Drupal CMS

Drupal CMS inherits Drupal 11's full Entity/Field API — 20+ core field types (text, integer, float, decimal, boolean, datetime, entity_reference, file, image, link, list, email, telephone, timestamp), unlimited custom content types, and schema-as-code via YAML config export. Polymorphic/union references require contrib (Entity Reference Revisions). The same raw power as Drupal core exists under the Drupal CMS distribution, though the marketer-facing UI simplifies some of the developer-facing schema tooling.

Entity Reference fields provide robust cross-content-type references with Views-based reverse traversal for bidirectional querying. Entity Reference Revisions adds revision-aware references (used heavily with Paragraphs). Polymorphic references possible via contrib. GraphQL module 5.x-beta (Feb 2026) continues to improve relationship querying. Not graph-native by design — bidirectional queries still require Views configuration rather than being implicit.

Paragraphs module remains the de facto standard for component-based content with unlimited nesting and reusable component types, with 200k+ active installations. Drupal Canvas (Jan 2026) introduces Single Directory Components (SDC) as reusable building blocks with Twig/JS/CSS encapsulation. Layout Builder in core adds layout composition. Rich text output from CKEditor 5 is HTML blobs rather than structured portable content (Portable Text / AST), limiting portability.

Drupal's Typed Data / Validation API built on Symfony Validator supports field-level constraints: required, unique, min/max length, regex, cross-field validation via Form API #states, file type/size, enumeration via allowed values. Custom validation via hook_entity_presave() and custom constraints. Comprehensive, but implementing custom validators requires PHP code — no UI-driven custom rule builder as found in some commercial platforms.

Full revision history stored per entity with revert capability. Content Moderation in core provides configurable workflow states (Draft, In Review, Published, Archived). Scheduled Transitions module for scheduled state changes at a specific date. Diff module for visual revision comparison. Drupal CMS ships with editorial workflow and scheduling pre-configured via Publishing Tools installer option. No native content branching/forking prevents a higher score.

Drupal Canvas 1.0 shipped with Drupal CMS 2.0 in January 2026, delivering true drag-and-drop visual page building with in-place editing, instant visual feedback, and component management. This is a genuine visual editor — marketers can rearrange layouts without developer involvement. Canvas replaced the older Layout Builder and Experience Builder alpha. However, Canvas is v1.0 and relatively new; multilingual support was still arriving in early 2026, and the component library (Mercury) has fewer ready-to-use components than established tools.

CKEditor 5 integration in Drupal 10/11 is solid with an extensible plugin architecture, media embedding, configurable toolbars per text format, and good paste handling. Supports inline media (images, video) via Media Embed plugin, custom styles, and code blocks. Output remains HTML blobs rather than structured portable content (AST), limiting channel portability. Custom mark/annotation support requires CKEditor plugin development.

Core Media module provides a reusable media library with grid-based browser, media type system (image, video, file, remote video, audio), and folder-like organization. Image Styles provide automated server-side transforms (resize, crop, scale). Focal Point available via popular contrib module. Drupal CMS 2.0 integrates media management with Canvas. Not a full DAM — lacks AI tagging, rights management, or brand governance workflows. URL-based on-the-fly transforms not built in.

Drupal CMS has no real-time co-editing capability. Content Lock contrib module provides pessimistic locking to prevent conflicting edits, but this is sequential access control, not collaborative editing. No presence indicators, no OT or CRDT-based concurrent authoring. CKEditor 5 has premium real-time collaboration features, but these are not bundled with Drupal and require a separate CKEditor Cloud subscription.

Drupal CMS ships with editorial workflow pre-configured: Draft → In Review → Published, with Scheduled Publishing enabled by default when Publishing Tools is selected during installation. Workflows + Content Moderation in core support multiple configurable workflow states and role-based transition permissions. ECA (Event-Condition-Action) module enables conditional routing and automated actions. Missing out-of-the-box parallel approval paths and native notification system without contrib.

JSON:API in core since Drupal 8.7 is spec-compliant with filtering, sorting, pagination, sparse fieldsets, and relationship includes — one of the most capable core REST implementations in any CMS. Core REST module also available for custom endpoints. GraphQL contrib module at 4.x stable and 5.x-beta2 (Feb 2026) with schema-first design. Both APIs support locale-aware queries. Strict JSON:API spec compliance is both a strength and a limitation for unconventional query patterns.

Drupal CMS is self-hosted with no built-in CDN. Cache tag-based invalidation in core is excellent for reverse proxy integration (Varnish, Fastly, Cloudflare), enabling granular cache purging on content publish. Purge module ecosystem provides CDN-specific integrations. However, CDN is a hosting-level decision (Acquia Cloud, Pantheon, Platform.sh) not a Drupal CMS feature. No edge computing or sub-second purge without hosting add-ons.

Drupal core has a robust internal event system via Symfony Event Dispatcher, but outbound webhook support requires the Webhooks contrib module. The module supports entity CRUD events, user events (login/logout), and system hooks (cron, cache_flush) with configurable HTTP dispatch. No built-in retry logic, payload signing (HMAC), or delivery logs without custom development. ECA module adds event-driven automation but webhook adoption remains limited compared to commercial SaaS CMSes.

JSON:API in core enables fully headless delivery to web, mobile, kiosks, and IoT. The next-drupal package provides Next.js integration with preview and ISR. The Headless CMS contrib module adds Webhook and NATS-based notification for frontend frameworks. However, Drupal CMS is primarily positioned as a traditional CMS with headless capability bolted on — Canvas Builder visual editing does not carry over to headless deployments. Rich text output is HTML blobs (not portable AST), and official vendor-maintained SDKs for mobile/IoT are absent.

Drupal CMS has no native audience segmentation engine out of the box. Rule-based segmentation requires contrib modules (Smart IP, Context) or Acquia Personalization (separate product). Some CDP-driven segmentation is possible via Dropsolid or Acquia CDP integrations. Score reflects available-but-requiring-extra-setup posture, not a built-in engine.

Serving different content per audience requires the Context contrib module or an external personalization engine — nothing ships natively in Drupal CMS 2.0. Acquia Personalize provides a visual personalization overlay but is a separate product. Canvas visual builder does not include audience-aware variant rendering.

No native A/B testing ships with Drupal CMS 2.0. The A/B Paragraphs contrib module enables basic split-content with configurable ratios. The Kameleoon module (stable) supports traffic allocation and segment-aware tests for Drupal 10/11. Both are contrib, not core recipes, and analytics depth varies.

No algorithmic recommendation engine exists natively in Drupal CMS. Manual editorial curation via Related Content fields is the default path. ML-based recommendations require external services (e.g., Acquia's recommendation API or custom builds). No official recipe or marketplace module ships this.

Drupal Core includes a Search module with full-text indexing and basic relevance ranking. The Search API contrib module (widely used, required for advanced search) adds faceting, filtering, and autocomplete. Out-of-the-box core search lacks typo tolerance and relevance tuning — that requires the Search API + backend pairing.

The Search API framework is one of Drupal's strongest ecosystem assets: official modules exist for Apache Solr, Elasticsearch, Algolia, Typesense, and MeiliSearch — all with Drupal 11 support as of 2025–2026. Webhook-driven index sync, faceted search, and autocomplete are well-documented. Breadth and quality of search backend support exceeds most CMS platforms.

Drupal Commerce (v3.3.4, March 2026) is a mature, full-featured commerce module: product catalog, cart, checkout, pricing rules, inventory, and order management are all built-in. Active development continues on Drupal 10/11. Not a SaaS commerce layer — it is genuine native ecommerce as part of the Drupal ecosystem.

A Shopify eCommerce module exists (products synced as Drupal entities, fieldable/theme-able, real-time webhook sync). BigCommerce and commercetools integrations exist via contrib but are less polished. No deep bidirectional sync or product picker UI at the level of dedicated composable commerce connectors.

Drupal Commerce supports rich product content modeling: variation fields for variants, attribute-driven product types, media fields for images, rich text descriptions. The content model is genuinely Drupal-native (fieldable, revisionable). Not a purpose-built PIM but strong for editorial product content adjacent to commerce.

Drupal CMS has no native content performance analytics dashboard. Core provides basic node statistics (page views via Statistics module, deprecated in D10). Content lifecycle and author productivity metrics require custom reporting or third-party tools. No built-in content health or engagement metrics.

Drupal CMS 2.0 ships one-click recipes for Google Analytics and Google Tag Manager. GA4, Segment, and Matomo contrib modules are well-maintained. Tag Manager integration via the GTM module is widely deployed. Event streaming from content operations is webhook-driven via contrib. Solid integration depth for the major analytics platforms.

Drupal supports multi-site via the Domain Access module (domain-based multi-site sharing content) and Drupal's native multi-site setup (separate databases per site, shared codebase). Sites can share content via Domain Access but governance tooling is manual. Not a SaaS-style multi-tenant management console — more silo-based with sharing possible via modules.

Drupal's multilingual system is one of the strongest in any CMS: field-level translation built into core (Content Translation module), locale fallback chains, locale-specific publishing, and 100+ supported languages via Interface Translation. All content types and configurations are translatable. This has been a Drupal core strength since D8.

