LMS integration features. The previous score credited Open Intranet's Courses recipe, which is not part of Drupal CMS. Basic learning content hosting only.

Core comments are available and the Forms recipe's Webform covers polls and surveys, but Drupal CMS has no reactions, forums, peer recognition, idea submission or community spaces. Those features (Kudos, Ideas) belong to Open Intranet. Basic commenting plus surveys.

Drupal CMS can reach workplace tools through ECA actions and contrib modules for Microsoft Entra ID, Google and Slack, but it installs none of them and has no Teams or Slack cards. The Microsoft 365 and Google Workspace integrations credited previously are Open Intranet features. Basic webhook-style integration only.

Drupal CMS provides content scheduling (publish/unpublish dates), revision history, content moderation workflow (draft/review/published/archived states), and the Content Planner module for editorial scheduling. The 2026 Drupal AI roadmap proposes background agents that autonomously flag outdated articles, but these are roadmap items, not shipped features. Automated review reminders for stale content and systematic archival workflows still require contrib rather than being native to CMS 2.0. Scores at 50 because the moderation states and scheduling exist, but automated freshness enforcement needs additional setup.

Drupal intranet deployments rely on GA4 or Matomo for basic page view analytics, accessible in external tools rather than within the CMS/intranet interface. There is no native intranet analytics dashboard in Open Intranet or Drupal CMS showing department-level engagement, failed search terms, or adoption metrics. Search analytics are available in Drupal Search API but require additional configuration to surface insights. Scores at 35 — above the floor because Search API logs are available, but below 45 because there is no purpose-built intranet engagement dashboard.

Drupal Multisite provides silo-based isolation: each site gets its own database, configuration, files, and domain while sharing a single codebase. Three architectural modes exist (multi-tenant shared DB, hybrid, multi-instance). This is genuine isolation at the application level, though not a SaaS-native multi-tenant architecture with guaranteed zero data leakage at the infrastructure layer. Adequate for enterprise multi-brand but requires ops discipline to maintain isolation.

Drupal Multisite shares a single codebase, allowing themes, modules, and Canvas component libraries to be maintained centrally and consumed by all brand instances. Drupal distributions and install profiles can enforce shared design tokens and templates. Canvas 1.0 (with the Mercury component library) introduces a component system that further enables cross-brand reuse, and the Site Template Marketplace pilot (DrupalCon Chicago 2026) adds reusable site foundations. However, there is no native UI for 'global content' pushed to multiple sites — this requires custom sync or a contrib approach like Config Split. Federation is workaround-based rather than first-class.

Across a Drupal multisite estate, governance comes from a shared codebase, shared recipes and site templates (Drupal CMS 2.2 can export a site as a reusable template with drush site:export), config management and consistent roles. There is no console enforcing standards or approvals across brands. Acquia Site Factory and similar commercial layers are out of scope for this entry, so the score drops from the previous round.

Drupal CMS is open source (GPL, no per-brand licensing fees), meaning additional brands add only infrastructure costs rather than license costs. A shared multisite codebase further reduces maintenance overhead across brands. Self-hosted or cloud-hosted via commodity providers. Compare to proprietary DXPs where each brand instance can cost six-figure license fees. The economics strongly favor Drupal for multi-brand scale, limited only by developer/hosting costs which remain relatively fixed.

Each brand site can run its own theme or Mercury sub-theme and, since Canvas 1.12, its own Brand Kit of colours and fonts applied to shared components through CSS variables. Shared components with per-site brand tokens meet the platform-level theming bar, though there is no single console managing brand kits across a portfolio.

Drupal CMS supports multilingual content per brand site in a multisite setup — each site can have its own language configuration, translation workflows, and regional legal content. Per-brand translation approval workflows are achievable via content moderation and TMGMT. However, there is no native brand-locale intersection governance — managing Brand A's French translations separately from Brand B's French translations with different approval chains requires custom workflow configuration rather than being a native platform feature.

Drupal CMS has no native cross-brand analytics dashboard. Each site in a multisite setup sends analytics independently to GA4, Adobe Analytics, or other external tools. Portfolio-level aggregation requires manual setup in Google Analytics 360 (roll-up properties), custom reporting, or third-party analytics aggregation tools. The 2026 Context Control Center proof of concept shows some cross-site data awareness but is experimental. Scores at 30 — not at the absolute floor because GA4 is one-click per site and cross-property reporting is possible externally.

In a Drupal multisite setup, each site can have independently configured content moderation workflows via Config Split — Brand A can have a 4-stage editorial review while Brand B has a simple draft-publish workflow. However, central auditability across brand workflows requires custom reporting or contrib — there is no native cross-brand workflow audit console. Scores at 48 because per-brand workflow configuration is genuinely possible and documented, but central oversight is a gap.

