# Drupal CMS vs Drupal: What Actually Changed? > The Drupal Association now ships a product called Drupal CMS alongside the Drupal everyone knows. Buyers searching for the difference find two names, one logo and no clear answer. Analyst Editorial by DXP Principal Analyst Group · Published 2026-10-31 · Not updated Source: https://www.dxpscorecard.com/editorials/drupal-cms-vs-drupal ## The short answer Drupal CMS is not a new CMS. It is Drupal 11 packaged by the Drupal Association with the Canvas page builder, site templates and SEO, forms and AI tooling preinstalled, so a marketer can launch a site in an afternoon. The database, module ecosystem, hosting bill and upgrade calendar are identical. Start from Drupal CMS for a content or marketing site, from plain Drupal when developers design the platform, and from Acquia when procurement needs a vendor. ## Key takeaways - Drupal CMS is a distribution of Drupal core, not a fork. It runs the same Drupal 11 engine, the same database and the same catalog of more than 50,000 modules. The product is the set of choices the Drupal Association made for you before the installer finished. - What changed is the first day. Drupal CMS 2.0, released on 28 January 2026, made Canvas the default editor, added site templates for marketing, education, government and nonprofit sites, and bundled recipes for SEO, forms, analytics, accessibility and bring-your-own-model AI. A free desktop Launcher runs the whole thing locally with no setup. - What did not change is every day after that. You still host it, patch it and upgrade it through Composer, security advisories still arrive across the bundled modules, there is still no vendor SLA, and SOC 2 or ISO 27001 still come from your host, never from the software. - The naming is the real source of confusion. Drupal 11 is the engine, Drupal CMS 2.x is the product built on it, and Acquia is the commercial company that sells managed Drupal with the compliance paperwork attached. Three things, one word, and vendors and agencies use all three loosely. - The choice is about who builds the first page and who runs the site afterwards. If a content team should launch and edit without a developer, Drupal CMS is the right starting point. If developers are designing a bespoke, commerce, intranet or decoupled build, plain Drupal gives them a blank slate without undoing preset choices. ## Our analysts' take For most of its twenty-five years, Drupal has been a framework that called itself a CMS. A fresh install gave you a login screen, a handful of content types and the expectation that a developer would spend the next several weeks choosing, installing and configuring modules before a marketer saw anything useful. Agencies loved it for that reason. Marketing teams, increasingly, did not, and the share of new sites choosing Drupal over WordPress or a hosted builder slid for a decade. In May 2024 the project's founder announced an initiative called Starshot to fix the first hour, and in January 2025 the result shipped under a new name: Drupal CMS. A year later, on 28 January 2026, Drupal CMS 2.0 arrived with the Canvas visual builder as the default editor, and the two names have been colliding in search results ever since. The collision is understandable. The product is called Drupal CMS, the engine underneath it is Drupal, the installer offers templates that look like a different product, and the Drupal Association's own site now leads with the packaged edition. A buyer who asks an agency for a Drupal quote may be offered either, and a buyer who reads a review of one may be reading about the other. Vendors in the Drupal ecosystem add a third layer: Acquia sells managed Drupal with FedRAMP and SOC 2 coverage under its own brand, and plenty of buyers believe Acquia is Drupal's commercial version in the way Automattic's WordPress VIP is WordPress's. It is closer to a managed host with a governance suite on top. This editorial is our attempt to settle the question for a buyer who does not want to become a Drupal historian. The short version is that Drupal CMS changed what you get on the first day and changed almost nothing about what you own for the next three years. That is a real improvement and a real limit, and the decision between the two editions, or a move to Acquia, follows directly from which of those matters more to your team. ## What to look for 1. **Who builds the first page.** Ask who on your side will create the first landing page and how many days after install. With Drupal CMS the honest answer can be a marketer in Canvas on the day of install, once the template is chosen. With plain Drupal it is a developer, after the content types, the theme and the editing modules are in place. If that first answer is a developer either way, the packaged edition buys you less than it appears. 2. **What arrives preconfigured.** List what your site needs that Drupal CMS ships switched on: meta tags and social cards, clean URLs and redirects, an XML sitemap, Webform with conditional logic and spam protection, scheduled publishing, an accessibility checker and the AI assistant with your own model key. Then list what it does not: personalization, A/B testing, content analytics, commerce and intranet features. Everything in the second list is a module and a developer on either edition. 3. **Who patches and upgrades.** Name the person or contract that applies security releases within a day and runs the Composer upgrade when a major version lands. Drupal CMS automates core updates only; its bundled modules, including Canvas, Webform and the AI stack, each have their own advisories. If that name is a managed host or an agency retainer, price it in. If it is nobody, neither edition is safe to run. 4. **Where the certifications come from.