Drupal

Core Field API covers text, numeric, boolean, datetime and daterange, entity reference, file, image, link, list, telephone and email fields on any bundle of any entity type, and the whole schema is YAML config that exports, deploys and ships in core recipes. Not higher because union or polymorphic references need contrib (Dynamic Entity Reference) and there is no native JSON or geolocation field.

Core entity reference fields are multi-value (many-to-many), target any entity type, and Views relationships traverse them in reverse; JSON:API include and filter across references. Not higher because references are stored one way only, so bidirectional sync needs contrib such as Corresponding Entity References.

Paragraphs (contrib) provides nested reusable components, Layout Builder and Single Directory Components are in core, and custom block content entities can be embedded inline. Not higher because rich text is stored as HTML rather than a portable AST and the most used composition model, Paragraphs, is contrib.

Validation is built on Symfony Validator constraints attached to entities and fields, so required, unique, length, regex and custom constraint plugins apply to API writes through JSON:API and REST as well as forms. Cross-field and custom rule plugins are standard developer practice; not higher because editors cannot add rules without code beyond the basic field settings.

Nodes, media, custom blocks and taxonomy terms keep full revisions with author, log message and one-click revert, and core Workspaces (stable) stages many changes and publishes them together. Not higher because the visual diff comes from contrib (Diff 2.0.1) and restoring deleted content needs contrib (Trash).

Core Taxonomy provides unlimited vocabularies with hierarchical terms, fieldable term entities, per-vocabulary permissions and term revisions, reusable across any content type and exposed through JSON:API. Not higher because synonyms and bulk reclassification need contrib and there is no governed term approval flow in core.

On a coupled site, node preview renders drafts in the real theme and core Workspaces previews a whole site of staged changes; decoupled frontends get draft preview through contrib (Next.js for Drupal 2.1.0). Not higher because a Standard install has no click-to-edit overlays on the frontend (Quick Edit left core) and headless preview needs developer setup.

CKEditor 5 in core includes media embedding from the Media Library, configurable toolbars per text format, Paste from Office and source editing, and contrib adds plugins such as Linkit. Not higher because output is filtered HTML rather than a portable AST and there is no native Markdown mode.

Core Media and Media Library give typed, fieldable media with alt text and reuse, image styles generate derivatives with WebP and AVIF conversion, and Responsive Image serves breakpoints. Not higher because transforms are predefined styles rather than arbitrary URL parameters, and focal point and cross-content usage reporting come from contrib.

Core detects concurrent saves and rejects the stale form, and Content Lock (contrib, active September 2026) adds pessimistic locking. Not higher because core has no presence, in-content comments or mentions; co-editing exists only in optional Canvas or paid CKEditor premium features.

Core Workflows and Content Moderation support custom states and transitions per bundle, permission-based transitions per role and a revision log of every state change. Not higher because task assignment, due dates and notifications need contrib (Content Moderation Notifications) and there is no parallel approval routing.

Scheduled publish and unpublish come from the Scheduler module (contrib 2.3.0, June 2026), while core Workspaces publishes a staged bundle of changes atomically. Not higher because scheduling is not in core, a workspace cannot be scheduled natively, and there is no calendar view without Views plus contrib.

Four core modules (Language, Content Translation, Configuration Translation, Interface Translation) give field-level translatability per bundle, translated config including menus and views, language negotiation and per-language JSON:API access. Not higher because configurable fallback chains and per-language editing permissions need contrib.

Core RBAC is very granular, with custom roles and per-bundle, per-vocabulary and per-transition permissions; field-level access, entry-level access, SAML and OIDC come from mature contrib (Field Permissions, Group, simpleSAMLphp Auth, OpenID Connect). Not higher because SSO and field permissions are not core and SCIM provisioning has no well-established contrib release.

JSON:API in core is spec compliant with filtering, sorting, pagination, sparse fieldsets, includes and language prefixes, alongside the core REST module; GraphQL 5.1.0 (contrib, September 2026) adds a schema-first option. Not higher because delivery and management share one API surface and GraphQL is not core.

Cache tags and contexts with Page Cache, Dynamic Page Cache and BigPipe give precise invalidation, and the Purge ecosystem pushes tag-based purges to Varnish, Fastly or Cloudflare. Not higher because Drupal is self-hosted with no CDN of its own; edge delivery depends on infrastructure the team provides.

Core has a full internal event and hook system, and outbound webhooks come from contrib (Webhooks 3.0.0-rc1, September 2026; Entity Webhook alpha) with entity create, update and delete events. Not higher because nothing ships in core and signing, retries and delivery logs depend on which contrib module is chosen.

The entity model is channel-agnostic and JSON:API and REST serve any client, with community client libraries such as Next.js for Drupal. Not higher because rich text is HTML, there are no official SDKs beyond the JavaScript community packages, and the default is a coupled web site.

Core has no segmentation; Smart Content (contrib 3.1.1, September 2026) and External Personalization add rule-based conditions such as UTM, device and role, and CDP data arrives only through custom or connector work. Low in the integration band because no named CDP connector feeds audiences into content rules.

Conditional block display through Smart Content or an external decision engine is possible, but there are no native per-segment variants or audience preview in the editor. Canvas ships a hidden canvas_personalization submodule, which is not part of a core install.

A/B testing comes from small contrib modules (Server-side A/B Testing, Smart Content A/B) or an external tool loaded through tag management. Not higher because none provide traffic allocation with significance reporting inside Drupal.

Related content is built with Views on shared taxonomy, Search API Solr offers a More Like This processor, and Recombee has a connector. Not higher because there is no built-in algorithmic or behavioral recommendation engine.

Core Search provides basic full-text indexing and a search page, and the contrib Search API stack (Search API 1.41, Search API Solr 4.3.14, Facets 3.0.7) adds Solr, Elasticsearch, Typesense or Algolia backends with facets and autocomplete. Scored as basic native search; the strong faceted experience is contrib assembly.

Drupal Commerce (contrib 3.3.10, September 2026) delivers a full catalog with product variations, cart, checkout, orders, promotions and payment gateways on the Drupal entity system. Capped at integration because it is a contributed module, not part of core.

The commercetools module (2.2.0) federates live product data and the Shopify module syncs products as entities but is still alpha (alpha7, September 2026). Not higher because there are no maintained connectors for Salesforce Commerce Cloud or SAP Commerce.

The Statistics module is no longer in Drupal 11 core, which leaves only database logs and recent-content history. No content performance or engagement analytics ship in core.

Google Tag (contrib 2.0.9) manages GA4 and GTM containers with event support, and Google Analytics and Matomo modules are available. Capped at integration because all are community contrib, with nothing first-party for Adobe Analytics or Segment.

Core multisite runs many sites from one codebase via the sites directory, each with its own database and configuration, which is silo-based. Content sharing across domains needs Domain Access (contrib, 3.1.0-alpha6), so native multi-site stays in the silo band.

TMGMT (contrib 1.19, August 2026) gives in-Drupal translation jobs, review and batch export with connectors for Smartling (9.28, October 2026), Lingotek (4.0.4), XTM and machine translation such as DeepL. Capped at integration because the translation workflow is contrib.