Drupal CMS has no corporate-to-brand syndication. Sharing content between sites requires contrib such as Entity Share or custom JSON:API sync, with no override-point model. Acquia Content Hub is a commercial Acquia product and is no longer credited here.

Each site in a Drupal multisite can have independently configured cookie consent (EU Cookie Compliance module), accessibility settings, data residency preferences (via hosting), and GDPR-related modules. Per-brand compliance configuration is therefore achievable. However, there are no platform-level publishing guardrails that prevent non-compliant content from being published — compliance is enforced through configuration discipline rather than automated checks. Scores at 45 because per-brand compliance configuration is real but guardrails are manual.

A central Canvas component library (SDC and code components, with version hashes tracked per component instance), shared Mercury theme, per-site Brand Kits and exportable site templates give a workable federated design system, with updates propagated through Composer and Git. Versioning and override management happen in code, not in a design-system UI.

Multisite can share or isolate user tables, and SSO across brand sites is possible with SAML or OpenID Connect contrib modules, but Drupal CMS installs neither and has no central console for per-brand teams. Acquia Site Factory's central user management is out of scope for this entry. Basic per-site user management with limited central oversight.

Drupal's shared multisite codebase allows content types to be defined centrally and shared across brand sites. Brand-specific field extensions are achievable via contrib (Field Group, per-site Config Split) but currently require forking the base content type configuration — there is no native 'extend without fork' inheritance model for content types in Drupal. Config Split mitigates this but adds complexity. Scores at 48 because shared base models are real but per-brand extension without forking is a workaround rather than a first-class feature.

There is no portfolio reporting in Drupal CMS. Each site has its own dashboard and GA4 property, and freshness or SLA reporting across brands needs external BI. The previous score credited Acquia Site Factory's management views, which are out of scope.

Drupal CMS installs the Klaro! consent manager in its base recipe for every site template, with a placeholder privacy policy page linked from the consent modal, and Klaro 3.1 (July 2026) added category-based consent and Google Consent Mode v2. However, the Drupal Association issues no DPA, sub-processor list or residency terms for the open-source product, so GDPR contracts are the deploying organization's responsibility, and Klaro still stores consent client-side only with no server-side proof of consent (issue #3549264, open as of 2026-09), which falls short of GDPR Article 7 without added logging.

The Drupal Association does not issue Business Associate Agreements, and there is no HIPAA-eligible service offering for the open-source product. HIPAA compliance for Drupal is achieved only at the hosting/ecosystem level — e.g., Acquia signs a BAA and maps SOC 2 controls to HIPAA — not at the platform level. Drupal CMS itself provides no BAA and no documented HIPAA-eligible infrastructure.

Drupal remains the dominant CMS for US government (NASA, USDA, VA, FDA, FCC and hundreds of federal properties) and is recognized for easing FedRAMP and Section 508 compliance paths — but FedRAMP authorization applies to the hosted system boundary (Acquia, GovDataHosting), not the open-source product, so it cannot be inherited. GDPR and CCPA are achievable via the GDPR module and Klaro. No IRAP, C5, PCI-DSS, or HITRUST certifications exist for the core software.

Drupal CMS is open-source software distributed by the Drupal Association; no SOC 2 Type 2 attestation exists for the platform itself, and 2026 searches confirm no Drupal Association certification. Hosting providers (Acquia, Pantheon, Platform.sh) hold their own SOC 2 Type 2 reports covering hosting infrastructure, not the Drupal CMS software product. Per scoring guidance for open-source self-hosted platforms, the customer is wholly responsible.

No ISO 27001 certification exists for Drupal CMS as open-source software or for the Drupal Association in scope of the platform. ISO 27001-certified Drupal hosting (amazee.io, Acquia) refers to the hosting provider's ISMS, not the CMS software — the anti-pattern of inheriting hosting certifications applies. Customers deploying on certified infrastructure gain that coverage, but Drupal CMS itself neither holds nor conveys the certification.

No third-party security certifications (CSA STAR, PCI DSS, Cyber Essentials, FedRAMP) apply to the Drupal CMS open-source product. The compensating factor remains strong: a dedicated 20+ member Drupal Security Team with a structured public advisory process, scheduled security release windows, a 25-point vulnerability severity scale, and coordinated disclosure — exceeding typical open-source practice. This positions Drupal CMS above minimally-maintained OSS but well below certified commercial platforms.

As self-hosted open-source software, Drupal CMS provides complete data residency flexibility — organizations can deploy in any region or on-premises with no vendor constraining data location, an intrinsic advantage over SaaS platforms. However, there are no vendor-issued contractual residency guarantees because there is no vendor-customer hosting relationship. CDN and sub-processor data flows are determined entirely by the deploying organization's infrastructure choices.