The Translation Management Tool (TMGMT) module provides TMS integrations for multiple providers including Microsoft Translator, Google Translate, and via sub-modules for Phrase (Memsource) and other TMS connectors. Bulk export/import workflows and machine translation hooks are supported. Not all major TMS providers have maintained official modules but the ecosystem is solid.

Multi-brand management via Domain Access allows different branding per domain under a shared Drupal install. Cross-brand approval workflows and global style enforcement require custom development — no native multi-brand governance tooling exists. Adequate for shared-content multi-brand but lacks centralized policy enforcement.

Drupal Core's Media Library provides organized asset management with metadata fields, custom tagging, folder-like organization, and usage tracking across content. However, it lacks asset versioning, rights/expiry management, and advanced bulk operations — capabilities reserved for standalone DAMs like Acquia DAM. Solid for mid-market asset management but not a purpose-built DAM.

Drupal CMS has no native CDN or on-the-fly image transformation pipeline. Image styles (resize/crop/convert) are server-side and pre-defined, not on-the-fly. CDN delivery requires external integration (Cloudflare, Fastly, AWS CloudFront via the CDN module). Focal point preservation via the Focal Point contrib module. No native WebP/AVIF generation pipeline.

Drupal CMS supports video file uploads and embeds (YouTube/Vimeo via oEmbed) natively through Media entities. No native video transcoding, adaptive bitrate streaming, or caption management. Video hosting requires external services (Mux, Cloudflare Stream, Vimeo). The Video Embed Field module is the standard approach.

Drupal Canvas launched in Drupal CMS 2.0 (January 2026) as the default editing experience: drag-and-drop component assembly, live in-context preview, multi-step undo, and integration with the Mercury component library (cards, heroes, testimonials, accordions). This is a significant leap over Layout Builder. Still maturing compared to Sitecore Pages or AEM's SPA editor but genuinely functional for marketers.

Drupal Core ships Workflows and Content Moderation modules: custom workflow states (draft, in-review, approved, published), role-based state transitions, and audit trail via content revisions. Drupal CMS 2.0 Publishing Tools recipe adds an 'In Review' state across all content types by default. Notification of workflow transitions via Message/Notification contrib. No native SLA timers or parallel approval paths without contrib.

The Scheduler module (widely deployed, D11 compatible) handles scheduled publish/unpublish with date/time. Moderation Scheduler extends this for workflow-integrated publishing. Drupal CMS Publishing Tools includes scheduling support. No native content calendar view (requires contrib Calendar module). Release bundles (atomic multi-item publishing) require custom development.

Drupal CMS has no real-time multi-author editing, presence indicators, or inline commenting natively. Content locking via the Content Lock contrib module prevents last-write-wins conflicts. Version history with author attribution is built-in via revisions. No @mentions, change suggestions, or simultaneous editing. This is a significant gap vs modern collaborative editors.

The Webform module is best-in-class among open-source CMS form builders: conditional logic, multi-step forms, hidden fields, progressive profiling, CAPTCHA/spam protection, submission storage with export, and webhook/handler integrations on submit. Drupal CMS includes Webform as a standard component. Not as polished as HubSpot Forms in UX but functionally superior for complex use cases.

Drupal CMS 2.0 ships a one-click Mailchimp recipe (subscriber sync + form integration). HubSpot, Marketo, and Constant Contact contrib modules provide list sync and triggered sends from form submissions. No native email send capability — Drupal CMS is CMS-side only. CMS event-triggered sends require contrib webhook handlers. Solid integration breadth but no content-side email composer.

Mautic (open-source marketing automation) has deep Drupal integration and is the primary path for behavioral triggers and drip campaigns on the Drupal stack. HubSpot integration via forms provides nurture flows. Acquia Campaign Studio (Mautic-based) is the enterprise option. Not native — requires a separate MA platform — but the integration quality is higher than most traditional CMS peers.

No native CDP in Drupal CMS. Segment integration via contrib (Segment.io Drupal module for event streaming). Dropsolid Rocketship provides a CDP-driven personalization stack for Drupal. Acquia CDP is a separate paid product. Real-time identity resolution and unified customer profiles require significant external tooling. Event streaming from CMS operations is possible but not out-of-the-box.

Drupal.org hosts 50,000+ contributed modules — the largest open-source CMS ecosystem by module count. Drupal CMS 2.0 adds one-click Recipes for Mailchimp, GA, GTM, AI tools, and more, lowering the barrier to module adoption. Partner ecosystem (Acquia, Pantheon, Lando) is mature. Module quality varies but top-tier modules (Webform, Search API, Views) are enterprise-grade.

Drupal supports outbound webhooks via the Webhooks contrib module covering create/update/delete/publish events. JSON:API and REST API provide event-driven patterns. No native webhook UI in Drupal CMS 2.0 core — configuration requires the Webhooks or Rules modules. Signed payloads and retry logic are available via contrib but require configuration. Less polished than SaaS CMS webhook UIs.

The Headless CMS contrib module provides a Preview submodule enabling content editors to preview unpublished content in external frontend applications. JSON:API and Next.js for Drupal (next_drupal) provide shareable draft preview links. No built-in branch environments or environment promotion UI — that requires platform-level tooling (Acquia, Pantheon). Decoupled Drupal preview is functional but requires setup.

Drupal Core has one of the most granular RBAC systems in the CMS landscape: custom role definition, per-permission granularity (500+ permissions), field-level access control via Field Permissions module, content-type-level access, locale-specific permissions via Content Language Access. SSO via SimpleSAML/LDAP modules. SCIM requires contrib. Permissions UI is complex but powerful.

Drupal CMS inherits Drupal 11 core's JSON:API module (fully spec-compliant v1.1) with consistent resource naming, relationships, sparse fieldsets, filtering, and sorting. The contrib GraphQL module (4.x series, updated Sep 2025) supports the full GraphQL spec with a GraphiQL explorer. Drupal 11.2 added JSON Schema support for content models. API documentation is auto-generated and lacks rich examples; no OpenAPI/Swagger without contrib.

No vendor-provided SLA since Drupal CMS is self-hosted by default. Drupal 11.3 delivered a 26–33% increase in requests with the same database load via reduced DB queries and cache operations. Dynamic Page Cache and Internal Page Cache provide layered caching. No CDN-backed delivery or built-in rate limiting out of the box — requires reverse proxy or managed hosting layer.

No official multi-language SDKs maintained by the Drupal Association or Drupal CMS project. The JavaScript space has next-drupal (TypeScript-first Next.js helpers for JSON:API) and drupal-jsonapi-params. No official Python, Java, .NET, or Go SDKs. Developers rely on generic HTTP clients or community-maintained packages. A meaningful gap relative to purpose-built headless CMS platforms.

Drupal CMS accesses the full Drupal.org module ecosystem — over 50,000 contributed modules. A curated set of 57 expert-picked modules was selected for the Drupal CMS launch. Coverage spans payment, DAM, CRM, search, AI, email, social, and analytics. Module quality varies; the Drupal 10/11-compatible maintained set is smaller but still the largest in the traditional CMS space.

Drupal CMS's extensibility is a primary selling point. The Recipes system (stable, with user input support) provides higher-level building blocks. OOP hooks via PHP attributes (complete in Drupal 11.2, extended to themes in 11.3) modernize the hook system. Plugin API, Symfony DI container, event subscribers, custom entity types, and field/form alterations provide extension at every layer. Experience Builder adds new frontend composition extension points.

SAML 2.0 (samlauth contrib), OIDC (OpenID Connect contrib), and OAuth2 (Simple OAuth contrib) are mature and available to any Drupal CMS installation without plan gating. MFA via TFA module. API authentication supports OAuth2 bearer tokens. SSO requires contrib module setup rather than a turnkey enterprise feature, but availability without pricing tiers is a genuine advantage.

Inherited from Drupal 11 core: hundreds of granular permissions, fully custom roles, and the node access grants system for content-instance-level access control. Drupal 11.3 added a dedicated permission for rebuilding node access. Field-level permissions via contrib modules (Field Permissions). Content Moderation provides workflow-state-based access gating. Group module enables audience-based access — a competitive strength for intranets.

Drupal CMS is open-source; certifications are hosting-provider dependent. Acquia (primary Drupal host) holds SOC 2 + FedRAMP + ISO 27001. Pantheon and Platform.sh hold SOC 2. Amazee.io provides ISO 27001-certified Drupal hosting. GDPR contrib module matures with consent management and data subject access request tooling. HIPAA eligibility requires appropriate hosting configuration — not inherent to the platform.

The Drupal Security Team provides coordinated disclosure for all Drupal core, including Drupal CMS. 2025 produced five core advisories (SA-CORE-2025-001 to 005) covering XSS, permission bypass, potential PHP Object Injection, and cache poisoning — all moderately critical, promptly patched. A HackerOne bug bounty program exists with sponsor-funded bounties. Security advisory database at drupal.org/security provides transparent, severity-rated disclosures.