Brand separation is assembled from Domain Access, Group and Config Split, with core recipes to standardize configuration across sites. Not higher because there is no cross-brand policy enforcement, shared component overrides or brand-level reporting.

Core Media has no rights, expiry, approval or asset versioning features; enterprise DAM arrives through connectors such as the Acquia DAM module (2.1.5) or Bynder. Low in the integration band because connectors are marketplace modules and the Cloudinary module has not shipped a stable release.

Core Media supports local video and audio files and remote video through oEmbed for YouTube and Vimeo. Not higher because there is no hosting, transcoding or adaptive streaming without external services or contrib FFmpeg setups.

Core Layout Builder lets editors arrange sections and blocks with drag and drop and per-entity overrides, previewed in the theme. Not higher because the experience is form-heavy with no governed component palette or headless composition; the modern visual builder, Canvas, is an optional contrib add-on and not scored.

Drupal renders full sites natively with themes, Twig templates, routing and caching, but the customer hosts it on their own infrastructure. There is no vendor-operated hosting for open-source Drupal; managed hosting is a commercial partner market.

Core Contact gives basic fieldable forms, while Webform (contrib 6.2.12 and 6.3.1, September 2026) is a full builder with multi-step, conditional logic, submission storage, spam protection and CRM handlers. Capped at integration because Webform is contrib.

Mailchimp (3.2.0-rc7) syncs subscribers and lists, Salesforce Suite (6.0.0-alpha6) maps entities to Salesforce, and Webform handlers post to HubSpot and others. Not higher because these are basic connectors without content push or in-CMS email preview, and several lack stable releases for Drupal 11.

ECA can drive internal event-based actions, and external automation (HubSpot, Marketo) connects through form handlers; the Mautic module has had no release since 2022. Not higher because there are no behavioral triggers, nurture flows or lead scoring.

Core provides path aliases and clean URLs; Metatag (2.2.0), Simple XML Sitemap (4.2.3), Redirect (1.13), Pathauto and Schema.org Metatag supply meta tags, hreflang, sitemaps, redirects and JSON-LD, all exposed to JSON:API. Capped at integration because the SEO layer is contrib, with no on-page recommendations.

The llms_txt module (1.1.1, August 2026) serves an editable /llms.txt with Markdown menu tokens, RobotsTxt lets admins manage per-bot rules, and Schema.org Metatag adds JSON-LD. Not higher because there is no per-page Markdown endpoint, AI citation analytics or crawler rate limiting.

drupal.org hosts tens of thousands of contributed modules with active Drupal 11 releases for the major ones (Webform, Commerce, Search API, TMGMT, Metatag), installed through Composer with core recipes for packaged setups. Not higher because there is no certification tier and quality varies outside the top modules.

Core User handles visitor registration, login, profiles, password reset and role-based access to content, so gated member areas work out of the box. Not higher because CIAM federation (OpenID Connect, SAML), social login and consent management come from contrib, and there is no portal or self-service account layer beyond the user profile.

JSON:API in core is fully spec-compliant (v1.1) with consistent resource naming, relationships, includes, sparse fieldsets, filtering, and sorting. Drupal 11.2 added JSON Schema support for content models. Error responses are standardized. However, API documentation is auto-generated and lacks examples; no OpenAPI/Swagger generation without contrib. Well-designed by spec adherence but documentation onboarding could be better.

No published SLAs (self-hosted). Drupal 11.3 delivered the biggest performance boost in a decade (26-33% more requests at the same DB load, up to 62% fewer queries on complex sites), and 11.4 adds Brotli compression for assets. Dynamic Page Cache and Internal Page Cache provide caching layers. However, no CDN-backed delivery by default, no built-in rate limiting, and API performance tuning still requires expertise.

No official multi-language SDKs maintained by Drupal Association. The @drupal NPM namespace hosts Drupal core's internal JavaScript packages, not a consumer-facing content SDK. The JavaScript ecosystem has next-drupal (full TypeScript support, targeting a 2.0 release aligned with the Next.js App Router) and drupal-jsonapi-params for query building. Developers otherwise use generic HTTP clients. No official Python/Go/Java/.NET SDKs — a meaningful gap versus headless CMSs with polished official SDK suites.

Drupal.org hosts over 50,000 contributed modules — one of the largest CMS extension ecosystems. Key integrations exist for virtually every major service category (payment, email, search, social, DAM, CRM, AI). Quality varies; many modules are unmaintained or Drupal 7 only. The Drupal 10/11-compatible maintained set is smaller but still substantial. Ecosystem breadth is a genuine strength.

Drupal's extensibility is world-class and continues to modernize. OOP hooks via PHP attributes completed in 11.2 with theme support in 11.3; 11.4 extends PHP attribute routing to form classes and adopts a Symfony Runtime bootstrap. Native HTMX integration (core dependency in 11.2, fully featured in 11.3) replaces much of BigPipe's JavaScript and is gradually superseding the legacy AJAX API. The Recipes system accepts user input and supports configuration actions. Plugin API, event subscribers, Symfony DI container, custom entity types, form/render alterations, and route subscribers provide extension points at every layer.

SAML (via samlauth module), OIDC (via OpenID Connect module), and OAuth2 (via Simple OAuth) are available and mature. MFA via TFA module. API authentication supports OAuth2 bearer tokens, basic auth, and cookie-based auth. SSO is possible but requires contrib module setup rather than turnkey enterprise feature. No native API key management UI. SSO available without plan gating (open source), scoring above enterprise-gated platforms.

Drupal's permission system is exceptionally granular with hundreds of permissions across modules, fully custom roles, and the node access grants system for content-level access control. Drupal 11.3 added a 'Rebuild node access permissions' permission for finer control. Field-level permissions via contrib, Content Moderation for workflow-state access, Group module for audience-based access. Competitive advantage for intranets and government sites.

Drupal is open-source; compliance certifications depend on hosting provider. Acquia holds SOC 2 + FedRAMP + ISO 27001; Pantheon and Platform.sh hold SOC 2. Amazee.io offers ISO 27001 certified Drupal hosting. GDPR module continues to mature with consent management and data subject access requests. HIPAA eligibility is hosting-dependent. Certifications are not intrinsic to Drupal itself, which limits this score relative to SaaS platforms.

The dedicated Security Team runs exemplary coordinated disclosure and a HackerOne program, but 2026 has been an eventful year: a highly critical PostgreSQL SQL injection (SA-CORE-2026-004 / CVE-2026-9082) saw exploit attempts in the wild from ~May 22, plus a critical JSON:API PHP object injection (SA-CORE-2026-005) and a run of moderately critical issues — Image module info disclosure (010), an XSS via HTMX attributes (011, a regression from the newly added HTMX feature), and a Layout Builder XSS (012). The team pre-announced the highly critical release via a PSA and shipped coordinated patches across all supported branches. Strong process, but an actively exploited highly critical plus a steady 2026 advisory stream (including a self-inflicted HTMX XSS) pull this further below a clean record.

Maximum flexibility: self-host anywhere, managed platforms (Acquia, Pantheon, Platform.sh), Docker containers (official images, DDEV). Multi-cloud, on-premise, hybrid all viable. Composer-based deployment supports any PHP hosting environment. No SaaS-only lock-in. The trade-off is you must manage infrastructure decisions, but deployment choice is entirely yours — ideal for regulated industries requiring private cloud.

