Liferay

Liferay CMS (generally available since 2026.Q3) builds content structures on Objects, with a broad field set including picklists, related content, uploads, rich text, email and phone number fields, plus nested and repeatable fields. Structures can be edited and reordered without breaking existing entries, and definitions export as JSON batch files for deployment through client extensions. Held in the adequate-to-strong band because there is no first-class schema-as-code workflow and no union or polymorphic field type.

Object relationships support one-to-many and many-to-many, and related entries can be read from either side through nested fields in the REST and GraphQL APIs. Referenced structure fields and related content cover the CMS layer. No polymorphic references or graph-style traversal, which keeps it below 75.

Referenced structures allow nested composition inside content structures, and fragments provide component composition on pages. Rich text remains an HTML blob rather than a portable structured format, and nesting is reference-based rather than an inline block system.

Object fields support required and unique constraints, and Object validations offer expression-builder rules (which can reference several fields) plus Groovy scripts on PaaS and self-hosted. Validations run on API writes as well as the editor. SaaS customers lose Groovy and must use client extensions, so it stops short of 75.

Versioned content with draft, pending, approved and expired states, version history with restore, a recycle bin for deleted items and author attribution. Legacy Web Content offers version comparison; Publications provided change-list branching but is in maintenance mode as of 2026.Q1. Solid adequate band; no strong diff UI or active branching model in the new CMS.

Vocabularies and categories are hierarchical, can be global and shared across sites, can be made required for specific asset types, and have internal or public visibility. Tags, bulk categorization and the Headless Admin Taxonomy API expose terms to delivery. Metadata sets and custom fields extend assets. Missing synonyms and term-level governance workflow keep it from the top band.

For Liferay-rendered sites, the Page Editor gives inline editing of fragment content and preview per segment experience and language, and the CMS editor (2026.Q3) previews a draft beside the form through a chosen channel and display page template, per translation language. The 2026.Q3 External URL channel embeds an outside application in the same panel, but it only shows saved content, applies no draft token and offers no click-to-edit overlay or SDK. Strong inside Liferay's own rendering, still weak for decoupled frontends.

CKEditor 5 is a release feature in 2026.Q1 and the default from 2026.Q2, with embedded images and media. Output is HTML rather than a portable AST, and CKEditor 4 customizations need rewriting.

The Liferay CMS asset library in Spaces adds AI tagging, faceted search and external storage integration, and Adaptive Media produces responsive srcset renditions at configured breakpoints. There are no URL-based transforms, focal point or on-the-fly modern format conversion.

Page comments with mentions on fragments and document checkout/check-in give async collaboration and some locking for files. Structured content has no co-editing, presence or conflict detection.

Kaleo supports custom states, role-based and scripted routing, conditions, forks and joins, notifications and a visual designer, with workflow assignable per content structure in Liferay CMS. Workflow Metrics adds SLA tracking and an audit trail. Among the most capable built-in engines; held at 80 by the lack of escalation routing out of the box.

Display date, expiration date and review date fields cover scheduled publish and unpublish, and Publications allowed scheduled release bundles. Publications is in maintenance mode with no announced replacement, and there is no publishing calendar view.

Field-level localization per field, per-site available languages, fallback to the default language, locale selection in the editor and Accept-Language on the headless APIs. Fallback is to the default locale rather than configurable chains, and there is no locale-specific branching.

Custom regular, site, organization and asset library roles with permissions down to the individual entry, Object field-level access, Space roles in Liferay CMS, SAML, OIDC and LDAP built in, and SCIM provisioning GA since 2025.Q1. One of the deepest permission models in the dataset.

OpenAPI-described REST plus GraphQL, auto-generated APIs for every Object, OData-style filter, sort, search and pagination, and locale via Accept-Language. No dedicated delivery-only API separate from management, and responses are verbose.

Liferay SaaS and PaaS front sites with a managed CDN, and cache-control headers are configurable. Self-hosted deployments bring their own CDN, and there is no granular per-entry purge or edge personalization.

Object Actions fire webhooks on create, update and delete with conditions and a secret key, and now cover Liferay CMS content built on Objects. There is no platform-wide event catalogue, documented retry or delivery log.

The 2026 Liferay CMS separates content from presentation and exposes everything through REST and GraphQL. Rich text is HTML and there are no official frontend SDKs, so it reads as a traditional platform with a solid API layer.

From 2026.Q1 local segment authoring in DXP is deprecated and read-only on new installs; segments come from Analytics Cloud and the Liferay Data Platform, which reached GA in 2026.Q3 with unified profiles and real-time segments activated across DXP and third-party tools. Those are separately licensed, so this is add-on and held below the 75 ceiling.

Experiences provide per-segment page variants with preview per segment in the Page Editor, and collection personalization varies lists by segment. With local segments deprecated, Experiences depend on Analytics Cloud or LDP segments, so the capability reaches buyers as an add-on. Targeting is page and collection level rather than per component.

A/B Testing on content pages with variants, traffic split and results reported through Analytics Cloud. No multivariate or bandit testing, and testing is not supported with staging enabled.

Analytics Cloud adds interest-topic content recommendations, and Liferay Commerce offers product recommendations. No general ML recommendation engine in the base product; manual curation via Related Assets otherwise.

Native Elasticsearch/OpenSearch search with faceted search widgets, type-ahead, Search Blueprints for no-code relevance tuning and boosting, synonym sets and result rankings for pinning. A genuine differentiator; no search analytics dashboard keeps it out of the top band.

Liferay Commerce is part of DXP: catalogs, price lists, account-specific pricing, cart, checkout, order management, inventory and payment methods. B2B-oriented and genuinely integrated; less depth for high-volume B2C than dedicated commerce engines.

SAP connectors for pricing, inventory and orders, otherwise integration through MuleSoft, Talend or generic APIs. No pre-built connectors for Shopify, commercetools, BigCommerce or Salesforce Commerce Cloud.

Analytics Cloud and the Liferay Data Platform report page and asset performance, engagement and individual profiles, and feed the content performance panel in the editor. All of it requires the separate product.

Site settings accept a Google Analytics ID and pages accept custom JavaScript for tag managers. No first-party connectors for Adobe Analytics, Segment or Amplitude and no event helpers.

Sites with shared asset libraries and Liferay CMS Spaces shared across sites, site templates, per-site configuration and Virtual Instances for tenant isolation. Portal heritage makes this one of the platform's strengths.

Native translation UX with side-by-side translation, XLIFF export and import, translation workflow, and machine translation through Google Cloud Translation, Microsoft Translator, AWS and DeepL. No official TMS connectors and no translation memory.

Design Libraries (2026.Q3) let a central team govern Style Books and fragments in one library and push updates to every site, and package approved assets into Design Packs for local teams. They sit alongside master pages, page templates and site-level permissions. Brand-level reporting and cross-brand approval policies are still not explicit features.

The Liferay CMS asset library adds AI tagging, faceted search and external system integration on top of metadata sets, versioning, file expiration and approval workflow. No rights management, brand portal or cross-channel usage tracking, and the legacy library is frozen while the new one matures.

External Video Shortcuts embed YouTube, Vimeo, Facebook and Twitch, and FFmpeg only produces previews. No native hosting, transcoding, adaptive streaming or captions.

The Content Page Editor offers drag-and-drop fragments, grids and containers, master pages and page templates, Style Book token guardrails, multi-element selection and marketplace fragment packs. Composition is for Liferay-rendered pages only; there is no visual builder for decoupled frontends, and new fragments need developers.

Liferay renders full sites natively, and Liferay SaaS and PaaS operate them with managed CDN, environments, custom domains and an SLA, while the product can also be self-hosted. Hosting of separate headless frontends is not offered, which keeps it below 90.

Objects with Form Container fragments are the recommended form path, supporting multi-step forms, CAPTCHA, submission storage and webhook actions on submit; the legacy Forms app adds conditional rules but is in maintenance mode. No progressive profiling or form analytics.

A HubSpot lead capture connector exists, and transactional notifications are native, but there are no connectors for Marketo, Mailchimp, Eloqua or Salesforce Marketing Cloud and no campaign email.

The Content Marketing Platform reached GA on 2026-09-23 as an add-on to Liferay CMS, covering campaign projects, tasks, a content coverage matrix by audience and journey stage, calendar and Kanban views, and approvals. That is campaign planning, not automation. LDP real-time segments can trigger personalized content in DXP and be activated to external tools, but there are no drip campaigns, lead scoring or nurture flows.

