If you want to know everything you need to know about Drupal, have a peek at the community discussion around sitemaps. There are genuine reasons behind the complexity, but a CMS that cannot generate a list of its own URLs, leaving thousands of people baffled, is quite an achievement.
Drupal has been absolute mess for maintenance, backwards compatibility, responsive ness (code/dev wise).
People started flocking more to WP and Drupal docs weren't just up to date as people were moving away.
Nothing will change my mine over Drupal at this point still especiallyin this day and age. Better create one yourself or mod WP.
---
Whatever the post says about it's "light-years ahead" sounds like a tiktok influencer talk.
I completely understand how people got burnt. The move forward was less about bringing users, site builders, and developers along for the journey and more about providing what enterprise needs.
And one of the enterprises that was front and center was Acquia, Dries' organisation that he set up to offer consultancy services based on Drupal.
Having said all that, it is genuinely a very good product now, and one that LLMs are incredibly good at building with.
The high level of documentation, convention over configuration, and the API-driven nature of Drupal lend themselves very well to LLM assistance.
Considering just how awful WordPress is in terms of security, community, cohesion, code quality and maintainability. I think it's a crying shame that Drupal has lost so much goodwill.
I'm not sure what the solution is, but I'd recommend anyone reading gives it a try with Codex or Claude code, and you'll hopefully see what I mean.
Drupal needs to market how well it can people make $ or at least save. ROI is a good KPI to bring up, if the team has data to back it up, etc.
Saying that Drupal is better than it has ever been is not much of a statement. It still isnt as easily extensible due to having a smaller community of contributors as an after effect of mismanagement.
I hope they have improved, but their reputation has been earned repeatedly.
Easier in terms of effort and time, but it still costs, and it still adds drag.
The fact that I can do housekeeping much more easily with agents doesn’t make me want to do more of it. The whole point is to free up my time, energy, and thinking for things that are more worthwhile, interesting, and value-adding. That’s my mentality both at home and at work.
If you’re building a framework or a library, whether open source or commercial, and you think agentic and AI native development gives you more license for breaking changes and churn because your users can just fix it up with their agents, then I’m afraid I’ve got some bad news for you because that blade cuts on both sides.
If you can keep churning and breaking stuff, then I can get fed up, drop your shit like a hot rock, and build it myself. And I will.
I’ve just rebuilt my personal site from scratch after getting cheesed off with the framework I used and it didn’t take very long. What’s actually taken longer is making all the improvements I would have liked to make but were too much hassle before, so one needs to relearn shipping discipline, but that’s OK.
Same goes at work. Even major stack changes, like migrating database engine, are so much easier. Yes, you still need to be methodical and disciplined - in fact I’d argue agents make that more important than ever in many enterprise contexts - but it is still so much easier. I’m seeing projects left and right that in the old world would have taken weeks or months executed in days or weeks. It’s wild times.
i.e. why read a book written by a human when an agent can write one? Why buy a painting that could have been printed.
One of the benefits of open-source and frameworks is they're made up of battle-tested decisions by a lot of people with real skin in the game for a long time. Yes an agent will often solve your problem, and will solve it correctly - as asked, but often a better answer is found by stepping back, evaluating the fundamentals, checking other perspectives, challenging assumptions, and having an opinion.
I'd rather point the agent at and authentication gem and tell it to use that, vs telling it "build authentication, make no mistakes".
But he never mentioned PHP again which was just fine with me.
In trust situations we have a sort of unspoken concept of Original Sin. Essentially once someone has made a security blunder of epic proportions, we can not trust that this is an isolated incident instead of a pervasive one. If The Rot Starts at the Head is true, then how can any amount of rework ever make you trust the thing again?
I looked at the security patch that Drupal applied, and I’m no PHP reader but I was sure I found the same antipattern in two other places in the code that were not patched. I only looked for an hour. There have been years and years of low effort CERT advisories since. From a user standpoint, if you’re not deep into Sunk Cost, this looks like throwing good money after bad. Only rationalization ever makes it seem like a good deal.