No inherent SLA — entirely dependent on hosting choice. Acquia offers 99.95% SLA on enterprise plans; Pantheon offers 99.9%. Self-hosted means self-managed SLA. No central Drupal status page because there's no central Drupal service. Scores lower than SaaS platforms by nature, though well-managed Drupal sites achieve excellent uptime in practice.

Drupal is proven at massive scale (government, media, enterprise). Drupal 11.3 delivered 26-33% more requests with same database load, with independent analysis showing up to 62% query reduction on complex sites. Cache tag-based invalidation enables granular cache management. Multi-server architectures with load balancers, read replicas, Redis/Memcached, Varnish, and CDN are well-documented. Scaling requires expertise but the architecture supports it well.

Full content export via config export (YAML) and database dumps. Standard MySQL/PostgreSQL backup tools apply. Backup and Migrate contrib module provides scheduled backups. Migrate API is excellent for data portability. Open data formats (no proprietary lock-in). RTO/RPO depends on hosting setup. No built-in multi-region failover — infrastructure concern.

DDEV is the officially recommended local development environment (selected by community in 2024, 93% recommendation rate in 2025 Developer Survey). One-command Drupal setup with database, mail, Solr, and Redis support. Lando remains a popular alternative. Drush CLI is powerful for development tasks. Near-production parity via Docker. Single Directory Components (SDC) stable in core streamline frontend component development locally.

Configuration Management system is purpose-built for CI/CD — config changes flow through version control as YAML files. Drupal 11.2 made module and config installations 3-4x faster, improving CI pipeline speed. Recipes system improvements enable more declarative config management. Environment promotion patterns are well-established. Deploy previews via Pantheon Multidev and Platform.sh environments.

Drupal.org documentation is extensive but uneven in quality. Official docs have improved but still mix outdated content with current material. api.drupal.org provides auto-generated API reference from PHPDoc annotations — thorough but not always beginner-friendly. New features like OOP hooks and Recipes have good documentation. Getting-started experience has improved with DDEV guides. No interactive API playground.

Drupal is a PHP platform with TypeScript limited to the frontend consumption layer. There is no official auto-generated type system from content models in core. The TypeScript Definition Generator contrib module generates type definitions from entity types via Drush; ts_for_core provides Drupal core TypeScript definitions (D10/D11); next-drupal ships with TypeScript support. All tooling remains contrib/community — no first-party code generation from content models.

Drupal sustains a fast dual-track cadence and is now approaching a major release: Drupal 12.0.0-alpha1 shipped Sept 2, 2026, with beta1 the week of Sept 14, RC the week of Nov 9, and stable (alongside 11.5.0) the week of Dec 7, 2026. Monthly patch releases continue across all supported branches (11.4.6 and 10.6.16 on Sept 3, 2026). Not higher only because feature delivery is spread across many contrib/AI modules rather than blockbuster core releases.

Release notes for minor releases remain detailed, documenting new features, deprecations, and developer-facing changes with linked change records, and the Drupal 12 readiness materials add per-requirement migration guidance. Change records on drupal.org document API changes with code examples. Quality of individual change records still varies since they are community-authored.

Roadmap transparency remains excellent: the official core release schedule publishes exact dated milestones (Drupal 12.0.0 + 11.5.0 week of Dec 7, 2026; Drupal 10 EOL Dec 9, 2026), and with 12.0.0-alpha1 now shipped those dates are being met on schedule. The AI roadmap for 2026 is detailed publicly and Dries blogs regularly on direction. Community participation is open at every level.

Semantic versioning with deprecation-before-removal continues, and Drupal 12 platform requirements (Symfony 8, PHP baseline) were announced well in advance with contrib readiness tooling and public compatibility tracking. Security windows are clearly published (Drupal 10 EOL Dec 9, 2026). Contrib module compatibility lag at the imminent D11→D12 major boundary remains a friction point, though advance notice, drupal-check/upgrade_status, and Rector-based tooling help.

Drupal remains one of the largest CMS communities globally with 500K+ (reported 676K+) active sites and major events (DrupalCon Chicago 2026, DrupalCon Europe). The AI Initiative alone now spans 50+ active contributors across 32 partner organizations. Community is large but a gradual demographic shift toward JS-based tooling continues, capping further upside.

Engagement is strong and measurably improving. The AI Initiative grew to 32 partner organizations, 50+ active contributors, and $2.3M+ committed funding (up from ~$1.5M / 31 orgs), a new AI Security Initiative launched, and agencies like Specbee joined as sponsors. The contribution-credit system remains operational and DrupalCon Chicago 2026 drove fresh momentum. Not higher because participation is increasingly concentrated in the funded AI workstreams rather than broad-based core contribution.

Large global network of Drupal agencies, SIs, and hosting partners remains intact and is actively investing: 32 partner organizations now contribute funds and FTEs to the AI Initiative, with Acquia as primary commercial backer and firms like QED42, 1xINTERNET, and Specbee leading or joining workstreams. Acquia Certification remains a recognized credential and the Drupal Marketplace lists certified providers. Not higher because there is no single dominant global-SI lock comparable to proprietary enterprise DXPs.

A substantial body of Drupal content exists across tutorials, courses, and YouTube, and Drupal 12, Canvas, Drupal CMS 2.0, and the AI roadmap are generating fresh coverage from many independent sources (TheDropTimes, SparkFabrik, Acquia, Vardot, BinaryWorks, decoupled.io). Dries' blog and Drupalize.Me structured training remain active. Not higher because overall new educational content volume has not recovered to the 2015–2018 peak.

Drupal's talent pool remains available but continues to contract, with community leaders acknowledging an aging talent base as a structural concern. Mitigation is underway: Acquia 'Drupal in a Day' training, Drupal Association study badges, and Drupal CMS 2.0 with Canvas reducing the need for deep specialist expertise. Government and enterprise sectors maintain stronger pipelines and the broad PHP base helps recruitment.

Momentum is building: Drupal CMS 2.0 shipped Jan 2026 with Canvas as the default visual builder and AI-powered page building, Canvas hit stable and Drupal Canvas 1.2.0 followed in Feb 2026, and the AI Initiative's growth to 32 orgs / $2.3M+ signals renewed enterprise interest. The 500K+ active-site base is stable. Not higher because net-new enterprise wins remain limited versus headless competitors and the aging talent pool poses delivery risk.

Organizational stability is strong and strengthening: the AI Initiative now has $2.3M+ committed across 32 partner organizations (up from ~$1.5M / 31), plus a new AI Security Initiative, demonstrating broad and growing financial backing, with Acquia as the primary commercial sponsor and a large share of Core Leadership. The Drupal Association maintains infrastructure and DrupalCon, and Dries provides 25 years of leadership continuity. Not higher because the model relies on community/foundation funding rather than a single deep-pocketed vendor balance sheet.