Native page SEO settings with title and description, friendly URL governance, canonical URLs, automatic hreflang, Open Graph, per-site robots.txt, XML sitemaps and a Redirection tool with 301/302, pattern redirects and 404 tracking. Structured data needs fragments or custom work and there are no on-page recommendations.

DXP 2026.Q3 adds llms.txt as a beta feature: once an administrator enables the feature flag, instance and site SEO settings serve hand-authored Markdown at /llms.txt per virtual host, alongside the editable per-site robots.txt. It is still beta, its content is written by hand rather than generated from pages, and there are no per-page Markdown endpoints, managed AI crawler rules or citation reporting.

About 815 marketplace apps across DXP apps, client extensions and cloud apps, with integrations for Salesforce, SAP, MuleSoft, Microsoft 365 and Google Drive. The ecosystem is split between legacy and new app types and maintenance quality varies.

Portal heritage: visitor registration and login, social login, SAML and OIDC federation to Okta, Auth0 or Entra ID, accounts and organizations for B2B portals, permission-gated pages and content, self-service account pages and personalization by user segment. Customer portals are Liferay's core use case.

Liferay DXP's 2026.Q1 LTS introduced a new API-first headless CMS replacing legacy content tools, alongside OpenAPI-compliant REST and GraphQL APIs with an in-admin API Explorer; the 2026.Q2 release (May 2026) continued on this baseline. 2025.Q3+ added siteKey/externalReferenceCode support to GraphQL endpoints and 2026.Q1+ moved LAR export/import onto the batch framework. Still carries Java verbosity, nested payloads, and multiple coexisting API generations — not higher until the new CMS APIs fully supersede legacy patterns.

API performance depends heavily on deployment configuration (self-hosted vs Cloud). No published SLAs for API response times. Pagination uses standard page/pageSize parameters; batch headless APIs handle bulk operations. No CDN-backed delivery tier. Performance at scale requires careful Elasticsearch and database tuning — not inherently fast without optimization.

Official SDK coverage remains thin: Java SDK, aging Android/iOS mobile SDKs, and a JavaScript client without full TypeScript support. No official Python, Go, Ruby, or .NET SDKs. Developers can self-generate clients (java, javascript, typescript-fetch) from Liferay's OpenAPI specs via openapi-generator, but no officially published, maintained typed client packages. Lower range for this item.

Liferay Marketplace at marketplace.liferay.com has a moderate catalog. 30+ integrations are natively bundled with Liferay 7.4+, covering LDAP, Salesforce, SSO providers, OpenSearch, Solr, MuleSoft, and HubSpot. Many community-maintained connectors have varying quality and update frequency. The marketplace is less vibrant than in the 6.x/7.0 era and smaller than competitors like Contentful or Sitecore.

Client Extensions are the standard extensibility model in 2026 with four categories (frontend, microservice, configuration, batch), supporting React, Vue, Angular, and Node.js without Java/OSGi knowledge; the 2026.Q1 LTS positions them as the upgrade-safe customization path, and FE client extensions gained HMR for faster iteration. Backend client extensions (documented on Liferay Learn) let developers add custom business logic and orchestrate external workflows via headless APIs. Legacy OSGi extensibility (ModelListeners, ServiceWrappers, custom portlets) remains for deep customization. Limited only by the complexity of the legacy path.

Authentication remains a genuine Liferay strength. Full SAML 2.0 (SP and IdP), OpenID Connect, LDAP synchronization, MFA support and enforcement, configurable session management, and OAuth 2.0 for API access. SSO is available without top-tier plan gating. Enterprise authentication is mature and battle-tested across large organizations. Not higher because the configuration UX is complex compared to modern SaaS platforms.

One of the most granular permission systems in the DXP space. Resource-level permissions, role-based access with Regular, Site, Organization, and Asset Library roles, individual permission assignment, content-level access control, and permission inheritance through organization hierarchy. Custom roles are fully supported. Field-level and content-instance permissions are available. The permission system is extremely flexible for complex enterprise access requirements.

Liferay's Trust Center confirms SOC 2 Type 2 alongside ISO/IEC 27001:2022, ISO/IEC 27017:2015, ISO/IEC 27018:2019, and CSA STAR Level 1 and 2. GDPR tooling (data erasure/export), EU cloud regions, and HIPAA-eligible Cloud deployments are available. Not higher because self-hosted compliance depends on customer infrastructure and certification breadth still trails Adobe.

Liferay runs a public bug bounty on Intigriti, a formal disclosure process with CVE assignment, and a maintained Known Vulnerabilities page. Volume remains high: the late-2025 batch added an OpenAPI authentication bypass (CVE-2025-62256), CSRF on the headless API (CVE-2025-62258) and unbounded page size on headless and GraphQL APIs (CVE-2025-62260, CVE-2025-43796) on top of a long XSS run, and the 2026.Q3 release notes list further Broken Access Control and cross-instance IDOR fixes in Commerce. Strong disclosure posture offset by recurring access-control flaws keeps it in the low 60s.

Liferay offers SaaS (fully managed), Liferay Cloud PaaS, and self-hosted on any infrastructure from one activation-key distribution. The 2026.Q3 release made Cloud Native support for GCP and CNCF-conformant Kubernetes generally available, with an official Liferay Toolkit and Helm chart (liferay-default) for private-cloud deployments. Not higher because self-hosted operations remain complex and Liferay Cloud adds significant cost.

Liferay Cloud offers 99.95% uptime SLA for production with a public status page (status.liferay.cloud) including per-region uptime history. Incident record is mixed: an 11-hour partial outage in September 2025, shorter incidents in November 2025 and April 2026, and an acknowledged outage in late May 2026. Self-hosted uptime is entirely customer-managed. Not higher given the incident frequency and no vendor SLA for self-hosted.

Liferay scales horizontally through clustering with cache coherence and session replication, Elasticsearch/OpenSearch clusters for search, and auto-scaling on Liferay Cloud; the 2026.Q3 GA Helm chart gives self-hosted teams a supported Kubernetes scaling path. Proven at enterprise scale (Airbus, Bosch). Not higher because there is no CDN-backed content delivery tier, no published scale limits, and clustering still needs significant infrastructure expertise.

Liferay Cloud provides automated backups and point-in-time recovery; self-hosted deployments need custom strategies for database, document library, and Elasticsearch indices. Content export improved in 2026.Q1+ as LAR export/import now uses the batch framework at site and instance scopes, making large exports more reliable. Still no publicly documented RTO/RPO targets, and LAR remains a proprietary format.

Liferay provides Blade CLI for scaffolding and Liferay Workspace (Gradle/Maven) for dev environment setup, with Docker-based local development. Client Extensions improved the dev loop with modern JS toolchains (Webpack, TypeScript) and HMR for frontend extensions. However, the full Liferay server must run locally, requiring significant setup and slow startup times — far from the instant-feedback loops of headless CMS platforms.

Liferay Cloud has built-in Jenkins-based CI/CD pipelines for building, testing, and deploying, with dev/UAT/prod environment management. Client Extensions integrate naturally with external CI/CD pipelines for automated deploy and rollback. Self-hosted requires custom setup; content migration via LAR remains fragile despite 2026.Q1 batch improvements. No content-as-code workflow, deploy previews, or branch environments.

Liferay Learn (learn.liferay.com) is a structured, role-based education ecosystem covering implementation, architecture, Client Extensions, headless APIs, and commerce, with structured learning paths and dedicated 2026 deprecation/breaking-change references for the Q1 LTS transition. API reference includes OpenAPI specs. Still limited by Java-centric code examples and gaps in advanced configuration docs.

Client Extensions support TypeScript via modern Webpack toolchains, and Liferay documents generating typescript-fetch clients from its OpenAPI specs via openapi-generator — a workable but DIY typed-client path. There is still no officially published typed SDK, no auto type generation from content schemas or Objects, and TypeScript is not integrated into the headless API workflow out of the box.

The 2026.Q3 line has already shipped nine builds (Q3.0 through Q3.8) on a near-weekly patch rhythm, with the 2026.Q1 LTS (Q1.13-LTS), 2025.Q1 LTS (Q1.29-LTS) and 2024.Q1 lines patched in parallel, and liferay-portal is committed to daily. Three standalone products also reached GA in eight weeks: Liferay Data Platform (2026-08-19), Digital Sales Room (2026-09-09) and Content Marketing Platform (2026-09-23). Not higher because new core features still land on a quarterly rather than monthly cadence.

learn.liferay.com maintains structured per-quarter release notes plus a '2026 Deprecations and Breaking Changes' reference with per-release sub-pages, and each quarterly release ships with a webinar and service-life/EOL policy. Still short of 75+ because code examples are sparse and migration guidance for complex scenarios remains incomplete.