Drupal CMS supports self-hosted (any PHP/MySQL environment), managed platforms (Acquia, Pantheon, Platform.sh), Docker via DDEV, and private cloud. Composer-based deployment is portable across environments. The hosting model is identical to Drupal: maximum flexibility with no SaaS lock-in, which is ideal for regulated industries. Trade-off is operational complexity.

No inherent SLA — Drupal CMS is self-hosted by default. Hosting-provider SLAs apply: Acquia Cloud Enterprise offers 99.95%; Pantheon offers 99.9%; generic managed hosts offer 99.9%. No central Drupal CMS status page because there is no central SaaS service. Per the anti-pattern note for self-hosted platforms, this scores appropriately lower than SaaS platforms.

Drupal 11 is proven at massive scale (government portals, global media). Drupal 11.3's 26–33% throughput improvement directly benefits Drupal CMS. Cache tag-based invalidation enables granular cache management. Standard Drupal horizontal scaling patterns (load balancers, read replicas, Redis/Memcached, Varnish, CDN) are well-documented. Scaling requires operational expertise but architectural ceiling is high.

Config Management system exports full site configuration as YAML, enabling version-controlled config recovery. Database and file backups via standard MySQL/PostgreSQL tools plus the Backup and Migrate contrib module. Migrate API provides robust data portability. Open formats (no proprietary lock-in). RTO/RPO are hosting-environment dependent; no built-in multi-region failover. Solid tooling but documentation of RTO/RPO targets is left to operators.

DDEV is the officially recommended local development environment for Drupal CMS (chosen by community in 2024; 93% satisfaction in 2025 Developer Survey). One-command setup provides near-production parity via Docker including database, mail, Solr, and Redis. Lando remains a popular alternative. Drush CLI handles database operations, config management, cache clearing, and code generation. Drupal Dev Days 2026 programme featured advanced DDEV tooling sessions.

Configuration Management is purpose-built for CI/CD — all configuration flows as YAML through version control via drush config:export/import. Drupal 11.2 made module and config installation 3–4x faster, improving pipeline speed. Recipes system enables declarative, reproducible setup. Branch-based environments via Pantheon Multidev and Platform.sh environments. GitLab CI templates for Drupal modules are actively maintained.

Drupal CMS launched with a dedicated documentation site at new.drupal.org with focused getting-started guides, Recipe documentation, and Experience Builder tutorials aimed at site builders — a meaningful improvement over Drupal's historically fragmented docs. Underlying API documentation at api.drupal.org is auto-generated and thorough but not beginner-friendly. No interactive API playground. Quality is uneven across contributed module docs.

Drupal CMS is a PHP-based platform; TypeScript applies only at the frontend consumption layer. The TypeScript Definition Generator contrib module generates type definitions from entity types via Drush. ts_for_core provides Drupal core TypeScript definitions (updated Dec 2025). next-drupal provides TypeScript helpers for JSON:API consumption. All tooling is community/contrib — no official auto-generated types from content models in core.

Drupal CMS launched January 15, 2025, hit 2.0 on January 28, 2026 (with Drupal Canvas visual builder), and 2.1.0 followed shortly after with site-template selection. Drupal core ships minor releases every ~6 months (11.3 in Dec 2025, 11.4 alpha Apr 2026) and a major every 2 years (Drupal 12 on track for H2 2026). Not higher because the CMS distribution is still under 18 months old.

drupal.org/project/drupal/releases and drupal.org/project/cms/releases provide per-release structured notes with breaking changes called out. Drupal has a long tradition of change records (drupal.org/list-changes) that flag API changes and migration steps. Not an 80+ because the CMS-specific distribution release notes are newer and less comprehensive than the mature core notes.

drupal.org/drupalorg/roadmap is publicly visible; the Drupal CMS 2.0 roadmap was tracked as an open meta-issue (drupal.org/project/drupal_cms/issues/3526521). The AI Initiative blog published a detailed 2026 execution plan with named milestones. Community RFC processes and public issue queues provide strong transparency. Not higher due to absence of a voting portal like Canny.

Drupal follows semver-aligned deprecation: deprecated APIs are flagged for at least one minor cycle before removal, with drupal.org change records documenting migration paths. The upgrade_status contrib module automates compatibility checks. Drupal CMS inherits these policies from core. Not higher because cross-major upgrades (10→11→12) still require manual effort.

Drupal is one of the largest open-source CMS communities globally: 800+ Slack channels, over 40,000 registered contributors on drupal.org, millions of live sites (1.2% of all tracked websites per W3Techs, stronger at 8.2% among top-10K domains). DrupalCon Rotterdam 2026 is scheduled. Not a 90 because community size metrics (GitHub stars, npm downloads) are less prominent for a PHP framework vs. JS ecosystems.

DrupalCon events continue with Rotterdam 2026 confirmed. The AI Initiative brought 28 organizations pledging 23 FTE contributors, signaling active corporate engagement. Slack workspace is highly active across hundreds of channels. Community Cultivation Grants fund regional groups. Not higher because younger developers are gravitating away per the 2025 Drupal Developer Survey (753 respondents).

Drupal Certified Partner program (new.drupal.org/association/become-a-drupal-certified-partner) lists hundreds of agencies globally with tiered certification. Top-tier agencies like Lullabot, Palantir, Acquia, and regional SIs are prominent. Acquia is a Fortune 500-backed SI wrapper for Drupal. Not in the 85+ range because major global SIs (Accenture, Deloitte) are not listed as Drupal Certified Partners, unlike AEM.

Drupal has decades of tutorial content: thousands of YouTube videos, Udemy and LinkedIn Learning courses, DrupalCon session recordings, and an extensive documentation ecosystem at drupal.org. SparkFabrik, Droptica, Acquia and dozens of agencies publish regular blog content. CMSWire and CMSCritic covered Drupal CMS 2.0. Near the top for this metric among open-source CMSs.

jobs.drupal.org lists active postings ($95K–$125K range); Drupal developers are available in volume in North America, Europe, and South Asia. However, the 2025 Drupal Developer Survey (753 respondents, 58 countries) explicitly flags that younger developers gravitate toward JS stacks, creating a generational concern. The talent pool is deep but the pipeline is narrowing. Not lower because near-term availability remains strong.

Drupal CMS as a distinct product launched January 2025 and reached 2.0 in January 2026 — strong early cadence. However, Drupal's overall market share declined ~31% since 2024 per market trackers, falling from ~1.7% to ~1.2% of all websites. Enterprise positioning remains solid (8.2% of top-10K domains). Momentum is bifurcated: new product energy vs. broader market share erosion. Not below 55 given the AI initiative tailwind and enterprise stickiness.

Drupal is governed by the Drupal Association (non-profit) with strong corporate sponsor backing — Acquia, 1xINTERNET, Dropsolid, amazee.io, and 28 organizations pledging $1.5M+ cash and in-kind to the AI Initiative. Open-source foundation model makes it immune to VC pressure. Acquia (acquired by Vista Equity, well-funded) is the primary commercial backer. Not higher because the Association's blog noted some financial sustainability challenges.

Drupal CMS positions as the accessible, AI-powered open-source alternative to proprietary DXPs — clear differentiation vs. WordPress (developer-focused) and commercial DXPs (costly). The 'State of Drupal October 2025' by Dries Buytaert articulates vision clearly. However, no current Gartner Magic Quadrant specifically names Drupal CMS; broader CMS market share has eroded materially. Analyst visibility is lower than peak Drupal years.

G2 shows Drupal at 3.9/5 with 470 reviews (as of 2026). Per scoring formula, sub-4.0 with <500 reviews lands 45–60; mid-range of that band is appropriate given volume. Review themes: praised for flexibility and enterprise capability, criticized for non-technical user complexity and steep learning curve. Drupal CMS 2.0 addresses the latter but is too new to have shifted the G2 aggregate meaningfully.

Drupal CMS is fully open-source and free — no licensing fees, no pricing tiers to navigate. The software cost is unambiguously zero. Hosting and support costs are external and vary by provider, but the platform itself has no opaque pricing. Scores well but not ceiling because total cost clarity requires researching hosting separately.

Open-source with zero licensing cost is the most predictable pricing model possible — no API meters, no seat counts, no bandwidth overages from the vendor. Hosting costs are separately controlled and predictable. The only concern is that total-cost predictability depends on implementation scope, which is notoriously variable for Drupal projects.

All Drupal CMS features are included in the open-source distribution — no premium tiers, no modules locked behind a paywall at the platform level. The recipe-based installation system, AI Assistant, and site builder tools in Drupal CMS are free. Contrib modules are overwhelmingly free; a small number of premium Drupal modules exist on Drupal.org but are not core features.

No software contract exists — you can stop using Drupal CMS at any time with no penalties. Hosting contracts are with third parties and vary, but many offer monthly billing. Startup and nonprofit programs exist through community hosting partners. Maximum flexibility from the platform vendor side.

Drupal CMS is permanently free for any use including commercial. Hosting can be obtained for ~$3–10/month on shared hosting providers. The full feature set is available at zero license cost. This is a strong free tier — no artificial capability restrictions, no time limits, commercial use fully permitted.