It's a situation entirely inline with Drupal's reputation: they couldn't just get it right, and now serious Drupal teams don't know which way to go in the ecosystem.
I don't see how Drupal or anything like it survive. These types of softwares seem fitted to 2006, not 2026.
That isn't needed anymore. One person can maintain an entirely in-house solution and easily make changes and adaptations.
Drupal is used at large organizations with hundreds of sites, thousands of users, and multiple more-or-less coordinated development teams. It's actually a great target for agentic coding, because it has such a well-established internal API. It can definitely feel like an anachronism, but I think there are few projects that could replace some of it's use cases. It's the B-52 of CMSs.
I reckon AI must be much better now at this since it's doing all sorts of things, but I wonder if you still would need to have the repo cloned so that it can crosscheck with the source code. Since the knowledge cutoff should be around 2025, most of the stuff it knows should be plenty
If I'm thinking of building a single one off site, then yeah I'd probably opt to just let CC handle it without worrying about a framework which is overengineered for my current need. That's what I do with most of the personal projects I work on these days. But I do have a skill to build consistency around the parts that should be consistent for everything I host. Like package shape and types of hooks available for deployment. How sites are publicly exposed and DNS management.
Sadly none of this applies to me, so I wonder whether it makes a good argument when my question is "should I use Drupal for my personal hobby website".
Once you find you do have a need for something more complex (i.e. you have a team, want to give agents governed access etc), then it's pretty easy to go from a flat file to something more complex.
PHP is, in fact, exceptionally good as a language for creating websites.
But that rewriting the base system, every couple of years, was why I dropped it.
Nowadays, with LLMs, it may be time to look at it again...
To be fair, they did it once, from v7 to v8. But yeah, a major release does break APIs. I'm concerned with how Drupal Canvas is bolted on, but it looks like it's basically a content editor UI that is separate from the site admin UI, which is a good idea.
Also, there were a whole plethora of extensions (not just "plugins"). Some of those broke, while others, did not.
Can't answer the specifically "Drupal" part (as for me I once had a certain pressure behind me to use it, found it atrocious at the time and won't look to repeat that; if their software is much better / much more to my taste now, good on them). But in principle, at least from a certain app size upwards, I'd rather start with something working in principle, then improve on it.
That said, it might still be more difficult to get things right with Drupal than with some other softwares where you have better continuity between versions. At least traditional search engine results tend to handle version changes rather poorly meaning you'll get tons of advice that don't really apply anymore because they're years old. That happened a lot to me when trying to help out a friend with a WordPress installation.
This probably changed somewhere down the line, but I genuinely believe the most significant factor in Wordpress becoming the dominant CMS is that, in the beginning, for a long time, it wasn't trying to be a CMS, just a blog engine.
The Drupal core team is moving really fast to improve its reputation, and I think a lot of the changes are good. The AI integration is pretty solid, and the Symfony framework is solid and easy to build on. I think the move to Canvas is misguided and from inside the community I can tell you that not everyone is on board, but it is nice that both paths are possible.
As many here have said: If you have large teams that manage large amounts of content, Drupal is really the only option. If you're making one-off sites or "brochure sites," then vibe-coding them is just as good as anything, but I don't think that's ever been Drupal's core concern.
Also, what an amazing day to pick to talk about anything PHP.
Drupal CMS is what a lot of people suggest for new folks, but it isn't explained what it is on the Drupal website. It's apparently a set of pre-configured extensions, templates, AI, and settings. Drupal has a version on their site to download but it says it's a "trial" and requires registration to get it, further increasing friction: https://new.drupal.org/drupal-cms/trial#:~:text=start%20your...
Once you do get it, it may or may not work. When I last tried the Windows version, it didn't work and just gave the old Drupal white screen of death in the browser.
When I've seen discussions in the Drupal sub-reddit, most of the recommendations on how to do something seem to be some version of 'have Claude do it for you'. And the Drupal homepage is very AI forward and mentions AI 9 times.