Liferay publishes a public Now/Next/Later roadmap at liferay.com/roadmap, and the items it flagged (Content Marketing Platform, Liferay Data Platform, AI Hub) have since shipped, which lends it credibility. A Feature Requests portal on Liferay Ask takes community votes with product-team replies linking Jira tickets. The roadmap carries no committed timelines and voting is not integrated with it, keeping it below 70.

The unified 2026 platform keeps upgrades a license-key change rather than a migration, three LTS lines (2024.Q1, 2025.Q1, 2026.Q1) are still receiving patches, and maintenance-mode transitions are documented with recommended alternatives. No codemods or automated migration tooling exists, and the volume of maintenance-mode transitions still imposes real planning burden.

GitHub liferay/liferay-portal sits at 2,266 stars and 3,807 forks, modest next to headless competitors (Strapi 65K+, Payload 30K+) despite a very active codebase of roughly 995K commits. discuss.liferay.com hosts the Free Tier community with per-release threads and liferay.dev retains a deep content archive, but the Free Tier has not visibly grown the overall footprint.

discuss.liferay.com shows consistent official engagement, with Liferay staff posting each Free Tier and quarterly release and responding to threads, and the Feature Requests portal receives product-team responses with Jira links. Core development remains overwhelmingly internal with rare external contributions, which caps the score.

Liferay runs a formal partner program with a searchable directory, regional/global tiers and developer certification, and kept adding technology alliances in 2026: Camunda's Technology Partner of the Year (May), MarketFully for adaptive multilingual content (August 18) and Demandbase for account intelligence (August 26). Delivery partners remain concentrated in LATAM and Europe; Liferay-specialized agencies are harder to find in North America and APAC than for AEM or Sitecore.

Third-party coverage picked up around the 2026 release model and AI Hub, with XTIVIA publishing several AI Hub analyses and diginomica covering Liferay's unbundling strategy. There are still no significant new Udemy/Pluralsight courses or sustained YouTube series, and much existing content targets legacy 7.x versions.

Liferay developer talent remains scarce relative to AEM, Sitecore or mainstream JS-stack platforms, with the Java/OSGi specialization a high barrier for generalists and the pool concentrated in LATAM, Spain and India. The Free Tier and unified platform lower the experimentation barrier, but no hiring-pool effect is visible in job-market signals.

Product-led momentum is strong: Data Platform, Digital Sales Room and Content Marketing Platform all went GA between August 19 and September 23, AI Hub entered public beta on June 3, and the ATO FastTrack initiative (September 4) targets US government agencies. Liferay also earned 2026 Gartner Customers' Choice and keeps publishing market research. Net-new enterprise logo and case-study announcements remain rare, keeping this mid-range.

Liferay remains privately held with no outside funding, acquisitions or layoff announcements, and is still funding a wide product push (four new standalone products in 2026). However, headcount data shows about 1,008 employees as of March 2026, down 2.1% year over year and 20.6% from 2023, and active job postings fell 87.4% versus 2025, signalling a hiring freeze rather than growth.

Liferay's latest Gartner MQ for DXPs (January 2025) was its 15th consecutive placement with improved execution and substantially improved vision, it ranked highest for the Authenticated Experience use case in Critical Capabilities, and IDC named it a Leader for AI-enabled full-stack CMS (December 2025). Unbundling into standalone CMP, Data Platform, Digital Sales Room and AI Hub products sharpens a B2B and authenticated-experience position. Still a Niche Player overall with an on-premise-heavy base, capping the score.

Liferay was named a 2026 Gartner Peer Insights Customers' Choice for DXPs, one of only two of seven vendors, with a 4.6/5 overall rating (64 reviews as of July 2026), the highest in the report, and 91% willing to recommend. The modest review volume keeps it below the 75+ band despite the top rating.

Liferay DXP pricing remains entirely sales-gated in 2026 — no public pricing for any enterprise, SaaS, or PaaS plan; buyers must request a quote via sales@liferay.com. Enterprise subscriptions reportedly start around $25K–$50K/year but this is never officially published; only the Free Tier carries a clear price of $0. The request-a-quote model creates significant friction for comparison shopping.

Self-hosted DXP uses per-server-instance/per-environment subscription licensing that escalates with dev/staging/prod and clustering. SaaS plans meter MALU (Monthly Active Logged-in Users) and APV (Anonymous Page Views), and AI Hub adds a third meter: prepaid Liferay Token (LRT) blocks with locked conversion rates and a hard stop at zero balance, which is predictable but one more unit to budget. Predictable at base level, but multi-environment licensing and stacked usage metrics create cost uncertainty at scale.

The 2026.Q1 release unified CE and DXP into one modular platform gated by activation keys, and the Free Tier now includes clustering on up to three nodes — a genuine improvement. However, security-critical features including multi-factor authentication, SAML SSO, and advanced search tuning still require an Enterprise Subscription key, which is exactly the problematic gating pattern (SSO/security behind enterprise). Free Tier patch access also stops at each quarter's stable release.

Liferay requires annual or multi-year subscriptions with no monthly billing option. The Free Tier provides a $0 entry point for development, PoC, and small-scale use, with an in-place upgrade path to enterprise (apply a Subscriber Activation Key, no reinstallation under the unified 2026 platform). No publicly documented startup program; exit and renewal provisions depend on contract negotiation.

The unified Free Tier gives everyone the same core DXP installation as enterprise: content management, sites, headless APIs, workflow, all supported databases, and clustering on up to three nodes. However, activation keys are valid only 12 months and must be renewed, keys are domain-registered, patch eligibility ends at each quarter's stable release, and MFA/SAML are excluded. A capable free tier, but the renewal requirement, key gating, and Java infrastructure footprint keep it below lightweight open-source alternatives.

Getting to first deployed content with Liferay takes days to weeks, not hours. Setup requires a Java app server, database, Elasticsearch, activation-key registration/deployment, content type definition, and theme work. Docker-based quickstart exists but still demands Java ecosystem knowledge; Liferay SaaS reduces infrastructure setup but onboarding and content modeling remain time-intensive versus headless CMS platforms.

Typical Liferay projects run weeks to many months: simple portals 4–8 weeks, moderate enterprise projects 3–6 months, complex integration-heavy deployments 9–12+ months, with implementation costs of $10K–$100K+. The quarterly release model and a mandatory javax-to-jakarta migration (guides advise budgeting 2× estimated upgrade time) add ongoing effort, keeping timelines in adequate-to-poor territory for an enterprise DXP.

Liferay developers command a 30–50% premium over generalist web developers. US salaries average ~$127K/year (range ~$96K–$171K), with embedded Liferay specialists costing $180K–$350K/year for 6–12 month engagements and freelance/offshore rates ranging $30–$100+/hr. Java/OSGi skill requirements and a smaller talent pool drive rates up; Client Extensions are lowering the barrier slightly but the core remains specialist territory.

Self-hosted Liferay requires multi-component infrastructure — Java application server, MySQL/PostgreSQL database, Elasticsearch cluster, and optionally document storage and caching — putting production hosting at roughly $500–$2000+/month. Liferay SaaS bundles hosting into the subscription (no infra cost) and PaaS adds cloud infra usage on top, so total hosting spend is comparable to other enterprise DXPs regardless of path.

Self-hosted and PaaS Liferay's real expense is engineering hours spent on upgrades, patch cycles, and infrastructure maintenance year after year — server patching, database and Elasticsearch management, cache/cluster tuning, and the quarterly-release upgrade cadence realistically demand part-time to full-time DevOps. SaaS reduces this substantially but configuration and deployment management remain; PaaS removes infrastructure ops but not application-level operations.

Migration out of Liferay is moderately difficult. Content extracts via headless REST APIs in JSON (a positive), but content models, permissions, workflows, and configurations are not easily portable; the LAR export format is proprietary and custom code (OSGi modules, Fragments, Client Extensions) is platform-specific. The 2026 unification also means even free usage runs the keyed DXP binary rather than a fully independent open-source build, and no vendor migration tooling to competitors exists.