Drupal CMS significantly reduces the setup barrier vs classic Drupal via one-click installers and recipes, but still requires provisioning a server, configuring PHP/MySQL, and running an installation wizard. A developer familiar with PHP hosting can get a working site in 2–4 hours; non-technical users will need a day or more. Not as fast as SaaS-delivered CMS platforms.

Community-reported timelines: simple marketing site 2–6 weeks, mid-size corporate 3–6 months, enterprise 6–12 months. Drupal CMS's recipe system aims to reduce this, but complex content modeling, theme development, and module integration still require significant time. Consistently above the 2–4 week ideal for simple sites.

Drupal development commands a meaningful premium: US senior Drupal developers bill $120–$200/hour vs. $80–$120 for general PHP developers — roughly 25–50% above generalist rates. Specialized skills (Acquia Cloud, decoupled front-ends, Solr/Elastic, Commerce) push rates higher. Talent pool is smaller than WordPress, increasing scarcity-driven cost. Not as expensive as proprietary DXP specialists but clearly above market baseline.

Drupal CMS requires separate hosting — no hosting is included in the platform. Budget shared hosting works for small sites ($3–15/mo) but performance degrades quickly. Production sites typically use managed Drupal hosting (Pantheon $50–500+/mo, Acquia $500–5000+/mo) or self-managed cloud VPS with CDN. Enterprise government portals report $50,000+/year in Acquia costs. Ops burden varies dramatically by deployment choice.

Drupal CMS is maintenance-heavy: regular core updates, security patches (manual application required), contributed module updates, PHP version compatibility management, and database maintenance. Zesty.io TCO analysis and community sources consistently flag ongoing ops as a major hidden cost. Managed hosting (Pantheon, Acquia) offloads some of this but adds cost. Self-hosted requires at minimum a part-time ops resource; enterprise deployments often require a dedicated platform team.

As open-source software storing data in standard MySQL/PostgreSQL databases, Drupal CMS has low vendor lock-in at the platform level. Content can be exported via Views Data Export module, REST/JSON:API, or direct database dump. Configuration exports in YAML via Drush. Moving to another platform requires ETL work but no proprietary data format or binary blob issues. Hosting lock-in is separate and depends on provider choice.

Drupal requires learning a substantial set of proprietary concepts: nodes, entities, content types, fields, views, blocks, regions, modules, hooks, and services. Even with Drupal CMS 1.0/2.0 abstracting some of this for editors, developers still encounter the full entity/hook system when customizing. Concept density is well above average for a CMS, though slightly reduced for site builders using Recipes.

Drupal CMS ships with a dedicated user guide at new.drupal.org/docs/drupal-cms, DDEV as the official contribution environment, and structured community resources via Drupalize.me. The Drupal CMS 1.0 launch added installation walkthroughs and quick-start paths. However, documentation spans drupal.org, Drupalize.me, and community blogs without a single cohesive in-app onboarding experience.

Traditional Drupal CMS uses PHP + Twig templating with a hook/event system that is not standard in modern JavaScript-centric workflows. JSON:API and GraphQL modules enable headless use, and the next-drupal.org project provides a Next.js integration layer, but developers must still learn Drupal's PHP backend. The disconnect between modern JS tooling and Drupal's PHP core is a persistent friction point.

Drupal CMS 1.0 introduced Recipes for pre-packaged configurations (blog, landing pages, documentation), and Drupal CMS 2.0 added Site Templates for faster project starts. The next-drupal.org project provides a community-maintained Next.js starter with demo content. However, official vendor-maintained starters for modern JS frameworks lack the polish and CI/CD config of headless-first platforms.

A Drupal CMS project requires Composer for dependency management, DDEV or equivalent for local dev, database configuration, file system permissions, module enable/disable, and environment-specific settings.php management. Drupal CMS's packaged installer reduces initial setup vs. vanilla Drupal, but the overall config surface remains heavy compared to SaaS platforms. Environment variable management across dev/stage/prod is non-trivial.

Drupal's entity/field system is highly flexible with no field count limits. Config Management (CMI) enables schema version control and deployment via config export/import. Field type changes on existing content require data migration scripts, but the migrate module and tools like Entity Update provide paths. Schema changes are lower-risk than platforms without migration tooling, though still require developer involvement.

Drupal CMS 2.0 ships Experience Builder (Canvas) which provides real-time WYSIWYG editing with side-by-side desktop/mobile preview — a significant improvement over traditional Drupal's node preview. For decoupled/Next.js setups, next-drupal provides preview mode but requires frontend configuration. Traditional Drupal's preview required Layout Builder setup; Drupal CMS 2.0 substantially reduces this friction for traditional deployments.

Custom Drupal development requires Drupal-specific PHP skills: the hook system, service container, entity API, Twig templating, and Drush CLI are not transferable to other platforms. No formal certification is required, but the ecosystem's reliance on niche PHP patterns means generalist React/TypeScript developers cannot be immediately productive. Drupal CMS's Recipes reduce this barrier for site builders but not for custom module development.

Simple Drupal CMS sites using Recipes and Experience Builder can be set up by a single developer. However, production implementations of any meaningful complexity typically require at least 2–3 people: a Drupal backend developer, a frontend developer (Twig or JS), and someone handling DevOps/hosting. Enterprise Drupal projects routinely involve 4–6 roles. Drupal CMS reduces the floor but not the ceiling.

Drupal CMS 2.0's Experience Builder (Canvas) enables marketers and editors to build and edit pages visually without developer involvement. Recipes pre-configure content types and workflows. The built-in Views and block system allow editors to manage content listings. Creating new content types or integrating third-party systems still requires developer work, but day-to-day content operations are well-supported for non-developers.

Drupal CMS (launched January 2025) introduces automated minor and security update support via the Automatic Updates module as a core feature — a significant improvement over classic Drupal. Updates are applied in the background with automatic maintenance mode. However, recipes applied during setup have no built-in update path, requiring manual management for recipe-based customizations. Major version upgrades still carry Drupal's traditional complexity. Version 1.2.9 (described as the final 1.x release in late 2025) signals an upcoming migration to a 2.x line.

The Automatic Updates module enables background security patching with a readiness check via /admin/reports/status — a meaningful improvement over classic Drupal's manual composer-based patching. The upstream Drupal Security Team remains active (SA-CORE-2025-005 through SA-CORE-2025-007 in 2025), with parallel patches for Drupal 10 and 11. For self-hosted Drupal CMS, patches are still applied by the operator via the auto-update flow, but the process is significantly less friction-heavy than before. Hosted environments via Acquia or Pantheon can delegate patching to the provider.

Drupal CMS inherits the core Drupal release policy: Drupal 10 EOL is December 9, 2026, with D12 planned mid-to-late 2026. Disruptive breaking changes are deferred to Drupal 13 (not 12), giving some relief. However, as a distribution built on top of core, Drupal CMS may introduce its own migration events as it matures from 1.x to 2.x. Recipes have no update path, meaning recipe-based functionality requires manual intervention at distribution upgrades. The forced-migration cadence is comparable to classic Drupal, with added recipe-layer risk for Drupal CMS specifically.

Drupal CMS still runs the full Symfony-based Drupal stack: PHP 8.3+, MySQL/MariaDB/PostgreSQL, Composer, plus Symfony components, Twig, Guzzle, and any contrib dependencies. The dependency surface is identical to classic Drupal. Recipes may introduce their own locked version constraints (as flagged in the drupal.org forum discussion about 'locked versions of themes/modules'), adding version pinning complexity. No simplification to the dependency graph compared to core Drupal.

Drupal CMS adds auto-update readiness checks to /admin/reports/status, surfacing whether the hosting environment can apply updates — a small but practical improvement over classic Drupal's status report. Otherwise, no built-in APM, alerting, or observability dashboard exists. Production monitoring requires external tools (Uptime Kuma, New Relic, Datadog) or managed-hosting platform instrumentation. The auto-update status indicator provides modest improvement over bare Drupal for operators.

Drupal CMS ships with curated editorial-facing recipes that provide improved content workflows compared to bare Drupal (e.g., the Page, Blog, and Events recipe starters). Project Browser allows installing additional modules without Composer CLI. However, no automated content hygiene features exist — orphan detection, broken reference alerts, and content expiry still require contrib modules or manual editorial processes. The editorial UX is improved but the underlying content governance model is unchanged.

Drupal CMS inherits the full Drupal caching architecture: page cache, dynamic page cache, render cache with tag/context/max-age metadata. Performance management complexity is unchanged — cache tag invalidation is automated but custom contexts require developer knowledge, and scaling requires external Varnish/CDN configuration and database query tuning. Managed hosting providers (Acquia, Pantheon, Upsun) absorb much of this for hosted deployments. Self-hosted installations require the same performance discipline as classic Drupal.

Support for Drupal CMS follows the same open-source model as classic Drupal — no vendor SLAs from the Drupal Association; formal support comes through hosting partners (Acquia, Pantheon, Upsun) or contracted Drupal agencies. Acquia and Pantheon offer tiered support with SLAs for customers on their platforms. The Drupal CMS target audience (site builders, non-developers) makes the lack of a first-party support tier more notable, though managed hosting partners partially compensate. Good support still requires an enterprise hosting or agency arrangement.