Positioning continues to strengthen: Drupal CMS 2.0 with the stable Canvas visual builder directly targets the platform's historic ease-of-use weakness, and the AI-native page-building plus DXP 2.0 orchestration narrative (Acquia 'Drupal at the Turning Point') positions Drupal for governance-first AI integration. Not higher because Drupal still lacks a current Gartner/Forrester Leader placement and clarity is improving rather than market-dominant.

Drupal's review footprint spans hundreds of reviews across G2 and Gartner Peer Insights (36 verified Drupal Commerce reviews), with users consistently praising flexibility, customization, multilingual handling, security, and integrations. The steep learning curve and some performance/weight concerns remain the top complaints, though Drupal CMS 2.0's Canvas builder directly targets the usability gap. Community sentiment is constructive with renewed optimism around Drupal CMS and AI.

Drupal is free and open-source (GPL v2+) with zero licensing fees and full source transparency — no sales gate, per-seat charge, or API metering. All costs are infrastructure and labor, fully within the buyer's control. Maximum pricing transparency; not higher only because real hosting/ops costs still must be discovered and budgeted by the buyer.

The open-source model means costs scale with infrastructure and team, not content volume, API calls, or user seats — no surprise usage-spike bills. Maximally predictable in that vendor pricing tiers don't exist. The caveat keeping it below 95 is that hosting/ops costs are real and grow with traffic, unlike a flat SaaS fee.

Every feature in Drupal core and the 50,000+ contrib modules is available to everyone — no premium tiers, enterprise-only features, or upsell gating. Drupal CMS 2.0 (Jan 2026) added a free Canvas visual builder, site templates, and AI tools in the open-source distribution. Acquia layers commercial add-ons (Personalization, Site Studio, DAM) on top, but the OSS platform itself has zero feature restrictions.

No vendor contract for the software itself — start, stop, switch hosting, change service providers, or move fully in-house at any time with no exit fees or commitment periods. Managed hosting contracts (Acquia, Pantheon) are independent and switchable, with self-hosting always available as a fallback. Not higher only because enterprise managed-hosting deals (Acquia) are typically annual and negotiated.

Drupal is fully free under GPL with no usage limits, user caps, or API restrictions, and is permissively licensed for commercial use. Hobby developers can self-host on any cloud VM for a few dollars a month with the full platform; DDEV and the Drupal CMS quick-start (SQLite) give zero-cost local setup. Not higher only because there is no vendor-hosted free tier — the buyer must provision hosting.

Drupal CMS 2.0 (Jan 28, 2026) materially improved the on-ramp: the Canvas visual page builder, pre-configured site templates that install a complete professional site in under three minutes, an admin AI chatbot, and the SQLite quick-start make a working content-typed site achievable in well under a day. Still requires the PHP/Composer/Docker toolchain for production and is not the sub-hour first-query experience of a SaaS headless CMS. Held stable as Drupal CMS matures the beginner path.

2026 community data: small custom site 4-8 weeks, content-led marketing site 6-14 weeks, multi-feature build with integrations 3-6 months, multi-language/multi-site enterprise 5-9 months. Mid-market builds land $25k-$250k, complex enterprise $80k-$400k+ (range $5k-$1M+). Comparable to other traditional CMSs but longer than headless; Drupal CMS templates help simple sites but haven't shortened typical enterprise timelines.

North American Drupal developers bill $80-$180+/hr, with Acquia Elite and top-tier partners at $150-$250/hr — a clear premium over generalist web devs, driven by a narrower talent pool than React/general PHP. Offshore rates ($15-$45/hr in South Asia, $35-$75 Eastern Europe) cut cost but require remote management. The certification-validated, niche-framework nature of the work keeps the premium moderate-to-high.

Self-hosted Drupal needs PHP hosting with a database — from ~$50/month for basic sites to $500-$3,000/month for managed enterprise, with Acquia carrying a reported 200-300% platform markup over raw AWS cost. Pantheon runs ~$41/mo basic up to ~$11k/yr for Performance XL. The 2026 shift to hybrid orchestration (paying cloud providers directly) can cut hosting costs up to 80%. Full control over the cost-performance trade-off is an advantage, but infrastructure is always an extra budget line versus SaaS-included platforms.

Self-hosted Drupal demands sustained ops: server maintenance, security patching, backups, monitoring, and caching management. Teams managing Drupal manually report 30-60 hrs/week of non-billable DevOps (20-40 hrs/month for smaller sites), and the 2026 collapse of the advisory-to-exploit window to under 24 hours has intensified the patching burden. Managed hosting reduces but never eliminates this; nowhere near zero-ops SaaS.

Minimal lock-in: all content lives in a standard MySQL/PostgreSQL database with a documented schema, the Migrate API provides robust import/export tooling, and configuration is stored as portable YAML. No proprietary data formats or vendor-controlled storage — you own all your data and can migrate hosts or providers freely. This is a core open-source advantage.

Drupal 11.4 (stable June 2026, now on 11.4.6) narrows the Drupal-specific surface with PHP attribute routing (Symfony #[Route] on controllers) replacing *.routing.yml, and Drupal 12.0.0-alpha1 (Sep 2, 2026; stable week of Dec 7, 2026) continues deprecation-driven cleanup — PHP 8.5 minimum, Argon2id hashing, six core modules removed — trimming legacy concepts rather than adding new ones. But the core mental model is unchanged: Entity/Bundle/Field hierarchy, render arrays, cache-metadata bubbling, plugin discovery, and config management remain unique to Drupal. Not higher because these overlapping abstraction layers still demand significant Drupal-specific re-learning.

Drupal CMS launcher app and the Byte site template (installs in under 3 minutes) remain the primary onboarding path, with DDEV 1.24+ recommended for permanent installs. Drupalize.Me, Acquia Academy, and DrupalCon recordings provide structured learning. Still no interactive in-browser developer tutorial — the trial is CMS/site-builder focused, and local dev still requires DDEV/Lando/Composer setup, so the developer onboarding curve is unchanged into the 11.4.x line.

Drupal 11.4's PHP attribute routing and Symfony Runtime adoption continue narrowing the gap with mainstream PHP/Symfony development, and Drupal 12's PHP 8.5 minimum keeps the platform aligned with modern PHP — routing uses the same #[Route] attribute Symfony developers already know, building on 11.3's HTMX-in-core and OOP theme hooks. Twig is shared with Symfony, JSON:API is in core, and Canvas uses React/Preact code components. Not higher because productive extension still requires deep Drupal-specific knowledge of the entity system, render pipeline, and contrib ecosystem.

Drupal CMS 2.0's 'Byte' site template ships a near-complete SaaS marketing site (blog, pricing, newsletter, contact form) built on Canvas and installing in under 3 minutes, and recipes provide composable feature packages — the Saplings starter recipe now bundles best-practice sub-recipes for launching a modern site. For decoupled, next-drupal plus the Wunder Next.js for Drupal Starterkit and Chapter Three/Pantheon kits exist. Not higher because there is still no official core-maintained Next.js/Nuxt starter with TypeScript, example content, and deployment config to match headless CMS vendors — the strongest options are agency-maintained.