Out of the box, Drupal CMS gives site owners full control of their data: the base recipe bundles the Trash module (soft delete and restore), core user cancellation can delete an account together with its content, and the 2.2 `drush site:export` command exports a whole site as a recipe. The GDPR module's export and 'forget me' workflows exist, but they are a contrib add-on that Drupal CMS does not install, so there is no ready-made self-service data subject request portal. Retention after deletion follows the deployer's own policy, not a vendor schedule.

The Drupal CMS base recipe enables core Database Logging (dblog), which records content operations, user actions and login events in an admin report. Core Syslog forwards logs to a SIEM through the system syslog daemon, and the stable Admin Audit Trail contrib module (1.0.13, Sept 2026) adds entity and configuration change logging, but neither is enabled by default and there is no native SIEM push connector. The tamper-evident audit_trail module is still dev-only, and dblog trims rows by count, so production deployments need a deliberate log pipeline.

Drupal's Claro admin theme documents WCAG 2.1 AA conformance, accessibility is enforced as a core merge gate (keyboard navigation, screen reader support, focus management), and the project follows the latest WCAG recommendation (2.2 AA) with an ATAG 2.0 target for authoring interfaces. Drupal CMS 2.0 (Jan 28, 2026) made the Canvas drag-and-drop visual editor the default authoring experience and added AI-assisted alt text with human review, but Canvas's accessibility conformance is not yet formally documented, preventing a higher score.

Drupal.org maintains a dedicated accessibility page documenting WCAG 2.2 AA targets and ATAG 2.0 commitments, and the GSA maintains a VPAT for Drupal core (with community OpenACR/VPAT tooling under CC BY-SA), supporting government procurement. However, no single current, product-level VPAT/ACR for Drupal CMS 2.0 (including the new Canvas builder) is published on drupal.org for direct procurement use — a formal core ACR remains an open issue (#3335955), and third-party Drupal ACRs are implementation-specific.

Drupal CMS 2.x's AI Assistant recipe preconfigures Canvas AI, which builds pages from a prompt, plus the ai_agents chatbot. The in-editor CKEditor assistant is not bundled: in AI 1.5.0 (Sept 25 2026) the ai_ckeditor submodule is deprecated in favour of a standalone project that is still at 1.5.0-beta4, and AI Automators ship in the installed ai package but come unconfigured. Scores 66 because prompt-driven page generation works out of the box, but rewriting, summarising and brand-voice controls in the editor need modules the installer does not set up.

The AI recipe installs ai_image_alt_text, grants content editors 'generate ai alt tags' by default, and gates the feature behind a Klaro consent app, so alt-text generation works on first install. AI 1.5.0 adds rich-text image description to Automators and lets providers declare their text-to-image formats. Image generation still goes through Field Widget Actions and the provider (DALL-E and similar), which the installer does not configure. Scores 54 because only alt text is turnkey, and there is no smart crop or AI video processing.

Neither the Drupal CMS AI recipe nor the multilingual recipe installs AI translation. The one-click ai_translate submodule is deprecated in AI 1.5.0 and has moved to a standalone ai_translate project (1.4.2 stable, Sept 2026), and the contrib ai_content_translation module handles structured content. Automators can batch-translate through Views Bulk Operations. Scores 55, which puts it in the basic-MT-hookup band: the capability is a stable add-on rather than part of the preconfigured localisation workflow, and it has no quality scoring or cross-locale brand-voice controls. The previous round credited contrib modules as native.

Out of the box Drupal CMS generates AI alt text, and its base recipe ships Yoast SEO real-time analysis and the SEO Checklist, but those two are rule-based, not AI. AI-written meta titles, descriptions and taxonomy tags need AI Automators to be configured on fields (AI 1.5.0 adds a setup-automators agent skill) or the contrib ai_seo or contentai modules. Scores 56, the partial-automation band. The previous round's 62 treated contrib SEO modules as bundled.

AI Automators ship in the installed ai package and support auto-tagging, summarisation, OCR, transcription and chained pipelines. They can run in bulk through Views Bulk Operations, and AI 1.5.0 adds configurable queue items per cron run and guardrails on Automators. None of it is configured by default: the Drupal CMS recipe enables only alt text, the site-building chatbot and Canvas AI. Scores 64 because the automation is broad and a site builder can enable it without code, but the installer does not build it into editorial work, and there is no smart scheduling or duplicate detection.