Drupal CMS has a dedicated #drupal-cms-support channel in the Drupal Slack workspace (800+ total channels), with active issue queues on drupal.org and contributor participation from Drupal Association staff. The broader Drupal community (Stack Overflow 100k+ questions, drupal.org forums) provides deep context. However, Drupal CMS is new (launched January 2025), so CMS-specific knowledge and answered questions are still building up. Some community tension noted over Slack vs. open tools choice. Score is slightly lower than classic Drupal's 75 due to the smaller CMS-specific knowledge base.

Drupal CMS shows an active bug-fix release cadence: 1.2.5 through 1.2.9 all shipped in the first few months of 2025, with 1.2.9 described as likely the final 1.x release. The Bug Smash Initiative meets bi-weekly and coordinates core fixes. Security issues in underlying Drupal core are addressed promptly (multiple SAs in 2025). However, Drupal CMS-specific issues (e.g., Project Browser update failures, recipe locking bugs) depend on a smaller maintainer team than core Drupal. Resolution velocity is acceptable but no formal SLA exists for non-security bugs.

Drupal CMS 2.0 (launched January 28, 2026) ships Canvas 1.0 — a drag-and-drop visual page builder with live preview, component-based layout design, and AI-assisted page generation ('Build me a landing page'). The Byte site template provides a preconfigured marketing site out of the box. Marketers can compose pages from hero banners, card grids, and CTA blocks without touching code. Not quite 80+ because Canvas is new and the component library is still maturing.

Drupal CMS provides content scheduling (publish/unpublish dates) and content moderation workflows but has no native campaign management module — no multi-channel coordination, campaign analytics dashboard, or campaign lifecycle tooling out of the box. Contrib modules (Campaign Monitor, Mailchimp recipe) extend this but do not constitute a campaign management system. Scores above headless CMS (30–35) only because of scheduling and moderation.

The Drupal CMS SEO Tools recipe bundles Metatag (meta titles/descriptions/OG tags), Simple XML Sitemap, Pathauto (SEO-friendly URL generation), Redirect (301 management), and Schema.org Metatag for structured data — all available at install time. This is a comprehensive built-in SEO toolkit that rivals dedicated SEO platforms. Canonical URL management and robots.txt management also included. Not 85+ only because real-time SEO feedback tools are contrib, not core.

Drupal CMS 2.0 includes a Mailchimp integration recipe (one-click signup form blocks), and the Webform contrib module provides capable lead capture forms. However, there is no native UTM parameter tracking, conversion pixel management, or CTA performance analytics out of the box. Performance marketers still need external analytics (GA4, HubSpot) for conversion tracking. Scores above 35 because the Mailchimp recipe and form tooling are more turnkey than typical CMS platforms.

Drupal CMS has no native personalization engine. The Smart Content contrib module provides basic rule-based targeting (audience segmentation by context), and Acquia Personalization adds a full behavioral targeting layer as a commercial add-on. The Kameleoon module enables audience targeting and analytics. No native real-time behavioral personalization exists in CMS 2.0 core or standard recipes. Scores above headless CMS floor because Smart Content is a meaningful contrib option and the Drupal ecosystem has real personalization tooling — but it requires add-ons.

No native A/B testing exists in Drupal CMS 2.0. Contrib modules include ab_paragraphs (basic variant testing via Paragraphs), A/B Test UI, and the Kameleoon module (stable release announced) which enables A/B testing with statistical reporting and audience targeting. Integration with external tools (VWO, Optimizely) is also documented. All experimentation is contrib or third-party — no built-in statistical significance or winner selection in core. Scores at the floor for a platform with real contrib options but no native capability.

Drupal CMS 2.0 Canvas 1.0 enables marketers to clone page templates, edit inline, add pre-built component blocks, and publish directly without developer involvement. AI-assisted page generation via text prompts ('Build me a landing page') further accelerates content creation. Bulk operations, content scheduling, and media library are all accessible in the editorial interface. Not quite 70+ because the component library is still maturing and complex layouts still benefit from developer assistance.

Drupal CMS provides RESTful and GraphQL JSON:API for headless/decoupled delivery to web, mobile, and other digital channels. Content structured in Drupal can be served to multiple front-end applications, IoT devices, and digital touchpoints via APIs. However, multi-channel is API-driven requiring front-end development per channel — no native social push, email, or SMS delivery from the CMS. Scores above purely headless CMS peers because Drupal's web-first experience is mature, and API delivery to additional channels is well-documented.

Drupal CMS 2.0 includes one-click Google Analytics 4 and Google Tag Manager recipe integrations — no technical setup required. Matomo and other analytics platforms have contrib modules. However, content performance metrics (engagement data, content decay, top-performing pages) remain in external analytics tools — no native analytics dashboard within the CMS. Scores above 45 because GA4 and GTM are genuinely one-click in CMS 2.0, a meaningful improvement over manual tag installation.

Drupal CMS 2.0 Canvas introduces a component-based architecture where brand themes enforce typography, color tokens, and approved component palettes via the theme system. Drupal distributions and install profiles can lock down design standards. However, there are no hard enforcement mechanisms preventing marketers from overriding brand colors or creating off-brand layouts — Canvas offers guardrails through component selection but not enforceable style locks. Scores above 50 because the component system is a genuine improvement over unconstrained page building.

The SEO Tools recipe provides OG and Twitter/X card meta tag management for social preview cards. Contrib modules exist for social sharing widgets, social feed embeds (Twitter, Facebook), and basic social media integration. No native social scheduling or push-to-social workflow exists in Drupal CMS 2.0 — social distribution requires external tools (Buffer, Hootsuite). Scores at the standard 'OG plus social sharing' tier for traditional CMS platforms.

Drupal CMS includes a native Media Library with image transforms (via core Image module), video embedding, and basic asset tagging. Rights management and usage tracking require contrib. Full DAM capability is available via integrations — Acquia DAM (first-party for Acquia cloud deployments) and third-party DAMs (Kontainer, Brandfolder) have Drupal modules. Most deployments use Drupal's media library as a working asset store without enterprise DAM features. Scores above 35 because the media library is functional and Acquia DAM integration is real.

Drupal CMS has one of the strongest multilingual frameworks in open-source CMS: core Language, Content Translation, Interface Translation, and Configuration Translation modules provide field-level translation, locale-specific content scheduling, and per-language URL structures. The Translation Management Tool (TMGMT) contrib module adds translation workflow, professional translation service integrations, and transcreation workflows. Regional cookie consent and compliance can be managed per locale via contrib. Not 65+ because transcreation UI and market-level scheduling are contrib rather than recipe-ready.

Drupal CMS 2.0 ships with one-click recipe integrations for Mailchimp (email/MAP), Google Analytics 4, and Google Tag Manager. A broad contrib ecosystem covers HubSpot, Salesforce CRM, Marketo (via webhook/API modules), and social ad platform tag management via GTM. However, there are no first-party, deeply maintained pre-built connectors to major MAP platforms (Marketo, Pardot) or CDP systems out of the box. Scores above 45 because CMS 2.0 recipes make common MarTech connections genuinely easy, but the connector breadth is below commercial DXPs.

Drupal Commerce 3.x (first stable release for Drupal 10.3+/D11) integrates natively with Drupal CMS, combining product data modeling, variant management, per-SKU media library, product taxonomy, and editorial content on a single platform. Commerce 3.x introduces a redesigned modal-based order management workflow allowing merchants to manage all aspects of an order from a single interface. Over 42,000 active Drupal Commerce sites validate real-world depth. Not 80+ because Commerce setup still requires developer configuration.

Drupal Commerce provides category management, promotion and discount engines, and scheduled pricing — reasonable for an open-source commerce layer. However, there are no native search result merchandising tools, AI-driven cross-sell/upsell content blocks, or visual merchandising interfaces. Category management and promotional content scheduling exist but require custom development for advanced merchandising. Scores above 35 because Commerce's promotion engine is real.

Drupal Commerce is the native, deeply integrated commerce solution — no external platform needed. For headless commerce scenarios with Shopify or commercetools, contrib modules and custom API integrations exist but no first-party, maintained deep-sync connector is bundled with Drupal CMS. The native Commerce path is strong; third-party commerce platform integration is more of a custom build. Scores mid-range reflecting native strength offset by weaker third-party synergy.

Drupal Commerce enables editorial commerce: buying guides, lookbooks, and shoppable content where customers can add products to cart directly from blog posts or editorial pages. Product references can be embedded inline in any content type alongside rich editorial content. Canvas 1.0 allows marketers to compose these editorial-commerce blended pages without developer help. Not 65+ because the 'shop the look' and hotspot-style visual storytelling patterns require contrib or custom development.

Drupal Commerce provides some CMS-manageable elements in the checkout flow — trust badges, promotional messaging, and upsell blocks can be placed on cart and checkout pages via Drupal's block system. However, there is no dedicated CMS-controlled content injection layer for transactional flows — checkout templates are primarily Commerce-controlled and require developer changes to introduce CMS-managed content blocks. Scores above the floor because the underlying Drupal block architecture technically enables content in checkout, but it's not a turnkey feature.