** Neither Drupal nor Drupal CMS carries a SOC 2 report, an ISO 27001 certificate, a HIPAA Business Associate Agreement or a data processing agreement, because the Drupal Association publishes software, not a service. Every one of those documents comes from the host you choose. Procurement teams who need a vendor to hold the paperwork are really choosing between hosts, and that is where Acquia, Pantheon and Platform.sh enter the conversation. 5. **What custom work will cost.** Anything beyond the templates and Canvas components still runs through Drupal's PHP entity, service and hook model, which takes a developer one to three months to learn and which Drupal specialists bill at roughly 25 to 50 percent above general PHP rates, with North American agencies typically quoting $80 to $180 an hour. Drupal CMS lowers the floor for marketers. It does not lower the ceiling price of the developer you still need for anything custom. ## Three products share one name, and buyers pay for the confusion Before comparing anything, it helps to be precise about what each name refers to, because the Drupal ecosystem is not. Here is the map we use. - **Drupal: the engine.** Drupal is the open-source framework published at drupal.org, currently the Drupal 11 line, installed from a blank Standard profile and extended with contributed modules. It is free under the GPL, it runs on any PHP host, and it is what agencies mean when they say they build on Drupal. Its content model, permissions and multilingual stack are the reason governments, universities and global publishers have run on it for two decades. Its first hour is still a developer's hour. - **Drupal CMS: the packaged product.** Drupal CMS is the same Drupal 11 engine with the Drupal Association's choices applied: the Canvas visual builder as default editor, site templates by sector, recipes that install SEO, forms, analytics, accessibility and AI tooling, a curated Project Browser for adding modules from the admin screen, and a free desktop Launcher for trying it locally. The current release as we write is Drupal CMS 2.2.7 from 23 October 2026, and version 2.2 added a template marketplace with partner-built and paid templates. It is a distribution, which means anything in it can be removed and anything from drupal.org can be added. - **Acquia: the commercial company.** Acquia is a private company founded by Drupal's creator that sells managed Drupal hosting with FedRAMP and SOC 2 coverage, Site Factory for running fleets of sites, a digital asset manager and a customer data platform. It runs Drupal and it funds a great deal of Drupal development, but it is not Drupal's owner or its official edition. Buyers choose it when they need one vendor to hold the compliance paperwork and the portfolio tooling, and they pay a reported platform markup of 200 to 300 percent over raw cloud cost for that. ## What Drupal CMS actually changed, and what it quietly did not Drupal CMS is a genuine shift in who Drupal is for. It is not a shift in what Drupal is. Both halves of that sentence matter when you are deciding whether it answers your problem. - **Changed: the first day.** An installer that asks what kind of site you are building and hands you a working one is new for Drupal. The templates come with meta tags and social cards, clean URLs, redirects with 404 tracking, an XML sitemap, real-time SEO analysis and a guided SEO checklist already installed. Webform is one click away with conditional logic and multi-step forms. The AI add-on connects to OpenAI, Anthropic, amazee.ai or a self-hosted model with encrypted keys, role permissions and guardrails, and the Canvas AI assistant builds pages from a prompt. The work an agency used to bill for in the first month is mostly done. - **Changed: who can edit.** Canvas, formerly Experience Builder, is the first page builder in Drupal's history that a marketer can use without a glossary. Pages are assembled from a component library by drag and drop, with reusable patterns, page templates, autosave, a trash can and scheduled publishing. Canvas 1.12, released in September 2026, moved Brand Kit out of its feature flag so each site carries its own colors and fonts, and added translated Canvas pages for multilingual sites. Once a developer has built the component library, the day-to-day editing no longer needs one. - **Did not change: the operating model.** Drupal CMS runs where Drupal runs, which is a PHP server you or your host operate. Automatic Updates covers core only; Canvas, Webform, the AI modules, CAPTCHA and Project Browser all carried their own security advisories in 2026, and each needs applying. Major versions still arrive on the project's calendar: Drupal 10 reaches end of life on 9 December 2026, and Drupal 12 lands the same week, requiring PHP 8.5 and dropping six core modules. There is no vendor support line, no uptime commitment and no certification. The marketer's first day got easier. The operator's year did not. - **Did not change: what is missing.** Nothing in either edition segments audiences, personalizes a page or runs an A/B test; the Canvas personalization module exists but is hidden and unsupported. There is no content analytics, because the Statistics module left core in Drupal 11, so engagement lives in Google Analytics. None of the site templates is a store or an employee portal; Drupal Commerce and the Open Intranet distribution are separate builds. The headless toolkit for JavaScript front ends is still pre-1.0. Anyone who read Drupal CMS as Drupal's answer to a DXP read the wrong release notes. ## How to choose between them, and when to choose neither Here is where we land. The two editions are one platform with two starting points, so the decision is about your team's shape and the first ninety days, not about capability. - **Start from Drupal CMS when a content team should own the site.