Drupal's largest install base was back in the Drupal 7 days, which was the last major version that supported upgrading in place from the previous versions. Major compatibility changes started with 8 and continued. About 1/2 the sites that used to run Drupal 7 migrated to WordPress rather than upgrade. Today, there are about the same number of sites running Drupal 7 as the current Drupal 11, which speaks volumes.
As someone that still uses a paid, extended-support version of Drupal 7 and is likely switching my big legacy site to Backdrop CMS (actively maintained Drupal 7 fork) and my other two sites to another CMS, it doesn't seem like there's a place for folks like me in the current world of Drupal.
This isn't correct. Yes it was true from Drupal 7 to 8, but one of the primary goals of that change was so that every major version after could have seamless in-place upgrades - which they have. Yes there's deprecated code etc. that you might run into in contrib. or custom modules, but the site upgrades themselves are easier than ever.
From all my reading in the Drupal subreddit, modern Drupal isn't especially useful for real world scenarios without a bunch of contributed modules and stuff... hence Drupal CMS. Additionally, folks were recommending not using Drupal 11 until it had been out for well more than a year due to the sad state of contributed module upgrades. I'd wager this is due to the much smaller Drupal community than the version 7 highs.
The churn stopped after D8 - upgrades from D8 -> D9 -> D10 have all been painless with no major overhauls to the API. The template system, the granular caching infrastructure, namespacing, package management, Symfony core, are good.
It's a solid framework to build on without having to reinvent the CMS wheel.
I think CMSes and websites are where that is most applicable. You no longer need these generalized abstractions and can now make your interfaces and data types just perfectly match your use case with little effort.
We went through great pains to build these mammoth, one-size fits all applications like Drupal and Wordpress for running dynamic sites across industries and companies with very little in common.
These days, I love to stay close to the model and stay close to the metal.
That seems more like an implementation opinion vs. a core property.
Agree that it was a pain to keep up with sometimes, but if software doesn't evolve over a 25 year timespan - it's likely going to be stuck in the past.
The reason Drupal can do what it does today is because of this willingness to rebuild - otherwise it'd just be a CMS that solves problems from the early 2000s.
Remember a while back when the world first heard about Mythos because there was a mismatch between what the "CMS" said was publish, what was shown on the site, and what was "really" available? Those types of problems haven't gone away and if anything are more critical when an army of agents will seek out and find any but of information they can get their hands on.
Why Drupal rather than another of the many CMS's and frameworks that exist?
I'd recommend Drupal specifically when you have the need for strong governed management of users + content + workflow and you want something that is battle tested without having to make all the decisions that get you there.
There's an old issue in the Drupal queues that I really like that exemplifies this: https://www.drupal.org/project/drupal/issues/174940
This one goes back 19+ years and has to do with 404s when a visitor looks for favicon but doesn't fully follow the standard of where that file could be. It happened with ie6 back then, and happens with some agents and services today. The easy fix is to put a favicon in the root, but that's a bandaid that runs into a bunch of edge case issues when creating a platform or doing something non-standard. Suppressing the error message is another option, but there's a performance and delivery cost into how that's done. If you ask a frontier model today how to fix this on your site, you'll likely get the easy "simple" answer.
Long way of saying, Drupal is an accumulation of battle tested decisions from a bunch of smart people over a long period of time - and if your need matches the usual intent of Drupal - users + content + delivery + rules around that - then that's a strong reason to explore it for your use case.
Other than that, familiarity is really the best selling point.
Until you define the project, you can't talk about what stack to use.
It succeeded to do what Drupal tried but never managed to do:
It is both extremely stable and extremely flexible at the same time.
By having an extremely generic and small core, combined with an extremely powerful programmatic API (basically jquery for data from the CMS, but better), you don't need fiftyeleven modules to achieve some basic tasks.
[1] https://processwire.com (don't get put off by the .com. It is open source).
It' reputation is earned.
A fresh web stack with a traditional (non-EAV) db schema and proper programming layers is a much better DX, I'd say. All very doable with LLM-assisted coding.
Maybe soon I can set my agents on it
It's time to abandon PHP and C-based software (i.e. PHP). The clock's ticking.