Recipes reduce initial configuration burden (Drupal CMS pre-applies ~30 out of the box), and 11.4 improves recipe-system performance by installing modules in batches via RecipeRunner::installModules(), building on 11.3's 3-4x faster module installs. However, the underlying config surface is unchanged: 500+ YAML files for a typical site, Config Split for multi-environment, and settings.php/services.yml layering. Not higher because faster install speed doesn't reduce the configuration surface area developers must manage.

No significant changes to data-modeling constraints in the 11.4.x line or Drupal 12 alpha. Adding content types and fields remains easy, but changing field types on populated fields still requires data migration, and config management handles additive schema changes well while destructive changes need manual migration via update/post_update hooks. Not higher because there is still no schema-migration tooling to simplify schema evolution on live content.

Drupal Canvas (default in CMS 2.0 since Jan 2026, first-party page builder for 11.2+) provides true drag-and-drop with live preview, SDC/React code components, Storybook integration, and an AI assistant for coupled architecture. For decoupled, next-drupal ships inline preview built into the editing interface with instant live updates, plus the next_preview module. Not higher because Canvas is coupled-only, and decoupled preview still requires the next-drupal SDK and frontend setup rather than being plug-and-play.

Canvas lets site builders create pages visually with no Drupal experience, and 11.4's attribute routing plus 11.3's HTMX reduce the Drupal-specific patterns developers must learn for routing and dynamic UIs. However, developers extending the platform still need deep Drupal-specific knowledge of the entity system, hook/event architecture, render pipeline, and contrib ecosystem. Not higher because the Acquia certification program exists precisely because this specialized knowledge is genuinely required for development work.

Drupal CMS 2.0 with Canvas, the Byte template, and recipes lets a solo site builder produce a production marketing site without developer help for basic use cases. However, customization beyond templates still requires backend developer, themer, and DevOps roles, and decoupled adds frontend developers — typical production projects still need 2-4 people. Not higher because anything beyond the packaged templates still demands multiple specialized roles.

Canvas drag-and-drop with live preview and its component library let editors and marketers build and edit pages without developers, and recipe-based integrations further cut developer dependency — e.g. the Mailchimp recipe auto-creates signup form blocks ready to drop into Canvas pages. The AI admin chatbot and AI-assisted alt text reduce ongoing content-ops burden. Not higher because developers are still needed to initially set up components and recipes before editors can self-serve.

The D11→D12 timeline has firmed up (12.0.0-alpha1 shipped Sept 2 2026; beta1 week of Sept 14, RC week of Nov 9, GA week of Dec 7 2026), resolving the earlier August-vs-December uncertainty. Contrib compatibility stays mostly metadata since disruptive public-API deprecations are deferred to D13, but newly-confirmed friction adds real work: D12 requires PHP 8.5, only starts from D11.3 (all pre-11.3 update paths removed), removes six core modules (Ban, Contact, Field Layout, History, Migrate Drupal/UI) requiring contrib swaps first, and switches to Argon2id hashing. Nudged down from 47: a mandatory PHP-runtime bump plus core-module removals is more than the metadata-only framing implied, though still a tested composer-driven effort, not zero-touch SaaS.

The Drupal Security Team's process remains best-in-class: same-day coordinated patches across all supported branches (latest 11.4.6 and 10.6.16 on Sept 3 2026), clear advisories, PSA pre-announcements, and emergency patches even for EOL branches. 2026 stayed a heavy year — highly critical SQL injection SA-CORE-2026-004 (CVE-2026-9082, PostgreSQL, RCE-capable, exploited in the wild by May 22) on May 20, plus moderately critical batches in June and July — and self-hosted teams must apply each emergency patch manually via composer update + deploy. Held at 73 to reflect the elevated 2026 emergency-patch cadence against a still-manual application model.

The 2-year major cycle is predictable and D10 EOL is firmly Dec 9 2026, giving a clear long-notice deadline; because D12 GA lands the same week as D10 EOL, D11 (supported into December 2028) is the practical destination, so most teams have a stable target. Still a mandatory upgrade on the vendor's cadence, and minor-version support gaps create surprises — D10.5.x lost security support June 17 2026, roughly six months before D10.6.x. Held at 48: predictable and well-telegraphed, but forced and requiring a PHP 8.5 / D11.3-minimum jump for anyone chasing D12.

Composer manages PHP dependencies effectively with a lockfile and composer audit for vulnerability scanning, but the surface area is large: Symfony components, Twig, Guzzle, plus contrib module dependency trees that create version conflicts and update cascades. The self-hosted stack adds PHP (8.5 for D12), database, web server, and often Varnish/Redis/Solr, and 2026's coordinated Symfony/Twig advisories showed transitive CVEs propagate into core releases. Well-managed for its size but non-trivial, far from SaaS near-zero client dependencies.

Drupal ships only basic health checks (/admin/reports/status) and Syslog/Dblog logging — no built-in APM, alerting, uptime monitoring, or observability dashboard. Comprehensive monitoring requires external tooling (New Relic, Datadog, Prometheus) or reliance on a managed host (Acquia, Pantheon). Per rubric, self-hosted with minimal built-in monitoring sits in the 30-45 band.

Drupal provides solid content-ops tooling — Views for listing and bulk operations, Taxonomy, Pathauto for URLs, Redirect for redirect management — but no automated orphan detection, broken-reference alerts, or content-health dashboard in core. Content hygiene relies on editorial discipline and manual review, and a neglected site deteriorates such that recovery costs far more than steady maintenance. Aligns with the 30-50 manual-governance band.

Drupal's caching system (page cache, dynamic page cache, render cache with tags/contexts/max-age) is powerful but requires developer knowledge — custom cache metadata, Varnish/CDN tuning, and Views/query optimization at scale all need ongoing attention. Profiling tools (Webprofiler, XHProf) exist but performance is not set-and-forget. Sits squarely in the 40-60 self-hosted band.

There is no vendor support for open-source Drupal core itself — formal support comes from hosting providers or contracted agencies, with quality tied to the paid arrangement (G2 rates Pantheon support 8.7/10 and Acquia 8.1/10, both solid but gated behind hosting spend). A robust third-party ecosystem offers 24/7 services, but good support effectively requires an enterprise contract, with dedicated maintenance running $4,500-15,000/month. Matches the rubric's 40-60 band for 'good support requires Enterprise'.

Community support is among the strongest in the CMS space: Drupal Slack with 800+ channels, active drupal.org issue queues, and 100,000+ Stack Overflow questions tagged 'drupal'. DrupalCon and regional events keep core contributors and module maintainers directly accessible. Sustained activity through 2026 confirms a healthy, responsive community.

Core release velocity is strong — frequent coordinated point releases (11.4.6 and 10.6.16 on Sept 3 2026; ongoing 11.3.x/10.6.x lines) and same-day emergency security patches across all branches. Critical bugs and CVEs are addressed within days. Non-critical core issues can sit in the queue for months and contrib fix velocity depends on individual maintainer availability, so there is no SLA for the long tail.

Drupal Canvas (stable since December 2025, default in Drupal CMS 2.0 January 2026) provides genuine drag-and-drop page building with live preview, AI-assisted layout generation, and component-based construction via Single Directory Components. Site builders without Drupal experience can theme and build entire sites in-browser; content creators compose any part of the page without developers. The Mercury component library provides common building blocks (cards, testimonials, heroes, menus, accordions). AI can generate complete designed pages from text prompts using available Canvas components. Canvas is still relatively new — ecosystem maturity, template variety, and community adoption are still building, keeping this below the 70+ tier reserved for fully mature visual builders.