Concept count remains very high: Sites, Pages, Fragments, Widgets, Objects, Client Extensions, Asset Libraries, Roles, plus Spaces (with Space Administrator/Content Reviewer/Member roles) and channels connecting spaces to sites in the 2026.Q3 CMS, while legacy Web Content/Blogs/Documents & Media persist in maintenance mode, so two content systems still coexist. 2026.Q3 adds further layers (Design Libraries, AI Hub agent workflows, Data Platform). Not lower because the Objects-centric CMS is now the clear default for new work.

Liferay Learn offers a structured, role-based curriculum including courses on Objects data modeling, backend and frontend Client Extensions, Workspaces & Tooling, and Jakarta upgrades, free for customers, partners and community, plus an active certification catalog and step-by-step CMS getting-started docs for 2026.Q3. Still no rapid 'build something in 30 minutes' developer quickstart, and onboarding assumes enterprise developer context, so it stays mid-range.

Client Extensions run outside the portal container against headless APIs in any language (React, Node.js, Vue, Angular, Spring Boot), and the headless CMS is API-first for any frontend. However, core platform customization still requires Java/Jakarta EE, FreeMarker remains the fragment templating language, and 2026.Q3 breaking changes (persistence finder API rework, ORM API removals, template-engine restrictions) show how much proprietary Java surface custom code still touches.

Sample Client Extension projects in Liferay Workspace remain the recommended starting points, with Blade CLI supporting quarterly release targeting. There are still no official Next.js/Nuxt/Astro starters and no vendor-maintained reference frontend for the headless CMS, even though 2026.Q3 added external-URL preview aimed at such frontends. Samples demonstrate individual features rather than complete applications.

Configuration surface remains enormous: portal-ext.properties with hundreds of settings, OSGi config, System/Instance/Site Settings, search, cache and clustering, and the Jakarta EE re-platforming still weighs on existing teams. The Cloud Native Experience toolkit, now Kubernetes Ready via the official liferay-default Helm chart and GCP/AWS Ready with opinionated Terraform, standardizes self-hosted infrastructure setup and is a 2026.Q3 highlight. Raised slightly for that, but production tuning still requires specialist expertise and CNE is a subscription feature.

The headless CMS standardizes content modeling on Liferay Objects-based content structures with auto-generated headless and batch APIs, stable class names (since 2025.Q1), and data model export/import for cross-environment portability. Automated migration tooling for breaking schema changes remains limited, and migrating existing Web Content into the new CMS is still an open effort; 2026.Q3 also moved database schema export out of System Settings.

Page Builder still provides solid built-in in-context editing, and the 2026.Q3 CMS adds a side-by-side preview in the editing view against display page templates of connected sites, plus an External URL channel that renders an external application's page in the panel or a new tab. The external preview is only an iframe of an address you supply: content must be saved as draft or published first and the external app must fetch the draft itself, with no documented draft token or framework SDK. Raised for the shipped preview, held below 60 because headless draft mode is still DIY.

With Client Extensions running outside the container against headless APIs and the CMS exposing standard APIs, generalist React/Node developers can handle a growing share of project work without OSGi or deep Java expertise. However, Java/Jakarta EE skills remain mandatory for core customization and upgrades, FreeMarker for fragments, and Liferay's active certification ecosystem reflects how proprietary the full skill set still is.

A production Liferay deployment still realistically needs 3-5 people minimum: backend Java developer(s), frontend developer, and DevOps/infrastructure. The CNE toolkit and SaaS hosting trim the ops role, but quarterly breaking changes, Jakarta/LTS upgrades and platform management keep enterprise deployments multi-role projects.

The CMS lets marketers manage content in Spaces with their own member roles, AI-powered translation, platform-wide find-and-replace (2026.Q2), in-context analytics, and from 2026.Q3 a self-serve preview against display page templates. Page Builder with Marketplace fragments and shared Design Libraries remains accessible to non-technical users. New content types and custom layouts still require developer involvement and authors need moderate training, so it stays mid-range.

2026.Q1 LTS is the recommended Jakarta target and Client Extensions reduce coupling, but each quarter still ships a long breaking-changes list: 2026.Q3 alone lists about 21, including kernel ORM and persistence API removals (Session.saveOrUpdate removed, finder API reworked, cacheResult folded into BasePersistence, DynamicQuery.setProjection overload removed) that break custom Java code. Not lower because LTS lines, upgrade reports and data-cleanup tooling are mature; not higher because the javax to jakarta move plus quarterly internal API churn keep upgrades a planned project for customized installs.

Patch cadence is fast: releases.json shows 2026.Q3 already at .8 and 2025.Q1 LTS at .29, and 2026 fixes such as an RCE via FreeMarker sandbox bypass (LPD-90754) and several cross-instance Commerce IDORs ship as documented breaking changes. Disclosure lags though: NVD lists 91 Liferay CVEs published Sep to Dec 2025 and none yet in 2026, so advisories arrive in large delayed batches. Not higher because self-hosted patching is manual and some fixes change default behavior; not lower because the update stream is frequent and every patch is documented with who is affected.

On top of the mandatory Jakarta move, 2026 deprecation notices push customers off features on Liferay's timeline: 2026.Q1 deprecated local Segments authoring in favor of Analytics Cloud (new installs read-only) and put Web Content, Blogs, Documents and Media, Knowledge Base, Asset Libraries and Publications into maintenance mode; 2026.Q2 deprecated CKEditor 4; 2026.Q3 archived the Dialect theme (customizations must be rebuilt against Classic tokens) and deprecated the Panel and Full Page Application page types with no automatic migration path. Not lower because deprecation flags keep features on for at least a year and maintenance-mode features stay supported; not higher because the pace of deprecations is high and several have no migration tool.

Self-hosted Liferay still needs a Java runtime, a Jakarta app server (Tomcat 10.1 or JBoss EAP 8), a database, Elasticsearch and an office suite for previews (OpenOffice deprecated in 2026.Q3 in favor of LibreOffice). Cloud Native Experience now covers AWS, GCP and any supported Kubernetes, and 2026.Q3 added a database migration tool whose only target is PostgreSQL, but both add toolchains rather than shrinking the stack. Not higher because the multi-service footprint and OSGi bundle management persist; not lower because CNE and Liferay PaaS automate provisioning.

Cloud Native Experience, now available for GCP and any supported Kubernetes as well as AWS, ships product-aware observability (Grafana dashboards, visibility into Liferay and every app in the cluster), and the Liferay Cloud console provides monitoring, logs and quota views for PaaS. Classic self-hosted installs outside CNE still need custom JVM, database and Elasticsearch monitoring. Not higher because the packaged observability requires adopting CNE or PaaS; not lower because it now spans more deployment targets.

Liferay has expiration and review dates for web content and documents, a Page Audit tool, a Content Performance tool and an audit framework, but no automated orphan or broken-reference detection, and the 2026 shift of classic content apps into maintenance mode while the new CMS matures adds a content-migration workload. Not lower because expiry, review and audit tooling are built in; not higher because hygiene still relies largely on editorial discipline.

CNE's horizontal pod autoscaling and self-healing clusters, plus Liferay SaaS and PaaS, reduce capacity work, but self-hosted deployments still need JVM tuning, cache configuration, database and Elasticsearch tuning, and CDN setup. 2026.Q3 also deprecated Asset Publisher pagination redirects because they enabled denial-of-service amplification and CPU spikes, which customers must switch off themselves. Not higher because tuning remains a customer task on most deployments; not lower because the managed scaling options are real.

G2 reviews (about 4.4 stars) praise responsive, knowledgeable support and helpful architects, but good support is tied to subscription tiers and Community Edition users have no official support. Not lower because enterprise customers report genuinely good experiences; not higher because tier gating persists and some reviewers report delays and documentation gaps. No new public evidence on support quality since the last scoring.

The liferay.dev Ask forum holds a large archive (about 55,500 Development and 48,300 Portal threads) and there is a community Slack with vendor participation, but the community is small next to WordPress or Drupal and advanced questions often go unanswered; the liferay.dev Ask page still showed a stale June maintenance banner in October. Not lower because the archive and learn.liferay.com documentation are deep; not higher because live community response is modest.

Subscribers get frequent update releases (2026.Q3 reached .8 within the quarter, LTS lines keep receiving updates) and each fix is documented with a ticket, but Community Edition only receives the .0 release each quarter and public CVE disclosure trails fixes by months. Not higher because non-subscribers and the public wait; not lower because the subscriber fix pipeline is steady and transparent in release notes.