** A marketing, communications, university or public-sector team that wants to launch a content-rich site, edit it visually and keep SEO and forms in house should start here. Pick the sector template, have a developer or agency build the Canvas components to your brand, and let the editors run it. You give up nothing from Drupal; you simply inherit sensible defaults that you can change later. - **Start from plain Drupal when developers are designing the platform.** A commerce site on Drupal Commerce, an intranet on Open Intranet, a decoupled build feeding a JavaScript front end, or any bespoke architecture is better started from a blank Standard install. Drupal CMS would hand you a theme, an editor and a dozen modules you would then remove, and its templates do not cover those cases. Canvas and recipes remain available as optional add-ons if you want them. - **Choose Acquia, or another managed Drupal host, when procurement needs a vendor.** If your security team needs a SOC 2 report, your legal team needs a signed data processing agreement, or your regulated status needs FedRAMP, no edition of Drupal will give you that on its own. Acquia bundles the certifications, the hosting operations and Site Factory for multi-site fleets; Pantheon and Platform.sh offer managed Drupal with their own attestations at lower price points. Either way, you are still choosing Drupal CMS or plain Drupal as the thing that runs on top. - **Check the calendar before you sign anything.** Any Drupal site started in late 2026 should start on Drupal 11, because Drupal 10 reaches end of life on 9 December 2026 and Drupal 12 arrives the same week on PHP 8.5. Ask the agency which version the quote targets, when they plan the next major upgrade, and who pays for it. The Drupal Association publishes dated release milestones well in advance, so there is no excuse for being surprised by one. - **Price the people, not the license.** Both editions cost nothing to license, so every dollar of the budget goes to hosting and humans. Name the operator who applies security releases within a day, the developer who owns custom work at specialist rates, and the contract that covers them when they leave. If that list is shorter than two names, the honest comparison is not Drupal CMS versus Drupal. It is Drupal versus a managed platform where the vendor is those two names. ## Platforms in this piece - [Drupal CMS](https://www.dxpscorecard.com/platform/drupal-cms) (Markdown: https://www.dxpscorecard.com/platform/drupal-cms.md) - [Drupal](https://www.dxpscorecard.com/platform/drupal) (Markdown: https://www.dxpscorecard.com/platform/drupal.md) - [Acquia](https://www.dxpscorecard.com/platform/acquia) (Markdown: https://www.dxpscorecard.com/platform/acquia.md) - [WordPress](https://www.dxpscorecard.com/platform/wordpress) (Markdown: https://www.dxpscorecard.com/platform/wordpress.md) ## Frequently asked questions ### What is Drupal CMS? Drupal CMS is the packaged edition of Drupal published by the Drupal Association since January 2025. It bundles Drupal 11 with the Canvas visual page builder, sector site templates and preinstalled SEO, forms, analytics, accessibility and AI tooling, so a marketing team can launch and edit a site without first assembling modules. It is free and open source, and it runs on any Drupal host. ### Is Drupal CMS the same as Drupal? Underneath, yes. Drupal CMS is a distribution of Drupal core, so it runs the same Drupal 11 engine, the same database and the same catalog of more than 50,000 modules. The difference is what is installed and configured when the installer finishes: Drupal CMS ships Canvas, templates and marketing tooling switched on, while plain Drupal hands a developer a blank Standard install to build from. ### Is Drupal CMS free, and what does Drupal cost to run? Both Drupal and Drupal CMS are free under the GPL, with no seat charges, usage metering or feature gating, and every feature, including Canvas and the AI tooling, is included. The cost is hosting and people: a managed Drupal host or your own servers, an operator who applies security releases, and Drupal developers, who in North America typically bill $80 to $180 an hour for custom work. ### Is Drupal a DXP? No. Neither Drupal nor Drupal CMS includes audience segmentation, personalization, A/B testing or content analytics, which are the features that define a digital experience platform. Both are strong content management systems with deep modeling, permissions and multilingual support, and the marketing layer is assembled from contributed modules and external tools. Acquia sells a Drupal-based DXP by adding a customer data platform, hosting and governance tooling around it. ### Should a new site start on Drupal CMS or on Drupal? Start on Drupal CMS when a content or marketing team should launch and edit the site visually, especially for marketing, higher education, government or nonprofit sites that match its templates. Start on plain Drupal when developers are designing a bespoke, commerce, intranet or headless build and would only remove what Drupal CMS preinstalls. You can add Canvas and recipes to plain Drupal later, and remove them from Drupal CMS. ### Is Drupal CMS easier than WordPress? On the first day they are now comparable: Drupal CMS installs a working site with a visual editor, SEO tooling and forms, which WordPress users have long taken for granted. After that, WordPress still wins on the size of its talent pool, lower developer rates and a gentler learning curve, while Drupal CMS wins on content modeling, granular permissions and built-in multilingual support for structured, multi-language sites. ## About this editorial A position the DXP Principal Analyst Group took on 2026-10-31. It is not updated; a changed view is published as a new editorial. The linked scorecards carry the current ratings for every platform named here. Scorecards and platform inclusion are unsponsored: no vendor pays to be named in an editorial or to change a rating.