No native campaign management in Drupal CMS 2.0 or Canvas. Content scheduling exists via Scheduler module, but there is no campaign concept, content calendar, multi-channel coordination, or campaign analytics. The Byte template adds newsletter signup and contact forms but no campaign orchestration. Marketing teams still need external tools (HubSpot, Marketo) for campaign management.

Drupal CMS 2.0 includes pre-configured SEO recipes deployable with a single click — Metatag defaults, XML sitemaps, robots.txt management, and Schema.org markup out of the box. The AI template auto-generates alt text for accessibility and SEO. Combined with the mature contrib ecosystem (Metatag, Pathauto, Redirect, Simple XML Sitemap), SEO tooling is both comprehensive and more accessible to non-developers than before.

Webform module remains the primary form builder with conditional logic and multi-step support. Drupal CMS 2.0's Byte template adds preconfigured newsletter signup and contact forms, lowering the setup barrier. Recipe-based Mailchimp integration automatically grabs audiences and creates signup form blocks for Canvas. However, CTA management, conversion tracking integration, lead scoring, and UTM awareness remain absent natively — performance marketing beyond form capture still requires external tool integration.

Smart Content module (3.x, actively maintained) provides rule-based real-time personalization via Decision Blocks integrated with Layout Builder. Conditions include UTM parameters, geolocation, browser state, and custom rules — placing Drupal firmly in the 40–60 range for rule-based targeting. AI-driven personalization is available via the Drupal AI module connecting to 21+ AI providers, with the Orchestration submodule enabling CRM-event-triggered personalized landing pages. However, Acquia Personalization reached end-of-life on January 31, 2026, replaced by Acquia Conversion Optimization — the enterprise predictive personalization path is now in transition, creating temporary uncertainty for organizations relying on that stack.

Drupal now has a genuinely native experimentation path, not just third-party integration. The Server-side A/B Testing module reached stable 1.0.0 (April 2026): a no-SaaS-dependency framework that serves existing Drupal nodes as experiment variants (Main/Control/Alternative pages with weights), selects the variant server-side before render to eliminate flicker and layout shift, keeps users in a consistent variant, and integrates with Drupal cache contexts. A/B Paragraphs (1.0.0-beta3, February 2026) adds paragraph-level content variant testing, and smart_content_ab still covers A/B/C testing on Smart Content segments. This moves Drupal from 'experimentation only via Optimizely/LaunchDarkly' into native basic-experimentation territory. It remains below the 60+ tier because there is still no built-in statistical significance engine or automatic winner selection — GA4/GTM is the recommended (and optional) analytics layer, and enterprise-grade stats/auto-winner still lean on Optimizely.

Drupal CMS 2.0 with Canvas materially improves editorial velocity — inline editing without switching form/preview views, drag-and-drop component placement, real-time live preview, and AI page generation from text prompts accomplishing in minutes what previously took hours. Workspaces enables batched content publishing. The Byte site template provides a pre-configured marketing site installable in under 3 minutes. Initial component authoring still requires developer involvement, preventing a score in the 70+ range.

JSON:API ships in Drupal core and provides structured content delivery to any channel. GraphQL is available via contributed module. The ProseMirror module specifically targets structured JSON editing for headless/multi-channel authoring workflows. Canvas AI can generate components that fetch data from JSON:API. Drupal is web-first but the API-first core makes multi-channel delivery to apps, kiosks, digital signage, and email systems a well-supported pattern rather than an afterthought.

GA4 integration via the ga4_google_analytics module and Google Tag module supports standard gtag.js event tracking. Adobe Analytics has dedicated Drupal modules. Hotjar, Heap, and others integrate via Google Tag Manager. The Visitors module provides a lightweight native analytics layer with no external script. However, there is no native analytics dashboard within the CMS showing content performance metrics or content decay — all analytics reporting lives in external tools.

Single Directory Components (SDC) — stable in Drupal core — bundle HTML, CSS, JavaScript, and JSON schema per component, enabling component-level design token enforcement via CSS custom properties. The sdc_styleguide module provides a Storybook-like pattern library interface. The Mercury component library shipped with Canvas provides standardized building blocks. USWDS design system integration is actively documented. Design token enforcement and component palette restrictions require developer setup — there is no no-code brand guardrail system — keeping this below the 65+ tier.

Metatag module (mature contrib) provides full Open Graph and Twitter Card meta tag management with token-based automation. AddToAny Share Buttons and similar modules handle social sharing widgets. Schema.org structured data for social previews is well-supported. There is no native push-to-social or social content scheduling in Drupal — that requires integration with third-party tools (Hootsuite, Buffer). OGP management is strong; social scheduling is a gap.

Drupal's core Media module provides file management, image styles (responsive transforms at multiple breakpoints), and a unified media library UI usable across content types. Acquia DAM module synchronizes Acquia's hosted DAM with Drupal's Media Library — editors can browse and select assets without leaving the CMS, with metadata sync and image style application. Third-party DAMs (Wedia, etc.) also have Drupal integration modules. Not enterprise DAM-grade natively — rights management, advanced tagging, and usage tracking require additional investment.

Drupal's multilingual stack is industry-leading. TMGMT (Translation Management Tool) orchestrates manual, machine, and LSP-based translation workflows. New 2025–2026 modules include ai_tmgmt (auto-translation via OpenAI, Ollama, and 21+ AI providers), tmgmt_auto_translate (triggers translation on content state transitions), and ModernMT integration. LSP connectors cover Smartling, memoQ, Plunet, Wordbee, thebigword, iLangL. Locale-specific campaign variants and regional scheduling are achievable via Content Moderation workflows per locale.

Core MAP/CRM platforms are well-covered via maintained contributed modules: Salesforce Suite (bidirectional sync), HubSpot via Webform HubSpot module, Marketo via Munchkin module plus Grazitti connector, Pardot via form/API integration. Mailchimp recipe-based integration in CMS 2.0 automates audience sync and signup form creation. The Drupal AI Orchestration module enables CRM-event-triggered MAP campaign workflows. Less common platforms (Braze, Iterable, MoEngage) require custom API integration.

Commerce 3.x stable supports Drupal 10.3+ and Drupal 11 with redesigned order management UI. Commerce 3.3.0 introduced a major overhaul of the merchant administration experience with a unified single-page Order View and modal-based editing, letting merchants manage all aspects of an order from one interface. Product modeling is robust: product types, variation types with attribute-based variants, rich product descriptions via the field system, per-variation media, and entity reference relationships treat products as rich content. Not a purpose-built PIM — bulk attribute management and data quality tooling still require additional development.

Drupal Commerce provides functional but not sophisticated merchandising: product categories via taxonomy, promotional pricing via the promotions engine (discounts, coupons), cross-sell via entity references, and Views-based product listings with faceted search. Advanced merchandising like search result merchandising, algorithmic recommendations, and content-driven discovery still require custom development or third-party tools.