Liferay's Page Builder with Fragments provides drag-and-drop layout and in-context editing. The Content Marketing Platform (CMP) lets marketers launch landing pages and microsites without leaving the platform, and automated A/B testing is available for conversion optimization. The new headless CMS (GA in 2026.Q1) does not change the page-building experience. Fragment development still requires developer involvement for new layouts, keeping it below dedicated marketing DXPs like Optimizely or Sitecore XM Cloud.

Liferay Content Marketing Platform reached general availability in 2026.Q3 (press release 2026-09-23) and is now a genuine campaign management tool built natively on Liferay CMS: projects act as campaign containers, tasks carry deliverables with owners and deadlines, and a centralized dashboard, kanban board and per-project calendar give real-time visibility. Approval steps support parallel review paths with an audit trail, and a Content Coverage Matrix maps assets against personas and funnel stages, with AI agents (via AI Hub) that flag gaps and draft content to fill them. Paired with Liferay Data Platform it attributes content performance by segment and funnel stage. It is separately licensed (feature flag plus CMP license), multi-channel execution beyond Liferay's own sites still relies on external MAPs, and campaign analytics depend on also buying LDP, which keeps it below the dedicated marketing suites.

Liferay supports meta title/description per page, sitemap generation, OpenGraph metadata, and friendly URL management. The Page Audit tool (powered by Google PageSpeed Insights) provides SEO and accessibility recommendations per page. The AI Assistant helps craft SEO-friendly headlines and meta descriptions. Structured data (JSON-LD) still requires custom implementation, redirect management is basic, and there is no SEO scoring or keyword validation tool.

The native Forms module handles lead capture, and the 2026.Q1 HubSpot Lead Capture connector syncs Liferay form submissions to HubSpot CRM. Liferay Data Platform (2026.Q2+) now ingests HubSpot and Marketo marketing events (form submissions, email clicks, webinar attendance) back into unified profiles, and CMP plus LDP attribute content by funnel stage, so the lead loop is more closed than before. A/B testing and AI insights support page optimization. There is still no native CTA management or UTM-aware campaign tracking inside the CMS, and conversion attribution needs the separately licensed LDP.

Liferay retains a mature personalization engine: segmentation by behavior, profile attributes, location and custom fields, Experiences per segment on content pages, and personalized dashboards. Segment authoring has moved from DXP (local authoring deprecated in 2026.Q1) to Liferay Data Platform, Liferay's CDP built on Analytics Cloud, which reached GA on 2026-08-19 and adds account attributes from Salesforce, firmographic data from Demandbase, and asset-categorization criteria. Real-time segments now evaluate behavior as it happens. Caveats: real-time segments do not sync to DXP and can only be targeted through the beta Audiences feature, batch segments recalculate every six hours, and workspaces carry usage limits, so self-hosted customers now depend on a SaaS product for the full story.

Liferay provides native A/B testing for content pages, testing headline variants, layouts, and CTAs with statistical significance tracking and winner detection. Tests are managed within the platform and synced automatically with Analytics Cloud for result reporting against bounce rate and click metrics, with winner publishing as the new default. The capability is solid for content-level experimentation but does not extend to full-funnel or server-side feature flagging.

CMP, now GA in 2026.Q3, gives teams calendar and kanban views, task deadlines and parallel approval paths that cut coordination time, and its AI agents can draft content for persona and funnel-stage gaps. AI Assistant helps draft blog posts, knowledge base articles and page layouts. Fragment-based page building allows template cloning and reuse, 2026.Q2 Link Content Fields cut re-entry, and CKEditor 5 is the default editor. Legacy Web Content is in maintenance mode while the object-based CMS takes over, and new page layouts still need developer-built Fragments.

Liferay's API-first architecture enables create-once, publish-everywhere delivery, and the 2026.Q1 headless CMS strengthens this: content is stored as structured, reusable data built on Liferay Objects and consumable on DXP pages, external applications, or any channel via headless APIs. CMP is built for multichannel and multisite management, enabling content distribution to web, mobile apps, and connected devices from a single authoring environment.

Liferay Data Platform (GA 2026-08-19) adds in-product content analytics beyond the old Analytics Cloud view: an Assets dashboard for engagement across web content, documents, media, blogs and custom CMS structures, a Sites dashboard with traffic, page performance and on-site search, and Page Analytics with per-experience metrics, audience composition and navigation paths. The Content Dashboard Performance tab and Page Audit remain in DXP. LDP is a separate subscription and GA4 or Adobe Analytics still connect only through tags with reporting in their own tools, so it stops short of full in-CMS performance dashboards for every customer.

Style Books enforce design tokens (colors, typography, spacing) per site, and Fragment Libraries constrain what marketers can assemble. Design Libraries, new in 2026.Q3, let a corporate team hold approved style books and fragments in one place, connect sites to them and propagate changes, so brand standards are maintained centrally instead of site by site. Guardrails are still enforced through the component palette rather than locked overrides, and marketers can adjust styling within a fragment's configuration options.

Liferay supports Open Graph and Twitter Card metadata per page, enabling proper social preview cards across platforms. There is no native social scheduling, push-to-social workflow, or social media management integration. UGC embeds require custom development. Social proof widgets are not native. Basic OG/meta tag management covers the fundamentals but no social publishing workflow is available.

Liferay Documents and Media provides a functional DAM layer with Asset Libraries for cross-site sharing, image transformations, tagging, metadata, and search. The AI Assistant can generate image alt text and descriptions. Documents and Media moved to maintenance mode in 2026.Q1 with asset management transitioning to the new headless CMS, but existing capabilities remain supported. Rights management and usage tracking are limited compared to dedicated DAM platforms.

Liferay provides multi-language content management, translation workflows with third-party connector support, locale-specific URL management, and per-locale content scheduling. Content can be maintained in multiple languages with approval workflows per locale. However, transcreation-specific workflows (market-level campaign variants, region-specific promo calendars) are not native — generic localization is applied to marketing content rather than purpose-built marketing localization.

MarTech connectivity improved materially in 2026. Liferay Data Platform ships data source connectors for Salesforce (accounts, contacts, leads), Marketo (connector plus event-stream webhook), HubSpot (marketing-event webhook) and Demandbase (anonymous visitor and firmographic data, under an August 2026 partnership), covering CRM, marketing automation and ABM intent. DXP adds the HubSpot Lead Capture connector, Salesforce, SAP and Microsoft 365 connectors, and LDP sync jobs push batch data to third-party endpoints. Ad platform connectors are still absent, LDP sync jobs carry tight daily call limits, and most of these integrations require the separately licensed LDP.

Liferay Commerce provides genuine product content management with catalogs, SKU/variant modeling, product specifications, options, and rich media per product. The 2026 commerce roadmap emphasizes advanced PIM-style catalog tooling, centralized product configuration management at scale, and bulk updates with master configurations. ML-based predictive analytics power personalized product recommendations and order forecasting. B2B-specific features — customer-specific pricing, multi-level account hierarchies, account-gated catalog views — remain strong differentiators.

Liferay Commerce provides category management, product display widgets, ML-powered suggested product groups, personalized recommendations, and smart loyalty score alerts. These are functional for B2B catalog merchandising but search merchandising remains basic and content-driven commerce experiences (e.g., shop-the-look, editorial overlays) still require custom development.

Liferay's commerce strategy is self-contained — Liferay Commerce is the intended path rather than integrating with external platforms. There are no pre-built connectors for Shopify, commercetools, BigCommerce, or Salesforce Commerce Cloud, and integration with these platforms requires custom API development. This is a weakness for composable commerce architectures.

Liferay's integrated CMS and Commerce layer allows combining editorial content with product data on the same page — product display widgets can be embedded within CMS content pages. Buying guides and product-adjacent editorial are achievable. However, shoppable content (inline add-to-cart within editorial), lookbooks, and shop-the-look experiences are not first-class authoring patterns and require custom Fragment development.

Because Liferay Commerce is native to the DXP, checkout pages are standard CMS pages built with the Page Builder. CMS-managed content — trust badges, promotional banners, upsell widgets — can be placed in cart and checkout pages through the same authoring interface. This is a meaningful advantage over headless-only platforms. However, injecting dynamic CMS content into specific transactional flow steps (e.g., post-add modals) without template changes still requires developer work.