The AI recipe installs ai_agents and puts a 'Drupal Agent' chatbot in the admin toolbar. The chatbot runs site-building functions such as creating fields and content types, and its permissions can be set per role. Canvas 1.11 and 1.12 (Aug and Sept 2026) built a Canvas Page Agent and a component agent with a Tools dropdown and chat history, but these sit in canvas_dev_ai behind an aiDevMode flag. AI 1.5.0 added agent skills and ChatMemory plugins. Scores 55 because agents are GA and preconfigured, but the shipped agent builds sites rather than running editorial pipelines, and the page-building agent is not released.

Drupal CMS ships no AI content intelligence. The bundled ai_dashboard covers AI configuration, not content performance, and the base recipe's dashboard and SEO Checklist are not AI. Gap analysis and stale-content detection come from contrib modules such as ai_content_strategy and ai_seo, or from custom agents. Scores 38, the basic band, because nothing preconfigured does topic clustering, performance scoring or editorial prioritisation.

AI 1.5.0 adds a configurable Moderation Guardrail plugin and a semantic topic-matching mode for the RestrictToTopic guardrail. Automators can classify or validate many entities at once through Views Bulk Operations. The older ai_validations and ai_external_moderation submodules are now deprecated, and that functionality has moved into AI core and standalone projects. Drupal CMS bundles Editoria11y, but its accessibility checks are rule-based, not AI. Scores 42 because moderation-style auditing at scale is possible, but there is no brand-voice or quality audit suite.

The Drupal CMS Search recipe installs keyword-only search (search_api + search_api_db) and nothing AI. Vector search is an add-on: in AI 1.5.0 the ai_search submodule is deprecated and marked experimental, and it has moved to a standalone ai_search project still at alpha (2.0.0-alpha2, 1.3.0-alpha5 on Sept 23 2026). Backends include the stable MariaDB VDB provider (1.0.1) and Elasticsearch hybrid search. AI 1.5.0 also adds an AI reranking processor for Search API. Scores 48 because production-grade parts exist, but semantic search is an alpha add-on that nothing preconfigures.

Drupal CMS has no ML personalization engine. Canvas's canvas_personalization module is still hidden as of Canvas 1.12 (Sept 2026), and it is rule-based page variants, not predictive. Smart Content plus a custom engine remains partner-built work. Scores 28 because nothing ships for predictive segments, next-best-content or cold-start handling.

Drupal CMS does not bundle an MCP server. The contrib mcp_server module was rewritten on the official MCP PHP SDK and is now 2.0.0-beta5 (Sept 23 2026), with STDIO and HTTP transports and plugin-based tools, prompts and resources. OAuth2 scopes, the admin UI and the Tool API bridge are now separate companion projects, and Tool API is still 1.0.0-beta10. The older mcp module has been stable at 1.2.3 since Nov 2025. Scores 42, the beta band: the server does a lot, but the maintained line is not stable and nothing preconfigures it.

The Drupal CMS installer asks which provider to use, amazee.ai, OpenAI or Anthropic, and since March 2026 it encrypts provider keys at rest with easy_encryption. The amazee.ai default is a 30-day trial that becomes a paid plan. Behind that, the ai module's provider abstraction supports dozens of providers, including self-hosted Ollama and LM Studio, and provider failover. Scores 80 for real multi-provider BYOK with local-model options; not higher because data residency depends on the chosen provider.

The ai module gives developers function-call plugins, Tool API integration and drush scaffolding. AI 1.5.0 adds agent skills, ChatMemory plugins, per-instance context overrides on function calls, multimodal embeddings in the API Explorer and token-usage metadata. The Drupal CMS project template now ships an AGENTS.md for coding agents, and JSON:API is inherited from core. Scores 68 because the extension surface is rich and well documented, but Tool API is still beta and there is no dedicated AI SDK or LLM-optimised delivery endpoint.

AI 1.5.0 builds on the global guardrails, streaming guardrails and input-length limits from the 1.4 line. It adds a configurable Moderation Guardrail plugin, semantic topic matching, regex validation and guardrails on Automators, and AI calls are logged through ai_observability. The Drupal CMS recipe itself routes AI features through Klaro consent, encrypts provider keys, and sets agent permissions per role. Scores 70, top of the good-governance band; not 75+ because there is no IP indemnification or hallucination confidence scoring.

AI Metering reached stable 1.0 in August 2026 (1.0.2, Aug 14). It adds pre-flight cost estimates, per-user monthly token quotas with fallback to a local model, a usage dashboard, a per-call log with CSV export and a personal usage block for editors. AI 1.5.0 adds gen_ai.* OpenTelemetry semantic conventions to ai_observability. Scores 55 because cost, quota and per-user tracking now exist inside Drupal, but AI Metering is a contrib add-on that Drupal CMS does not install, and there is no quality-trend or prompt-effectiveness analytics.