Drupal's commerce story remains primarily native (Drupal Commerce) rather than integration-focused. A Shopify module exists that syncs Shopify products as Drupal entities for display, but checkout still flows through Shopify — this is display integration, not content+commerce federation. Pre-built connectors for commercetools, BigCommerce, and SFCC are largely custom-built; no product picker UI or real-time sync is available.

Content-driven editorial commerce is Drupal Commerce's core differentiator and primary marketing claim. Blog posts, buying guides, lookbooks, and editorial content can embed 'Add to Cart' actions directly via entity reference and Views. Centarro (the maintainer) explicitly cites 43% higher AOV for content-commerce integration and markets editorial-first commerce as Drupal's unique advantage. This is a first-class authoring pattern, not a workaround — product references inside editorial content are natural given Drupal's unified entity system.

Cart and checkout pages in Drupal Commerce are Drupal-rendered templates, meaning trust badges, upsell banners, shipping callouts, and post-add modals can be injected via Layout Builder block placement, Drupal blocks, or theme-level modifications. This is feasible and within Drupal's architectural strengths, but it requires developer involvement for initial setup — there is no no-code UI for dragging trust badges onto the cart page. More flexible than most pure-commerce platforms but not turnkey for marketers.

Drupal Commerce core provides an order receipt email template with customizable Twig output. The commerce_order_document module generates PDF and emailed order documents from custom templates. Order workflow state transitions can trigger post-purchase content delivery via ECA (Events-Conditions-Actions). Delivery tracking pages require 3PL/ERP integration and custom development. Post-purchase email sequences and loyalty program content management are not native — they require integration with MAP tools or custom build.

Drupal Commerce has a strong, actively-deepening B2B story. Commerce Pricelist provides static and per-variation pricelists assignable per customer group for customer-specific pricing display; role-based catalog visibility gates product access and purchase by authenticated role. A full B2B portal (with quotes, purchase orders, and tiered pricing) can be built from a single Drupal Commerce install side-by-side with B2C, no custom code required — demonstrated in Centarro's February 2026 'Any Drupal Commerce Site Can Have a B2B Portal' webinar. Centarro's current roadmap explicitly expands B2B (price lists, faster reordering, improved invoicing and PO management) to close enterprise gaps. Account-based content via the Group module is a natural fit with Drupal's access control architecture.

Search API with Solr or Elasticsearch backends provides high-quality faceted search. Because Drupal Commerce product variations are entities in the same system as editorial content, blending content and product results in a unified search index is achievable by indexing both node and product variation entities. Search landing pages via Views are a standard pattern. Configuration is required — this is not a turnkey content-product search blend — but the architecture is sound and well-documented.

Contributed modules cover most promotional content scenarios: Commerce Promo Bar for sale banners with countdown, Commerce Discount Time for time-windowed promotional pricing, Commerce Cart Countdown Timer for urgency elements, Drupal Scheduler for timed editorial promotional content publish/unpublish. Time-of-day precision for promotion start/end has historically required module combination workarounds. Channel-specific targeting requires custom logic, but the baseline promotional content toolkit is solid.

Drupal Commerce supports multiple Store entities within a single installation, with per-store pricing, currency, and tax configuration. However, truly separate storefront experiences with distinct front-end presentations from one instance typically require multisite architecture or a decoupled approach using Drupal Commerce as a shared backend with separate front-end builds. Acquia Site Factory simplifies multi-site provisioning for brand-separated storefronts. This is a workable architecture but involves more setup than purpose-built multi-storefront commerce platforms.

The image_360_degree_view module supports interactive 360-degree product image viewing. AR integration was documented by Specbee in 2025 using A-Frame.js for 360-degree VR product previews. Third-party 3D configurator platforms have Drupal integration modules. Core image styles handle multiple responsive transforms. None of these are native, turnkey capabilities — all require contributed module installation and developer configuration. This places Drupal in the 'possible with development' tier for visual commerce, not the 'native or deeply integrated' tier.

Drupal Commerce's official documentation explicitly lists 'Marketplace (Multi-vendor)' as a supported use case, with coverage of vendor management, seller dashboards, and commission structures. However, no turnkey marketplace distribution exists — implementing a marketplace is a substantial custom development project using Drupal Commerce as the foundation. Multi-author content contributions and role-based seller access are viable with Drupal's architecture, but content moderation at marketplace scale and seller self-service tooling require significant custom work.

Drupal Commerce with Drupal core multilingual provides best-in-class commerce localization. Multi-currency uses the CLDR dataset (every world currency with locale-aware formatting). Product names, descriptions, and attribute labels are translatable via Drupal's i18n system. Locale-specific price display, address formats, and tax rule configurations are native in Commerce 3.x. TMGMT handles product content translation workflows with LSP connectors. Regional regulatory content (EU labels, market-specific disclaimers) is manageable via per-locale content variants.

There is no native content-to-revenue attribution or conversion tracking dashboard in Drupal or Drupal Commerce. GA4 Enhanced Ecommerce integration is possible via GTM with custom event implementation, and the GA4 module supports standard ecommerce tracking. Order reporting within Drupal Commerce has historically been noted as weak (basic order totals only). Revenue attribution to specific content pages, content-assisted conversion tracking, and product content performance metrics all require external BI tools (GA4 + Looker Studio, or Acquia's analytics layer).

Remains one of Drupal's genuine competitive strengths. The permission system with hundreds of granular permissions, node access grants for programmatic content-level control, Group module for flexible group-based access, and field-level permissions provide enterprise-grade access control. SSO integration via contrib (SAML, OpenID Connect), LDAP support, and department/audience-based content visibility make Drupal a top choice for government and enterprise intranets requiring complex access patterns. Open Intranet now includes hierarchical groups with parent/child relationships, inherited access, and audit logging.

Strong taxonomy system for hierarchical content classification, Views for dynamic content listings, Search API with Solr/Elasticsearch backends for high-quality internal search, Book module for hierarchical documentation, and Content Moderation for review/approval workflows combine well for knowledge management. Open Intranet's AI-powered RAG search adds semantic search capability for knowledge discovery. The gap remains that you assemble a knowledge base from components rather than getting a pre-built solution with lifecycle automation.

Open Intranet distribution has materially expanded its feature set with seven business recipes: Courses (learning management), Kudos (employee recognition), Ideas (innovation management), Inventory (asset management), Kanban (project management), Room Booking, and Consultation Process — all with automated workflows. Combined with the existing employee directory, LDAP/SSO integration, social interactions (comments, reactions, kudos), AI-powered RAG search, adoption analytics (RFV scoring), and multi-channel notifications, this represents a meaningfully stronger intranet platform than a generic CMS. Still labor-intensive compared to purpose-built intranet platforms for advanced scenarios like personalized dashboards.

Open Intranet provides targeted internal news with restricted access and supports multi-channel notifications via email and SMS. Basic news feeds, department announcements, and audience-targeted content publishing are achievable within Drupal's access control architecture with hierarchical group-based targeting. However, read receipts and mandatory-read acknowledgment tracking are not native — they require custom field + flag module implementation. This places Drupal in the adequate-but-not-purpose-built tier for internal comms.