Liferay Commerce includes an account portal where customers can view order history, credit limits, and account documentation — providing basic post-purchase content. Smart loyalty score alerts and ML-driven recommendations can surface post-purchase upsell content. However, CMS-managed order confirmation pages, delivery tracking content, product onboarding sequences, and review solicitation workflows triggered by order events are not native capabilities.

B2B commerce content is Liferay's strongest commerce area: customer-specific pricing, multi-level account hierarchies with account-gated catalogs, quote requests, contract pricing, spec sheets and gated documentation. Digital Sales Room reached GA in 2026.Q3, giving sales teams governed, branded deal microsites with per-room access control, shared proposals and documents, and buyer engagement tracking, which extends account-based content into the late-stage B2B sale. Liferay Data Platform adds account lifecycle stages for B2B accounts.

Liferay Commerce uses Elasticsearch for product search with faceted filtering, category-based navigation, related product display, and search landing pages. Search Blueprints allow content managers to customize result ranking and content blending. AI-powered relevance improvements are included. Content-product search blending is possible within the unified CMS+Commerce environment. Synonym management and search analytics are supported.

Liferay Commerce supports promotional pricing, discount rules, and tiered pricing structures. CMS-managed promotional banners and product spotlights can be scheduled through the Page Builder. Personalized promotion targeting based on audience segments and intent signals is available. However, countdown timers, promo code display widgets, and channel-specific promotional content management are not native features and require custom development.

Liferay Commerce supports multiple storefronts with multicurrency and multilingual configurations, enabling region- or brand-specific commerce experiences from a single instance. Shared product catalogs with storefront-specific editorial and pricing are achievable, and 2026 roadmap work on centralized product configuration across multiple channels, order types, and accounts strengthens this pattern. However, storefront-specific editorial governance adds operational complexity and there is no dedicated multi-storefront content management dashboard.

Liferay Commerce supports image galleries, multiple media per product, and video embeds on product pages. The Documents and Media system handles image transforms. However, there is no native 360-degree product viewer, AR/3D model integration, or image hotspot functionality. Advanced visual commerce experiences require third-party integrations or custom development. This reflects Liferay's B2B focus where visual richness is less critical than account management depth.

Liferay Commerce is not designed for marketplace or multi-vendor commerce scenarios. There are no native seller profile management, seller-contributed product descriptions, review aggregation, or content moderation tools for multi-vendor scenarios. Liferay's B2B commerce model assumes a single seller with multiple buyer organizations — not a marketplace model. Implementing marketplace seller content would require extensive custom development.

Liferay Commerce supports multicurrency display, multilingual product descriptions, and locale-specific storefront configurations. Generic localization infrastructure applies to product content. Country-specific pricing rules and multilingual catalog management are supported. However, regulatory content (EU labeling, CA Prop 65), locale-specific promo calendars, and currency-aware editorial content blocks are not purpose-built features — they require configuration and some custom work.

Liferay Analytics Cloud and the Commerce analytics module provide order forecasting, product-level purchase analytics, and ML-driven engagement insights. Content-to-commerce attribution is partially achievable by correlating content engagement data from Analytics Cloud with order data from Commerce. However, direct revenue attribution to content pages, content-assisted conversion paths, and product content performance dashboards are not native — they require custom reporting or BI tool integration.

Access control remains one of Liferay's strongest capabilities, reflecting its portal heritage. Granular resource permissions, organization-based access hierarchies, role-based content visibility, user group management, SSO integration (SAML, OIDC, LDAP), and department/site-level access control are all deeply supported. For intranet scenarios, Liferay's permission model is best-in-class among DXP platforms.

Liferay provides purpose-built knowledge management through the Knowledge Base application (hierarchical articles, versioning, search), Wiki, Message Boards, and strong taxonomy/tagging. Search Blueprints surface relevant knowledge, and AI-powered search improves discovery. Content lifecycle management (review dates, expiry) is available for knowledge articles. For enterprise knowledge management, Liferay remains one of the strongest DXP options.

Employee portal capabilities remain Liferay's strongest use case: AI-driven personalized dashboards, notifications, social features (blogs, message boards, mentions), announcements, workflow-driven approvals, and mobile access. Out-of-the-box connectors for Microsoft 365, Google Drive, Salesforce, and SAP enhance the digital workplace experience. Customer deployments like Toll Global Express and Coach demonstrate frontline-inclusive intranet patterns. LDAP/AD directory integration is mature.

Liferay supports targeted internal communications with announcements, department-level news feeds, role-based audience targeting for content visibility, and alert notifications. Mandatory-read workflows and read-receipt tracking are achievable through the Workflow engine. The platform provides solid internal comms infrastructure for enterprise intranets. Purpose-built features like read receipts and acknowledgment dashboards require workflow configuration rather than being out-of-the-box.

Liferay has a native people directory integrated with the organization hierarchy and user profile system. Employee profiles can include skills, contact information, and organizational position. Organization hierarchy reflects reporting structures. HR system integration (Workday, BambooHR) is possible via API but no pre-built connectors exist. A visual org chart widget is available as a marketplace app but is not in the core platform.

Liferay's Documents and Media provides document versioning, metadata, taxonomy, and workflow-based approval. The Knowledge Base supports policy-style content with versioning and review workflows. Mandatory-acknowledgment flows can be configured through the Workflow engine. Automated content expiry and review reminders require custom workflow configuration. This covers the functional basics of policy management but lacks turnkey SOP tracking and audit trail dashboards.

Liferay's BPM and Workflow engine can automate onboarding content delivery sequences — role-specific task checklists, staged content access, and new-hire notification workflows are achievable. The platform's role-based personalization can surface role-specific onboarding dashboards. However, progressive 30/60/90-day content journeys, LMS-connected learning paths, and HR-triggered new-hire portals require workflow configuration and potentially custom development, rather than being turnkey.

Liferay's Elasticsearch-powered search provides AI-enhanced relevance, faceted filtering, Search Blueprints for customizable ranking, and synonym management. Search covers all Liferay content types natively. Federated search can be extended to index external systems (SharePoint, Confluence) via custom connectors. AI-powered semantic search improvements have been added in recent releases. Search quality for internal content volumes is strong.

Liferay DXP supports mobile delivery through responsive web and headless APIs, with customer deployments (Toll Global Express, Coach) demonstrating frontline mobile intranet patterns. The platform supports push notifications and mobile-optimized layouts. However, a dedicated native Liferay intranet app (comparable to Unily, Staffbase, or Viva Engage) is not part of the core product — mobile access is primarily via responsive web browser or custom-built mobile apps using the headless APIs. Offline support is not native.

Liferay does not have a native LMS or e-learning module. Learning content can be hosted in the platform via Web Content, Knowledge Base, and structured content types. The Workflow engine can track content consumption for basic completion flows. Integration with LMS platforms (Cornerstone, Workday Learning, SAP SuccessFactors Learning) is possible via API but no pre-built connectors exist in the core product. Micro-learning and certification tracking require external LMS.

Liferay has a mature social layer for enterprise intranets: blogs, message boards, comments, reactions, mentions, forums, polls/surveys, idea submission (app), and community spaces (sites) per department or interest group. Peer recognition programs can be built on the platform. Legacy Blogs moved to maintenance mode in 2026.Q1 but remain fully supported, and the new Liferay CMS adds native blog-building on modern fragments and style book tokens. Social features are native and purpose-built for the intranet use case, not bolted-on widgets.

Liferay provides out-of-the-box connectors for Microsoft 365 (including Teams integration), Google Drive, Salesforce, and SAP. Document co-editing via SharePoint/OneDrive integration is supported. Teams notifications and Slack webhooks are achievable. The integration depth provides a meaningful single-pane experience for employees, embedding Office documents and enterprise application content within the intranet. Bot-driven integrations require custom development.

Liferay supports content expiry dates, workflow-based review cycles, and archival states for web content and knowledge base articles. Content ownership assignment and expiry notifications can be configured. Stale content flagging and automated review reminders require workflow configuration rather than being turnkey. The overall lifecycle management is functional for intranet governance but below purpose-built intranet platforms with automatic stale content dashboards.

Liferay Analytics Cloud provides content engagement metrics, visitor behavior tracking, and segment-level analytics applicable to intranet measurement. Page-level view data, engagement heatmaps, and failed search term analysis are available. Department-level content performance segmentation is achievable via Analytics Cloud segments aligned to organization groups. Dedicated intranet adoption dashboards and ROI reporting are not turnkey — they require custom Analytics Cloud dashboard configuration.