Drupal Commerce provides a customer dashboard where order history, address book, and payment management are accessible — and CMS content can be surfaced in this area via Drupal's block/view system. Order confirmation emails are templated and can include CMS-managed content. However, CMS-managed post-purchase sequences tied to order events (delivery tracking, review solicitation, loyalty content) require custom development or contrib modules. Scores above the floor because the Commerce customer portal exists.

Drupal Commerce has a proven B2B track record: customer-specific pricing via price resolvers, quote-request flows, account-level catalog segmentation (customer groups), purchase order workflows, and ERP/CRM integration capability. Gated product documentation and spec sheets are achievable via Drupal's access control system. The Commerce B2B contrib module extends these capabilities further. Over 42,000 active Drupal Commerce deployments include substantial B2B use. Not 65+ because the B2B content features require significant developer configuration.

Drupal Search API with Solr or Elasticsearch backend enables faceted product and content search, taxonomy-driven filtering, and search result blending of editorial and product content. Commerce-specific search landing pages are achievable via Views and Search API. Synonym management and search result merchandising require contrib customization. Scores at mid-range because Search API is powerful but requires significant configuration and no native blended content-product search UI exists out of the box.

Drupal Commerce ships with a promotion engine supporting time-based activation, percentage/fixed discounts, promo codes, tiered pricing, and scheduled pricing rules. Sale banners and countdown timers can be managed via Drupal's block and scheduling system. Channel-specific targeting requires additional configuration. The promotion engine is genuinely capable for an open-source platform. Not 60+ because channel-specific content targeting and countdown timer components require contrib.

Drupal Multisite combined with Drupal Commerce enables multiple storefronts from a single codebase — each storefront can have region-specific editorial content and legal content while sharing a product catalog. Shared content types and media are maintained centrally. However, storefront-specific editorial requires content duplication or custom sync logic — there is no native shared-product/isolated-editorial architecture. Scores at 55 because the multisite commerce architecture is real and production-proven but requires ops discipline.

Drupal's media library supports image galleries, video embedding, and basic image transforms. Product images with multiple angles are manageable. However, there is no native 360-degree product viewer, AR/3D model support, or image hotspot functionality in Drupal Commerce or Drupal CMS 2.0. These advanced visual commerce features require third-party integrations (Cloudinary, Viuer) or custom development. Scores above the floor because multi-image galleries and video on product pages are achievable without custom code.

Drupal Commerce marketplace capability exists via contrib (Commerce Marketplace module, custom multi-vendor setups) but is not a first-class out-of-the-box feature. Seller profiles, seller-contributed product descriptions, and content moderation at marketplace scale are achievable but require significant developer configuration. No turnkey marketplace content management solution ships with Drupal CMS 2.0. Scores in the 30s — not at the floor because the Drupal ecosystem has documented B2B marketplace deployments.

Drupal Commerce inherits Drupal's best-in-class multilingual framework — product titles, descriptions, and attributes can be translated per locale, with currency-aware content blocks, locale-specific pricing, and regional regulatory content (EU labels, legal disclaimers) manageable per language. The Translation Management Tool (TMGMT) applies to product content. Regional promotional calendars can be scheduled per locale. Strong foundation, with the only gap being no AI-assisted product translation out of the box.

Drupal Commerce integrates with GA4 via the Google Analytics module, enabling basic ecommerce tracking (product views, add-to-cart, purchases). However, there is no native content-to-revenue attribution within the CMS — connecting which editorial pages assisted conversions requires GA4 or external analytics configuration. No content performance dashboard within Drupal CMS surfaces commerce conversion data. Scores at 35 as a CMS with GA4 ecommerce tracking available but no native content-commerce analytics.

Drupal's access control system is one of its historic strengths: granular RBAC per content type, node-level access control, field-level permissions, content-instance visibility, and SSO-backed authentication via SAML/OAuth/LDAP. Open Intranet and Droptica distributions confirm AD/LDAP/SAML/OpenID Connect integration at enterprise scale. Not quite 80+ because department-level audience segmentation requires contrib (Domain Access or similar) rather than being native.

Drupal CMS offers content moderation workflows (draft/review/publish/archive), revision history on all content, taxonomy-based knowledge classification, and Search API for internal search. Open Intranet now adds AI-powered search via RAG (Retrieval-Augmented Generation) with vector search to help employees find information fast. Solid for a CMS but not purpose-built for KM — lacks a guided knowledge lifecycle UI; most features require contrib or distribution selection.

Drupal has a genuine intranet ecosystem: Open Intranet (Droptica), Open Social distribution, and drunomics intranet solutions all provide news feeds, employee directories, social features, notifications, Microsoft 365/Google Workspace integration, and AI-assisted content — with documented deployments scaling to 7,000+ users. These are mature contributed distributions, not core features, meaning real enterprise deployments exist but setup requires distribution selection and configuration. Scores above 35 because the Drupal intranet distribution ecosystem is real and production-proven.

Open Intranet provides company news feeds, department-targeted announcements, and social interactions (comments, reactions). Drupal CMS core supports content scheduling and audience-based access control for targeted publishing. However, there is no native read receipt, mandatory-read workflow, or formal acknowledgment tracking — these require custom development or contrib additions. Scores above 35 because Open Intranet delivers targeted news publishing with social engagement, which is a genuine internal comms capability.

Open Intranet includes an employee directory module where staff can find contact information, roles, and expertise. Org chart visualization is achievable via Drupal contrib (Views + Hierarchical Select) but is not a native directory feature. HR system integration (Workday, BambooHR) requires custom API development or contrib connectors. Scores above 35 because a real employee directory ships with Open Intranet, but org chart and HR sync are add-on efforts.

Drupal provides revision history on all content, content moderation workflows (draft/review/publish), and scheduled content review via the Content Planner module. Document publishing with version control is achievable. However, there is no native mandatory-acknowledgment tracking, policy expiry reminders, or formal SOP management workflow in Drupal CMS 2.0 or Open Intranet. Policy management is possible via Drupal's content structures but requires custom configuration to match dedicated policy management tools.

Open Intranet's 2026 release added a Courses recipe providing Learning Management System-like functionality — course assignment, structured learning paths, and content sequencing. This enables role-specific onboarding content paths and progressive disclosure of material. Checklist-style onboarding tasks require contrib (Drupal Task module or custom). HR-triggered new-hire portal activation requires custom integration. Scores above 35 because the new Courses recipe makes structured onboarding achievable without full custom development.

Open Intranet 2026 includes AI-powered RAG search using vector search to help employees find information quickly — a significant upgrade for knowledge retrieval. Drupal Search API with Solr or Elasticsearch provides faceted filtering, relevance tuning, and search analytics. However, federated search across external systems (SharePoint, Confluence, Google Drive) is not native — it requires custom connectors. Scores below 65 because the RAG search is confined to Drupal content, not external system federation.

Open Intranet provides responsive design for mobile browser access. There is no native iOS/Android app for Drupal intranet deployments — mobile access is via responsive web only. Push notifications are not supported natively. Offline support and kiosk/shared-device modes require custom development. Scores above the floor because responsive design is genuine and the mobile browser experience on Open Intranet is documented, but the absence of native apps and push notifications is a real gap vs. purpose-built intranet platforms.

Open Intranet's 2026 Courses recipe provides course creation, assignment, and structured learning paths — functional for basic LMS scenarios. Completion tracking and certification are achievable via this recipe. External LMS integration (Cornerstone, Workday Learning) requires custom API development. The Courses recipe is a meaningful addition that moves Drupal intranet above basic content hosting for training, but stops short of full LMS functionality with advanced tracking and xAPI support.

Open Intranet provides comments, reactions (likes), Kudos (peer recognition/employee appreciation), and Ideas (innovation management/idea submission) via the 2026 business recipes update. Social interactions are a core feature of the Open Intranet distribution. Discussion forums and community spaces by department are achievable via contrib. Polls/surveys require Webform or a dedicated contrib module. Scores above 50 because the combination of comments, reactions, recognition, and idea management is meaningful social infrastructure.

Open Intranet (Droptica) documents Microsoft 365 and Google Workspace integration as core features, enabling SSO via Azure AD and content surfacing within the intranet context. LDAP/SAML/OpenID Connect authentication connects to enterprise identity providers. Slack integration and Teams bot-driven notifications are not native — they require custom webhook development. Scores above 35 because M365 and Google Workspace integration are genuinely built-in, but the 'single pane' Teams/Slack experience is not.

Drupal CMS provides content scheduling (publish/unpublish dates), revision history, content moderation workflow (draft/review/published/archived states), and the Content Planner module for editorial scheduling. Content ownership assignment is achievable via author/owner fields. Automated review reminders for stale content and systematic archival workflows require contrib (Content Expiry module, Content Planner) rather than being native to CMS 2.0. Scores at 50 because the moderation states and scheduling exist, but automated freshness enforcement needs additional setup.

Drupal intranet deployments rely on GA4 or Matomo for basic page view analytics, accessible in external tools rather than within the CMS/intranet interface. There is no native intranet analytics dashboard in Open Intranet or Drupal CMS showing department-level engagement, failed search terms, or adoption metrics. Search analytics are available in Drupal Search API but require additional configuration to surface insights. Scores at 35 — above the floor because Search API logs are available, but below 45 because there is no purpose-built intranet engagement dashboard.