Meanwhile, there are different threat models to any type of web application, it's just that PHP has repeatedly failed us in any threat model, same as C in most threat models that don't involve compiling it to WASM or running it air-gapped.
Leaving memory unsafe runtimes and interpreters directly available to public web traffic is a liability I don't want for me and users don't deserve to face the consequences of it whenever they are trusting you with their data. Rust and Golang even with all of their design issues should be the baseline for internet facing software nowadays.
As for the Linux kernel, everything I run on it is inside a VM (or a microVM) instead of relying on containers exclusively, because I can't trust a C kernel to not have vulnerabilities.
Funnily enough, regarding SoftTalker's point, just a few hours after my original comment, CVE-2026-110264 (a CVSS 10.0... worse than PHP's RCE) rolled in for GitLab, which would be prevented by using a memory safe language to write the interpreter instead of C.
After evaluating the landscape, my take was that the project was a waste of time and wouldn’t benefit the company. But a large consultancy was involved, so we had to pick a CMS. We picked Drupal. The result was exactly what management wanted: a single CMS, well-defined taxonomies, and all the content in one place.
Unsurprisingly, the writers hated it. They’d been forced to give up specialized tools for something half-baked that mostly did the same things.
The development experience was atrocious. Scaling was difficult, rolling upgrades and deployments without downtime were nearly impossible, and we constantly ran into bugs and limitations in the existing plugins. We had to bring in Drupal consultants at $300 an hour to get the project over the finish line, but we eventually did. All we ended up using was the admin interface and a GraphQL API, which the company’s products then had to be rebuilt around.
Management wanted everything hosted by Acquia, so we ended up paying $100,000 a year for a few servers that would have cost, at worst, a few hundred bucks a year on Hetzner.
By the original requirements, the project was a success. We managed to move all the traffic over without any downtime. Shortly afterward, I left the company because of how miserable the project had made me.
A few days ago, out of curiosity, I checked whether they were still using Drupal. It turns out management hadn’t learned from its past mistakes: they’d migrated to yet another CMS, even though it was obvious non-management the problem was the business model not the CMS. What of waste of time and money.
Ok. As someone who hasn't shipped a Drupal site since halfway through the D8 cycle: is this better or worse than the tumor that is Gutenberg?
It feels dated. Even the "new" designs they're rolling out still feel old. They're working with a dated design system, and honestly, it feels like they had developers build it without bringing actual designers into the process. The result is always functional, but somehow a little awkward. Not unified. There's still like 3-4 different ways to do the same sorts of actions depending on where you are. It's clumsy. It's Drupal!
And true to its roots, Drupal still requires way too many third-party modules to get a build working the way I want. Half of those don't even have the "new" design system applied. So even for a CMS that cares about WCAG, they're still falling short. I'm not sure they'll ever get all the open-source developers on the same page. (I know they have a stated goal of 2027... I don't see it happening.)
More broadly, I don't have much confidence that Drupal modules will be maintained beyond a version or two. That makes anything you build on top of them inherently disposable. Which is fine; a lot of the web is disposable. But it also means I don't want to take ownership of long-term maintenance for projects built on Drupal.
Every time I have to install a third-party module in Drupal, I cringe a little. I know that two or three years down the road, when a new major version comes out, I'll be hunting down the guy who wrote the module, hoping he'll update it. Otherwise, we're forking his repo and taking responsibility for maintaining it and applying security patches ourselves. Cringe.
Meanwhile, I've really enjoyed working with Contentful, Directus, and even Statamic. There are a lot of great CMS options out there these days.
One platform I'd actively warn people away from, though, is Strapi. I've had two false starts with projects where people wanted to use it, only to run into some fundamental flaws.
Like, "Oh, you want to associate one of your 10,000 files with this page? Sure, we'll put them all in a dropdown for you to sift through... and that'll make pages take 2 minutes to load." Cringe. Run. (Ha, wait... and the whole, "We are in France, so we don't answer support emails in August." Literally what their support email told me. Yikes.)