Liferay supports multi-tenancy through Virtual Instances (separate users, sites, configurations, database/schema-level data separation, and domains) and Sites for lighter isolation. Cross-tenant administration is available to an Omni Admin while local administrators manage their own instances. Virtual Instances share the same JVM, which limits true physical isolation for strict regulatory requirements. As of 2026.Q1, using multiple domains requires an Enterprise Subscription — a licensing rather than architectural constraint.

Design Libraries (2026.Q3) give Liferay a real central component library: corporate teams create style books and page fragments in a library, connect any number of sites to it, and the library's resources appear in each site's page editor alongside its own. Asset Libraries continue to share content across sites. Limits remain: a library cannot hold fragment compositions, connecting a site does not apply a style book to pages in bulk, and per-brand overrides of a shared style book are not supported, so brand variants still need their own style books.

Liferay's organization hierarchy, site administration model, and role-based permissions provide a functional governance framework. The 2025 IDC MarketScape recognized Liferay for attribute-driven multisite publishing, cascade publishing, visual workflow design, quality gates, and life-cycle automation across content supply chains — confirming governance depth. Virtual Instances enable centralized governance with local variation across regions, brands, or business units. There is still no purpose-built multi-brand governance dashboard.

Multiple brands can share a single Liferay instance, providing infrastructure cost sharing. The 2026.Q1 unified platform (single modular distribution with activation keys replacing separate CE and DXP installations) reduces operational overhead and provides a free tier with quarterly feature releases. However, multiple domains for Virtual Instances now require an Enterprise Subscription, licensing costs still scale with deployment size, and each brand requires independent theme development and content operations.

Style Books provide per-site design token configurations (colors, typography, spacing) enabling genuine per-brand visual identity on a shared component foundation. Each site can have its own Style Book assignment, and Fragment Libraries can be brand-filtered. This supports per-brand theming at the platform level while sharing the underlying component structure. Custom theme development is still required for full brand differentiation beyond Style Book tokens.

Liferay supports per-brand localization through site-level language configurations, translation workflows with approval chains, and locale-specific content scheduling. However, brand-aware translation approval (where Brand A's French team approves translations independently of Brand B's French team) requires careful Workflow configuration per site — it is not a turnkey brand-x-locale governance model. Regional legal content governance per brand requires custom workflow design.

Liferay Analytics Cloud can be configured to aggregate data across sites (brands) within a single DXP instance, providing per-site and comparative engagement metrics. Publishing cadence and content velocity can be monitored per site. However, there is no executive portfolio dashboard that presents brand-level performance side-by-side out of the box — cross-brand aggregation requires custom Analytics Cloud segment and workspace configuration.

Liferay's visual Workflow Designer allows independently configured approval chains per site (brand), enabling brand teams to manage their own publishing workflow while central administrators retain audit oversight. Workflow instances can be scoped to specific sites and content types. Central workflow audit logs are available at the system level. Per-brand workflow autonomy with central auditability is a genuine capability.

Liferay supports cascade publishing and attribute-driven multisite publishing — recognized by IDC MarketScape 2025 as key strengths. Asset Libraries enable corporate-level content shared across brand sites with site-level override capability. Content can be pushed from a master site to child brand sites with controlled local adaptation. This covers the core corporate-to-brand syndication pattern, though the override granularity per content element is limited.

Liferay provides per-site compliance configurations — cookie consent management, GDPR features, and accessibility settings can be configured per Virtual Instance or site. Virtual Instances separate data at the schema level, supporting regional and business-specific regulatory compliance. Publishing guardrails (e.g., preventing GDPR-non-compliant publishing) are achievable via Workflow quality gates. Data residency is configurable in Liferay Cloud deployments. However, turnkey per-brand/region compliance rules with automated publishing guardrails are not a native self-service feature.

Design Libraries (2026.Q3) make the design system centrally maintained: style books and fragments live in a library, publishing a library style book change reaches every page using it, and fragment changes can be propagated to connected sites from View Site Usages. Design Packs package approved assets for local teams. Brands can extend the central token set with their own site style books. Version governance is still thin: library style book changes go live without staging or per-site override, each placed fragment holds its own copy until propagated, and there is no version pinning per brand.

Liferay's Virtual Instance and Organization hierarchy enable central admin management of all brands with autonomous brand-level team administration. The Omni Admin can manage all Virtual Instances from a single control plane while local administrators oversee users, sites, and content for their own portals. SSO (SAML, OIDC) operates across all instances. The model effectively provides central governance with delegated brand autonomy.

Liferay's Web Content Structures can be shared across sites, providing a base content model usable by multiple brands, and the object-based headless CMS (GA 2026.Q1) stores content as structured, reusable data. The 2026.Q2 Link Content Fields add relational modeling — an entry (author, category, location) is maintained once and referenced across brands rather than duplicated — improving shared-model reuse. Site-specific structure variations allow some per-brand customization. However, extending a shared base model per brand without forking (e.g., Brand A adds a video field independently of Brand B) is still not natively supported — model changes typically require forking the base structure.

Liferay does not provide an out-of-the-box executive portfolio reporting dashboard spanning multiple brands/sites. Content freshness by brand, publishing SLA adherence, and cost allocation per tenant are not native reporting dimensions. Analytics Cloud provides per-site engagement data but requires custom configuration to aggregate into portfolio-level executive views. Operational reporting across the brand portfolio requires custom BI tool integration (Tableau, Power BI).

DPA applies by default to cloud customers in EEA, UK, Latin America, and Mexico, with SCCs implemented for cross-border transfers; other customers can request it. Liferay publishes a detailed sub-processor table (entities, locations, functions, transfer mechanisms) with 10 days' notice before new appointments. EU residency via Frankfurt and Hamina (Finland), UK via London, plus a built-in Personal Data Erasure dashboard. Meets the 80 threshold for DPA + EU residency + SCCs + public sub-processor list; not higher without additional EU-specific attestations.

Liferay's Trust Center lists HIPAA readiness alongside ISO 27001/27017/27018, SOC 2 Type 2, and CSA STAR Level 2, and the healthcare industry page documents Business Associate Agreement capability under HIPAA with SaaS, PaaS, or self-hosted options for PHI control. HIPAA has no formal platform certification program, so this rests on BAA availability plus documented healthcare deployments. Not 70+ because BAA terms and plan eligibility remain a case-by-case offer rather than a published self-service legal document.

GDPR built-in with DPA and erasure tooling; CCPA via DPA; LGPD coverage implied by default DPA application to Latin America plus São Paulo hosting; Spain's Esquema Nacional de Seguridad (ENS) listed on the Trust Center. The new ATO FastTrack initiative (launched Sept 4, 2026) adds a documented US-government readiness path — an authorization-ready low-code platform with Zero Trust controls, plus FIPS 140-3 readiness and OSCAL-based documentation coming by end of 2026. Not higher because ATO FastTrack is a path to agency ATO, not a FedRAMP authorization Liferay itself holds, and no IRAP/C5/HITRUST exists.

Current SOC 2 Type 2 attestation, independently verified annually since 2019, covering Liferay PaaS, SaaS, Analytics Cloud, and Managed Services. Reports available to customers upon request, and the DPA allows a recent SOC report to substitute for customer audits. Not 85+ because the specific Trust Service Criteria covered beyond Security are still not publicly documented.

Liferay holds ISO/IEC 27001:2022 (certificate ISMS-LS-5319) with scope covering development, operations, maintenance, and delivery of the DXP and Cloud Services Platform — platform scope, not just infrastructure. Also certified ISO/IEC 27017:2015 and ISO/IEC 27018:2019 for cloud PII processing, audited by A-LIGN. Meets the 80+ threshold for platform-scope ISO 27001 plus ISO 27018.

Portfolio now adds ISO/IEC 42001 (AI Management System, certified Dec 2025 — among the first companies globally), a meaningful current attestation, on top of CSA STAR Level 1 (CAIQ) and Level 2, CSA Trusted Cloud Provider, Spain ENS, and ISO 27017. ATO FastTrack signals FIPS 140-3 readiness in progress for 2026. Still no PCI DSS, FedRAMP authorization, or Cyber Essentials Plus, which caps the score below 78.