Drupal Multisite provides silo-based isolation: each site gets its own database, configuration, files, and domain while sharing a single codebase. Three architectural modes exist (multi-tenant shared DB, hybrid, multi-instance). This is genuine isolation at the application level, though not a SaaS-native multi-tenant architecture with guaranteed zero data leakage at the infrastructure layer. Adequate for enterprise multi-brand but requires ops discipline to maintain isolation.

Drupal Multisite shares a single codebase, allowing themes, modules, and Canvas component libraries to be maintained centrally and consumed by all brand instances. Drupal distributions and install profiles can enforce shared design tokens and templates. Canvas 1.0 introduces a component system that further enables cross-brand reuse. However, there is no native UI for 'global content' pushed to multiple sites — this requires custom sync or a contrib approach like Config Split. Federation is workaround-based rather than first-class.

Drupal provides centralized governance via granular role/permission management, content moderation workflows, and editorial policies enforceable across a multisite installation. Acquia Site Factory adds a commercial governance layer (centralized security, backups, user management, compliance) but is a separate product. Cross-brand content standard enforcement in vanilla Drupal CMS requires configuration (Config Sync, shared distributions) rather than a native governance console. Scores in the 60s because governance is possible and real but requires bespoke setup.

Drupal CMS is open source (GPL, no per-brand licensing fees), meaning additional brands add only infrastructure costs rather than license costs. A shared multisite codebase further reduces maintenance overhead across brands. Self-hosted or cloud-hosted via commodity providers. Compare to proprietary DXPs where each brand instance can cost six-figure license fees. The economics strongly favor Drupal for multi-brand scale, limited only by developer/hosting costs which remain relatively fixed.

Drupal supports per-brand sub-themes that inherit from a parent theme, allowing independent color palettes, typography, logos, and layout configurations per brand while sharing underlying component structure. Canvas 1.0 components are theme-aware and can be configured with brand-specific design tokens. Config Split enables per-site theme configuration. Not 65+ because there is no platform-level 'brand kit' abstraction — theming is done via CSS/config overrides rather than a visual brand management UI.

Drupal CMS supports multilingual content per brand site in a multisite setup — each site can have its own language configuration, translation workflows, and regional legal content. Per-brand translation approval workflows are achievable via content moderation and TMGMT. However, there is no native brand-locale intersection governance — managing Brand A's French translations separately from Brand B's French translations with different approval chains requires custom workflow configuration rather than being a native platform feature.

Drupal CMS has no native cross-brand analytics dashboard. Each site in a multisite setup sends analytics independently to GA4, Adobe Analytics, or other external tools. Portfolio-level aggregation requires manual setup in Google Analytics 360 (roll-up properties), custom reporting, or third-party analytics aggregation tools. The 2026 Context Control Center proof of concept shows some cross-site data awareness but is experimental. Scores at 30 — not at the absolute floor because GA4 is one-click per site and cross-property reporting is possible externally.

In a Drupal multisite setup, each site can have independently configured content moderation workflows via Config Split — Brand A can have a 4-stage editorial review while Brand B has a simple draft-publish workflow. However, central auditability across brand workflows requires custom reporting or contrib — there is no native cross-brand workflow audit console. Scores at 48 because per-brand workflow configuration is genuinely possible and documented, but central oversight is a gap.

Drupal has no native corporate-to-brand content syndication system. Content sharing between multisite instances requires custom development — typically via a shared content entity approach, Content Hub (Acquia commercial product), or REST API-based sync scripts. Press releases and legal disclaimers can technically be pushed via API but there is no native override-point mechanism where local brands can adapt syndicated content within defined bounds. Scores above the floor because Content Hub (Acquia) is a real commercial solution for this, even if not native to CMS.

Each site in a Drupal multisite can have independently configured cookie consent (EU Cookie Compliance module), accessibility settings, data residency preferences (via hosting), and GDPR-related modules. Per-brand compliance configuration is therefore achievable. However, there are no platform-level publishing guardrails that prevent non-compliant content from being published — compliance is enforced through configuration discipline rather than automated checks. Scores at 45 because per-brand compliance configuration is real but guardrails are manual.

Drupal's shared multisite codebase provides a centrally maintained component library via Canvas and the theme system. Canvas 1.0 components can be updated centrally and propagated to all brand instances via codebase updates. Brand-level extensions are achievable via sub-themes. However, there is no dedicated design system management UI — versioning, update propagation, and brand-level overrides are managed through Git-based deployments and config management rather than a visual design system platform.

In a Drupal multisite setup, users can be configured with cross-site accounts (shared user table mode) or isolated per-site. Central administrators can manage user roles across sites. SSO via SAML/OpenID Connect provides single authentication across brand sites. However, autonomous brand teams with per-brand user management while remaining centrally visible requires contrib or custom implementation. Acquia Site Factory adds a commercial central user management layer. Scores at 52 because the technical building blocks are sound but the native UX for cross-brand user management is limited.

Drupal's shared multisite codebase allows content types to be defined centrally and shared across brand sites. Brand-specific field extensions are achievable via contrib (Field Group, per-site Config Split) but currently require forking the base content type configuration — there is no native 'extend without fork' inheritance model for content types in Drupal. Config Split mitigates this but adds complexity. Scores at 48 because shared base models are real but per-brand extension without forking is a workaround rather than a first-class feature.

Drupal CMS has no native portfolio-level reporting dashboard. Executive reporting across brand sites — content freshness, publishing SLA adherence, cost allocation per brand — requires external business intelligence tools (Tableau, Looker) fed by GA4 or custom Drupal data exports. Acquia Site Factory provides some central site management visibility but is a commercial product, not part of the base Drupal CMS. Scores at 30 because multi-site management dashboards exist only in commercial add-ons.

Drupal CMS 1.0 (Jan 2025) ships with built-in consent management and privacy tools as part of its default installer recipes, going beyond legacy Drupal which required contrib-only GDPR tooling. The GDPR contributed module provides consent tracking, data anonymization, Subject Access Request (SAR) management, and a 'forget me' erasure flow. However, the Drupal Association issues no vendor DPA — as open-source self-hosted software, GDPR compliance and any required DPAs are the deploying organization's responsibility. No EU data residency guarantee exists at the software level.

The Drupal Association does not issue Business Associate Agreements. Paubox explicitly states 'Drupal will not sign a business associate agreement and therefore is not HIPAA compliant' as a vendor. Drupal CMS can be deployed on HIPAA-eligible infrastructure by the customer, and module-level controls (audit logging, access control, encryption at rest) can support HIPAA technical safeguards, but the platform itself provides no BAA and no documented HIPAA-eligible service offering.

Drupal powers approximately 56% of global government websites and is widely used across US federal agencies (HHS, DOD, NASA, VA), demonstrating real-world suitability for regulated environments. GDPR and CCPA compliance is achievable via the GDPR module and configuration. However, FedRAMP authorization belongs to Acquia Cloud (a commercial hosting vendor), not the Drupal CMS open-source product itself — inheriting that authorization is invalid. No IRAP, C5, PCI-DSS, or HITRUST certifications exist for the core software.

Drupal CMS is open-source software distributed by the Drupal Association; no SOC 2 Type 2 attestation exists for the platform itself. The Drupal Association does not operate a SaaS environment requiring SOC 2 audit. Hosting providers (Acquia, Pantheon, Platform.sh) hold their own SOC 2 Type 2 certifications, but these cover the hosting infrastructure, not the Drupal CMS software product. Per scoring guidance for open-source self-hosted platforms, the customer is wholly responsible.

No ISO 27001 certification exists for Drupal CMS as open-source software or for the Drupal Association's operations in scope of the platform. ISO 27001-certified hosting for Drupal (amazee.io, Acquia) refers to the hosting provider's ISMS, not the CMS software itself. The anti-pattern of inheriting cloud/hosting provider certifications applies here. Customers deploying on ISO 27001-certified infrastructure gain that coverage, but Drupal CMS itself does not hold nor can it convey the certification.

No third-party security certifications (CSA STAR, PCI DSS, Cyber Essentials, FedRAMP) apply to the Drupal CMS open-source product. The platform does have a strong compensating factor: a dedicated Drupal Security Team with a structured public advisory process, weekly security release windows (third Wednesday), a 25-point vulnerability severity scoring scale, and a transparent coordinated disclosure process — all exceeding typical open-source security practices. This positions Drupal CMS above minimally-maintained OSS but well below certified commercial platforms.

As self-hosted open-source software, Drupal CMS provides complete data residency flexibility — organizations can deploy in any region or on-premises, with no vendor constraining data location. This is an intrinsic advantage over SaaS platforms. However, there are no vendor-issued contractual data residency guarantees because there is no vendor-customer hosting relationship for self-hosted deployments. CDN and sub-processor data flows are determined by the deploying organization's infrastructure choices, not the CMS vendor.