In the last five years, Strapi is the only CMS I've built with that I just couldn't get behind on any level. I would have rather used Drupal for those projects. Ha!
We've been hearing this for years. On the Drupal site, it says it's a trial and makes you register to download it. Last time I downloaded the Windows package, it gave a Drupal white screen of death. I'm not planning on registering again to try it again. Nor do I want to use AI to install and manage my CMS.
What came after was such a different beast it should have just been its own thing.
If you disagree with the sentiment, it'd be interesting to here why - that's the sort of information that's extremely useful for makers.
There isn't a day I don't ask Claude "What would Drupal do?"
I would not be surprised if approaching vibe engineering from the Drupal perspective is the way out of AI slop.
Nonetheless, although I had a blast one evening building custom modules using Claude wishing I had this tool during those hours of stress I suffered 15 years ago, I don't think there is a place for Drupal outside of higher educations marketing.
Let's revisit the statement in a year :)
My gut is we're seeing the exact opposite. The scale of publishing + users + need for governance is exploding.
From a site building perspective:
The problems agents bring to the table are the same problems that UGC brought to the table - new scale, untrusted users, an increased need for governance.
From a user experience perspective:
You can't ever really know if it's a human, an agent, a human driving an agent, or an agent driving a human - so stick to information architecture and accessibility best practices.
beyond that though, we're in new territory when it comes to change / scale / security / etc, so if there is a strategy it'll be out of date tomorrow.
Is it just the last remaining pockets of "that kind" of web dev?
We're finding that this is becoming even more critical when users are using agents and the scale of changes / publishing increases. Pair that with things like AI regulations that require records of human providence etc, and a CMS becomes even more important.
The benefits are massive ranging from better versioning, free choice of any tools under the sun, strict access control far away from people who don't even understand text encoding, clean CDN deployments, complete elimination of clunky SSR and its footguns, more precise control of the web server configuration, etc.
It's very rare nowadays to see any web devs who don't know the "full stack" from bare Apache/Nginx up to React (or even writing the exact necessary modern plain HTML/CSS/JS). That's why I distinguished the devs who prefer a CMS as "that kind of web dev".
This shift happened in the mid-2010s and I don't know anyone who ever looked back unless they're stuck slow-maintaining something older from before that point in time.
Licensing a CMS now seems like a pointless middleman cost for a subpar product from a time before we had good web standards that were well understood and supported. Every CMS sales pitch seems to be aimed squarely at middle management fearmongering for the most trivial and basic stuff any web dev already knows how to do a lot more efficiently and reliably without a CMS. All devs I see now have experience with these standards using more modern tools at large scale and with the full SDLC and business requirements in mind for over a decade.
For many implementations though, requiring a dev to make the changes is the failure state.
I love static builds and use them all the time when they're the right fit for the project, but in many cases they are not. I'm also finding that I'm starting to lean towards a CMS more even when it's "just me", but I have a team of agents. i.e. I want the ability to have a voice conversation with a dot / grok bot / etc. and have it update content without it having the ability to do dev type things.
And fortunately those of us in tech, the amount of software in the world is exploding so all those lanes are getting bigger, even within their niche.
citation needed. Pretty much every single React/JS front end dev I've dealt with, doesn't know, understand, or care about the web server aspect itself "Not my problem".
You mean the kind of development that powers nearly the entire web?
I know it's becoming more and more outdated nowadays, but if a magazine or a news website is still written by humans rather than AI they need a way to provide formatted text and media, and preview the output.
On the other hand I should add that i've also seen an upward growth in CMSes like WordPress being used exclusively as Online Editors, with content ultimately being exported trough REST to completely different backends and frontends, like a Firebase/NextJS infra.
Separating delivery from content management also reinforces this. Set up a governed content / user workflow and then let an agent focus on just the presentation after pulling in the content. I'd say this extends well beyond rest as well. A user interacting with something like a voice assistant in an agent might actually be using many interfaces at once (mcp from the assistant, HTML in a card, WebMCP alongside the HTML, browser open on another device for the human.) When that happens you want one canoninical system for the content.