Liferay Cloud now lists 15 PaaS regions across the US (Oregon, Iowa), Canada (Montreal), Brazil (São Paulo), the UK (London), the EU (Frankfurt, Hamina), Switzerland (Zurich), the Middle East (Doha, Dammam), India (Mumbai, Delhi), Japan (Tokyo, Osaka) and Australia (Sydney), plus SaaS data centers in North America, Brazil, the EU, Saudi Arabia, Japan and Australia. Environments can be placed independently, backups stay in the instance's data region, and self-hosted DXP gives full residency control. Not higher because Mumbai and Sydney need special approval for new PaaS projects and SaaS region choice is coarser than PaaS.

Post-termination retention is documented: customers have 14 days to retrieve data after subscription end, with permanent deletion 30 days after termination; Analytics Cloud retention defaults to 13 months and is configurable. Built-in Personal Data Erasure dashboard provides self-service right-to-erasure with APIs for third-party integration, plus data portability export. Meets the 75+ threshold for self-service export + documented retention + API-based erasure.

Comprehensive audit framework captures logins, password and entitlement changes, group membership, and content operations, with output in CSV or JSON. Native SIEM integration via Splunk, ELK stack, Syslog audit message processor, and CloudAMQP; ATO FastTrack reinforces continuous monitoring within a Zero Trust posture. DPA additionally grants customer audit rights with documentation support. Meets 75+ for comprehensive logs with native SIEM integration.

Liferay publishes a current 'DXP Admin Experience Accessibility Conformance Report' (VPAT 2.5Rev, dated Nov 29 2025 for the 2025.Q4 release) — formal conformance documentation specifically for the authoring/admin interface, now covering WCAG 2.x, Revised Section 508, and EN 301 549. Conformance evaluated with automated static analysis plus manual testing using screen readers, magnifiers, and speech recognition. Exceeds the 70 threshold given current, authoring-specific, multi-standard formal documentation.

Current VPAT-based ACRs are publicly downloadable for procurement: December 2025 Admin Experience and Sites Experience reports (VPAT 2.5Rev), covering WCAG 2.x, Section 508, and EN 301 549. A dedicated accessibility compliance page is maintained. Meets 70+ for current, public, multi-standard VPAT/ACR availability; not higher because ATAG 2.0 assessment is still not documented.

AI Hub (GA in the 2026.Q3 release) ships writing tasks in Liferay CMS (Change Tone, Improve Writing, fix grammar, summarize) and built-in Generate Content and Generate Field Value agents that draft entries or fill single fields, while AI Creator still offers OpenAI generation in the Web Content editor. New since the last review: documented AI Hub Instructions apply reusable tone, brand voice and policy guidance to every agent in scope (including CMS requests), giving real brand controls. Held below 70 because brand voice is prompt-level guidance rather than enforced checking, and bulk generation is not documented.

AI Hub's built-in Generate Image agent creates images from a description in the Files section's New menu or straight from a File field, and agent workflows can call the L_IMAGE_GENERATION tool from an LLM node; AI Creator's DALL-E path into the DAM and auto-tagging at ingest remain. No automated alt-text generation, smart cropping or AI video processing is documented, keeping this mid-band.

Bulk machine translation via Google Cloud Translation and Amazon Translate is built into the localization workflow, and AI Hub (GA, 2026.Q3) translates content in the editor into any language the instance offers, with custom translation agents built by duplicating the built-in one; instructions can carry brand voice into those agents. No translation quality scoring is documented, so this stays below the 70 band.

AI Hub's Auto Categorize and Generate Tags agents suggest categories and tags drawn from the asset's existing vocabularies for editor review, on top of GA auto-tagging via OpenNLP, Google Cloud and Microsoft Cognitive Services and the PageSpeed-based Page Audit Tool. SEO titles, meta descriptions and alt text are still authored by hand, with no AI generation of SEO copy or schema suggestions documented, capping this at partial automation.

Editorial AI now spans several shipping assists: auto-tagging, category and tag suggestions, built-in content drafting and field filling, in-editor translation, writing tasks, and an AI Assistant chat supervisor that coordinates these tasks with DXP search context, all GA with AI Hub in 2026.Q3. Reaches the 60 band for breadth; held there because smart scheduling, duplicate detection and lifecycle automation are not offered as built-in features.

Liferay AI Hub is GA as of the 2026.Q3 release (public beta from June 3, 2026): agents are built as Liferay workflows in the Workflow Designer with LLM, AI Decision (model-chosen branching), HTTP Request, Service and AI Hub Agent nodes, so multi-agent chains run end-to-end and DXP workflows can call agents. Because agent logic is a standard Liferay workflow, the usual Task and Condition nodes are available for human approval steps. Held below 80 because the Activate plan caps custom agents at five, data sources are website crawls only, and the GA is new.

Beyond AI Insights behaviour recommendations and the Content Dashboard, Liferay's Content Marketing Platform (GA September 2026) adds a persona by funnel-stage Coverage Matrix with AI gap agents, and AI Hub ships a gap-search delegate, so AI content gap analysis now exists. Held below 60 because CMP needs a separate license and a feature flag, and there is no built-in content health, stale-content or ROI scoring dashboard.

The Page Audit Tool surfaces SEO and accessibility issues via Google PageSpeed Insights, which is rule-based rather than AI-native, and AI Hub agents with AI Decision nodes can be assembled into DIY review flows. AI Hub guardrails screen agent inputs and outputs, not published content. No AI quality scoring, brand voice compliance checking or duplicate and thin content detection across a site is documented, keeping this near the band floor.

Liferay Enterprise Search ships production semantic search — text embeddings stored in Elasticsearch via txtai or Hugging Face providers with cosine/dot-product similarity — and the 2026.Q1 LTS native Elasticsearch 8 connector adds Reciprocal Rank Fusion (RRF) hybrid keyword+vector search. Held below 65 because semantic search remains an LES paid add-on rather than base-DXP functionality.

Content and product recommendations driven by role, history and behaviour are GA, and AI Insights adds ML-based layout suggestions. Liferay Data Platform (GA August 19, 2026) builds segments, but real-time segments reach DXP only through the beta Audiences feature, so segment execution on the site is still largely rule-driven. No cold-start handling or personalization performance analytics is documented, keeping this in the AI-assisted band.

Liferay DXP 2026.Q3 moves the official MCP server at /o/mcp onto a release feature flag (LPD-63311), out of beta. It accepts basic auth and OAuth 2.0 bearer tokens, works across clustered nodes without sticky sessions, acts with the authenticated user's permissions, and supports read and write operations on objects, workflows, content and commerce data, with documented setup for Copilot, Cursor and Claude. Held below 75 because it is off by default per virtual instance and is newly out of beta.

AI Creator is true BYOK but only for OpenAI, set per instance or per site. AI Hub's GA note calls it LLM-agnostic, able to use 'any AI model accessible through the Model Context Protocol', yet the AI Hub docs show no model or API key setting on LLM nodes, and AI Hub meters model calls, safety checks and embeddings in prepaid Liferay Tokens, which points to Liferay-run models. Lowered from 72 because multi-provider key control is now documented only for the legacy tool, and no data residency controls for inference are shown.

AI Hub agent workflows add a RAG content retriever on LLM nodes that searches the connected DXP instance as the signed-in user and can be narrowed to a Search Blueprint, an HTTP Request node for REST and client extensions, and an AI Hub Agent node that lets DXP workflows call agents. These sit alongside the MCP server (now on a release flag with OAuth 2.0) and the full headless REST APIs. Held below 70 because there is no first-party AI SDK or official LangChain or LlamaIndex guide, and the HTTP node cannot call external APIs that need their own key.

AI Hub now documents a real governance layer: reusable Instructions for tone, brand voice and policy, scoped to CMS or chat; mandatory Liferay-managed instructions covering AI transparency, data minimization, PII non-generation and EU AI Act prohibited practices; and per-agent input and output guardrails run through Google Cloud Model Armor (prompt injection and jailbreak, malicious URIs, sensitive data, harmful output). Agents act with their users' permissions, with per-agent permission restrictions, under ISO/IEC 42001. Held below 75 because there is no hallucination detection or IP indemnification, and AI Hub roles are still being refined in beta.

AI Hub meters every operation (model calls, agent execution steps, content-safety checks, embeddings) in Liferay Tokens bought in prepaid 5K to 200K blocks at locked conversion rates. The Activity page shows the remaining balance alongside agent and chatbot counts, consumption stops hard at zero, and concurrency caps are documented. That gives basic cost visibility; held at 50 because there are no per-user or per-team consumption metrics, prompt effectiveness analytics or quality trends.