Drupal CMS includes built-in consent management and the GDPR contrib module provides a documented data subject request workflow: users can trigger 'forget me' and 'export' actions, site admins manage SARs via the GDPR Tasks dashboard, and the GDPR Fields submodule marks personal data at field level for targeted deletion. Data export is available via JSON:API or GDPR Export submodule. Post-termination data retention is not governed by a vendor policy (self-hosted), so retention is the deployer's responsibility — an advantage for control but requiring deliberate policy enforcement.

Drupal core includes the Database Logging (dblog) and Syslog modules for tracking content operations, user actions, authentication events, and system messages. The Syslog module enables forwarding to external log management systems and SIEMs via the system syslog daemon, providing an integration path without native push connectors. The Admin Audit Trail contributed module extends logging to cover configuration changes and entity-level operations. Log retention is configurable but defaults to database storage with no automated rotation — production deployments require explicit log pipeline configuration.

Drupal's Claro administrative theme explicitly states WCAG 2.1 AA conformance and is the default admin UI for Drupal CMS. Accessibility is enforced as a core gate — all code merged to Drupal core must pass accessibility review including keyboard navigation, screen reader support, and focus management. The project targets ATAG 2.0 for authoring interfaces with ATAG issues tracked separately. Drupal CMS 2.0's Canvas drag-and-drop builder added new accessibility considerations still being resolved in early 2026, preventing a higher score.

Drupal.org provides a dedicated accessibility page documenting WCAG 2.2 AA targets, ATAG 2.0 commitments, and coding standards. The project documents an ACR (Accessibility Conformance Report) process using the US Government's OpenACR tool, and issue #3335955 tracks adding a formal ACR to Drupal core. However, no single published, downloadable VPAT or ACR for Drupal CMS is available for direct procurement use. Third-party service providers (Tyler Technologies, CivicActions) publish Drupal-based ACRs, but these are implementation-specific, not product-level documentation from the Drupal Association.

Drupal CMS 2.0 (GA January 2026) ships AI Automators (field-level rewriting, summarization, tone adjustment, chained pipelines), AI CKEditor integration (grammar, tone, rewrite, expand in CKEditor 5), page generation from a single text prompt via Drupal Canvas, and the Context Control Center (GA Oct 2025) for centralizing brand voice, target audience, and key messaging. All features are recipe-installable without code. Scores below 70 because bulk generation and content-type-aware prompt templates are less polished than dedicated SaaS platforms, and brand guardrails depend on correct Context Control Center configuration.

AI-powered alt text generation ships GA in Drupal CMS 2.0 and is applied across image fields site-wide. Image generation via DALL-E and Stable Diffusion is available through the AI module provider abstraction. Drupal CMS 2.0 added AI-assisted media categorization for the media library. Scores 50 because image generation is provider-integrated (not a native DAM product), and smart focal-point/crop and AI video processing are absent.

The AI Translate sub-module provides one-click multilingual publishing. The dedicated AI Content Translation module (drupal.org/project/ai_content_translation) supports OpenAI-powered translation of complex structured content including paragraphs and entity references. TMGMT integration is available for TMS handoff. Agentic framework supports custom glossaries. Scores 60 because these are contrib modules (not embedded in core CMS workflow by default) and brand voice preservation across locales depends on agent configuration rather than built-in controls.

The ai_seo module provides on-demand SEO analysis within the node edit view, examining content and metadata with practical ranking recommendations. The contentai module auto-generates SEO titles, keywords, and meta descriptions. AI Automators handle taxonomy tag auto-generation. The AI Content Strategy module (updated Jan 21 2026) provides content gap and positioning recommendations. Scores 58 because these are distributed across multiple contrib modules rather than a single integrated SEO workflow, and on-page scoring is on-demand rather than continuous.

AI Automators (core to Drupal CMS AI recipe) provide comprehensive field-level automation: auto-tagging via taxonomy suggestions, audio transcription, OCR, web scraping, social post generation, and chained automator pipelines. Autonomous content agents (GA in AI v1.2, Oct 2025) actively detect outdated information (prices, statistics) and propose site-wide updates with human review gates. Media categorization in v2.0 aids content discovery. Scores 65 because smart scheduling and duplicate detection are less prominent, but the breadth of automator coverage is above average for open-source CMS.

The AI Agents framework reached stable production quality in AI module v1.2 (Oct 2025), shipping a no-code agent builder via admin UI, loop-based execution (LLM → tool results → loop), sub-agent composition, and BPMN.io visual editor for pipeline design. The Orchestration module v1.0 (Oct 2025) connects Drupal agents to external platforms. ECA (Event-Condition-Action) integration enables trigger-based agentic workflows. Three bundled agents cover structural tasks (field types, content types, taxonomy) with content creation agents via agentic framework. Scores 55 because no named production content-workflow agent product comparable to Contentstack Agent OS exists, and the three bundled agents target site-building rather than editorial pipelines.

The AI Content Strategy module (updated Jan 2026) analyzes existing content and provides strategic recommendations including content gap identification. Autonomous agents detect stale/outdated content across the site. The ai_seo module includes SEO gap identification within node analysis. There is no native content health dashboard or AI-driven ROI attribution engine. Scores 42 for basic-to-moderate content intelligence that covers gap analysis and stale detection but lacks comprehensive performance scoring, topic clustering, or editorial priority recommendations as a unified dashboard.

AI External Moderation provides content safety and policy compliance checks before publishing. AI Validations enables field-level AI-powered content validation against custom prompts. Autonomous agents can audit content for outdated factual information at scale. There is no comprehensive brand voice compliance audit suite or accessibility AI scanning integrated into Drupal CMS. Scores 38 for covering the moderation/safety dimension but lacking quality scoring, thin-content detection, and multi-dimensional auditing at the 45+ threshold.

The AI Search module (drupal.org/project/ai_search) implements RAG-based semantic vector search integrated with Search API. Multiple vector database backends are supported: Milvus, Pinecone, PostgreSQL with pgvector, Azure AI Search, and SQLite. Only SQLite has a stable release; production-grade deployments (Milvus, PostgreSQL) require additional setup but are documented and community-supported. Scores 48 because semantic search is functional but SQLite-only stable means most production deployments are in beta/require manual configuration — not out-of-the-box in Drupal CMS.

Drupal CMS has no native ML-driven personalization engine. The AI module ecosystem enables behavioral signal-based search ranking adjustments and contrib agencies have built ML personalization solutions on Drupal, but no packaged product ships with Drupal CMS. Scores 28 because while the open API allows building personalization, no out-of-the-box predictive segmentation, next-best-content recommendations, or cold-start handling ships in the platform.

The mcp_server module (drupal.org/project/mcp_server) exists with an alpha release, last updated March 9 2026. The base Model Context Protocol module (drupal.org/project/mcp) reached stable 1.2.3 in November 2025. The MCP Server supports tool-level RBAC, OAuth 2.1/JWT/mTLS auth, STDIO and HTTP transports, and MCP Studio for no-code tool creation. An mcp_client module (1.0.0-alpha1, Dec 2025) connects Drupal to external MCP servers. Scores 35 because MCP Server itself remains alpha as of March 2026 — announced and substantially built but not production-stable.

BYOK is a core design principle of the Drupal AI module, not an afterthought. Supported providers switchable via admin UI without code changes include: OpenAI (GPT-4, DALL-E), Anthropic Claude, Google Gemini, Mistral, Fireworks, Hugging Face (cloud and self-hosted), Ollama, LM Studio, and amazee.ai. The drupal_cms_ai recipe ships amazee.ai as default with free tokens; users substitute their own API keys during recipe setup. Local and air-gapped deployments via Ollama/LM Studio are explicitly supported for data residency requirements. Score stops short of 80+ because data residency controls are provider-dependent rather than platform-managed.

Drupal AI exposes a plugin-based AIFunctionCall system allowing custom tools to be registered for agent consumption. The Tool API module makes Drupal capabilities machine-readable for MCP and agent consumption. JSON:API and REST API expose structured content endpoints usable for LLM context. AI Search generates embeddings for RAG-ready content delivery. ECA integration provides webhook-style event triggers for AI workflows. Official developer docs and community guides exist for LangChain-style integrations. Scores 65 because there is no dedicated AI SDK (as opposed to the module plugin API) and dedicated LLM-optimized endpoints are a roadmap item rather than shipped.

AI Logging sub-module (core to the AI module, not a bolt-on) records all AI interactions for accountability and compliance documentation. Human-in-the-loop is a stated design principle across all Drupal CMS AI features. AI External Moderation provides content safety checks before publishing. Role-based access controls are applied at tool and agent granularity. Drupal CMS 2.0 introduced configuration rollback for AI-generated structural changes. Scores 58 because 'Advanced governance' (IP indemnification, hallucination confidence scoring, prompt template governance) remains on the 2026 roadmap rather than shipped.

The AI Dashboard in Drupal CMS 2.0 provides a central visibility panel showing available AI features and configured providers. AI Logging records all interactions. The AI Explorer admin tool enables real-time prompt testing. There are no per-user AI consumption metrics, AI credit/cost tracking dashboards, prompt effectiveness analytics, or quality trend monitoring built into the platform. Scores 30 because observability is limited to interaction logging and a feature overview panel — the analytics and cost management layer that would push this to 45+ is absent.