Open Intranet includes a searchable employee directory with profile management. OrgChart module, Views Org Chart, and Organigrams modules render org chart visualizations from Drupal user/content data. LDAP/Active Directory integration provides authentication and basic profile sync. However, native integration with HR systems (Workday, BambooHR) for org data sync requires custom API development. The directory and org chart are buildable and functional, but not turnkey with HR system integration.

Drupal core's Workflows + Content Moderation module provides draft → review → approved → archived state progression with full revision history, author tracking, and rollback. The outdated_content module flags content requiring review after a configurable number of days. The ai_content_lifecycle module adds AI-powered content quality analysis. ECA (Events-Conditions-Actions) module enables automated archival and review trigger workflows. The notable gap is mandatory acknowledgment tracking — no native field or workflow enforces that users have read a policy document.

Drupal's role/permission system gates role-specific content access naturally. Opigno LMS (a dedicated Drupal distribution) supports structured learning paths, role-based sequential content delivery, 30/60/90-day onboarding journeys, task checklists, SCORM/xAPI, and completion tracking. Open Intranet now includes a Courses business recipe providing LMS-like functionality directly within the intranet distribution, lowering the barrier to onboarding content delivery. Without these distributions, a standalone Drupal site requires significant custom development for structured progressive onboarding.

Drupal's search ecosystem is exceptional. Search API is the standard abstraction layer with Solr and Elasticsearch backends for production-grade relevance. search_api_ltr (Learn to Rank) adds ML-based relevance tuning. The aisearch module provides RAG-powered contextual AI answers from top results. The ai_search module implements semantic vector search with Milvus, Pinecone, and Qdrant backends. Open Intranet now includes AI-powered RAG vector search out of the box. Coveo integration is documented for enterprise AI search. All paths require backend infrastructure setup.

Advanced PWA module provides push notifications, offline caching via service workers, and web app manifest — enabling a PWA with sub-2-second load on 2G and 60% reduction in server queries. Open Intranet supports multi-channel notifications via email and SMS. There is no native iOS or Android app — native mobile requires using Drupal as a headless backend with a separate React Native or Flutter build. PWA covers the primary frontline access scenarios but lacks some capabilities of a native app (deep OS integration, advanced biometrics, store distribution).

Opigno LMS — a dedicated Drupal distribution — supports SCORM/xAPI, video and PDF course content, quiz scoring, certification management, role-based learning paths, and completion tracking. Open Intranet now includes a Courses business recipe for in-intranet learning management. Moodle Sync module bridges Drupal sites with Moodle for external LMS integration. Paradiso LMS and other enterprise LMSes have Drupal connector modules. Cornerstone OnDemand and Workday Learning integration requires custom API development.

Open Social platform (deployed by the UN, Greenpeace, and the European Commission) provides real-time co-editing, comments, reactions, Organic Groups, discussion forums, polls, surveys, peer recognition, and community spaces by interest/department. Open Intranet has expanded its social layer with Kudos (employee recognition) and Ideas (innovation management) business recipes, adding structured peer recognition and idea submission workflows. This is a genuinely strong social layer — not native in core Drupal, but readily available via well-maintained distributions widely deployed in enterprise contexts.

Microsoft 365 integration is the strongest dimension: the Office 365 Connector module uses Microsoft Graph API to enable Teams messaging from Drupal, in-CMS OneDrive file access, and Teams chat/call initiation. LDAP, Azure AD, and Google authentication for SSO are standard. Open Intranet references Google Drive and Dropbox file linking. Slack integration exists but is less deeply documented. The Microsoft 365/Teams integration is genuinely useful for intranet scenarios; Google Workspace integration is lighter and primarily SSO-focused.

Content lifecycle management is well-supported: outdated_content module flags content after configurable review intervals. ai_content_lifecycle module adds AI-powered content quality and freshness analysis. ECA (Events-Conditions-Actions) module automates archival and review-trigger workflows without custom code. Drupal CMS includes a native Archived state. Content Moderation supports automated state transitions. Ownership assignment for intranet trust is achievable via author fields and revision tracking. This is one of Drupal's stronger intranet capabilities.

Open Intranet now ships Adoption Analytics with RFV (recency-frequency-value) scoring and active-user tracking, providing genuine engagement measurement within the intranet distribution — a step above generic web analytics. The Visitors module provides basic native Drupal analytics without external scripts, and the GA4 module can surface internal search keywords. Open Social has built-in engagement metrics. However, there is still no department-level content engagement dashboard, no failed search term reporting by audience, and no executive intranet ROI dashboard within core Drupal — meaningful department-level analytics still lean on external tools (GA4, Matomo, Power BI).

Multi-site provides full database-level isolation between tenants. Domain module provides logical isolation within a single installation. Acquia MEO (Multi-Experience Operations) enables running multiple Drupal sites from a single shared codebase with centralized code deployment and governance enforcement, while each site retains its own identity, content, and operational independence through site isolation. No native unified multi-tenant admin dashboard exists across all approaches without Acquia Site Factory or MEO.

Canvas introduces Single Directory Components (SDC) — self-contained, reusable packages of Twig, JavaScript, and CSS shareable across sites. Combined with multi-site shared codebase and Domain module content sharing, component reuse across brands is improving. However, there is still no native brand override system or cross-tenant component marketplace — customization relies on theme inheritance and configuration management.

Drupal CMS 2.0 positions multi-site governance as a key capability. Acquia MEO enables central teams to manage code deployments, enforce governance standards, and push updates across all sites from one place. Acquia Site Factory provides one central location to manage all sites in the portfolio with role/permission control, governance across sites and brands, and quick site provisioning. Role-based permissions with domain-aware access control and Content Moderation workflows per content type remain strong primitives. Cross-brand approval hierarchies and global policy enforcement still require Acquia's platform or custom architecture work.

Open-source licensing means zero per-brand software cost increment. Shared codebase in multi-site means shared development effort, and Drupal CMS 2.0 recipes and site templates reduce per-brand setup time. Acquia MEO allows running multiple sites from a single shared codebase reducing code maintenance overhead. However, each multi-site instance still needs its own database and hosting resources, so infrastructure costs scale per brand. Better economics than per-brand licensing platforms, but ops costs still scale.

Per-site themes with CSS custom properties implement design tokens at the brand level. SDC enables reusable components with brand-variable styling via CSS custom properties. The Mercury component library provides standardized building blocks extendable per brand. Acquia Site Studio adds a low-code visual theming layer for multi-site deployments, documented for global pharma multi-brand use cases — spinning up and styling market instances at scale. Without Site Studio, CSS/config theming per brand is the mechanism — functional but requires developer setup.

In a Drupal multisite deployment, each site can have its own TMGMT translation workflow and Content Moderation states, enabling per-brand translation approval chains. Acquia Site Factory allows centralized governance with per-site workflow overrides. Shared vs. isolated translation workflows are configurable but require deliberate architecture. Per-brand translation approval workflows and regional legal content governance are achievable but not pre-configured — they represent a meaningful setup investment.

There is no native Drupal portfolio-level analytics dashboard. GA4 multi-property setup can aggregate cross-site data in Looker Studio. Acquia's platform layer provides some centralized visibility across the portfolio. Pantheon offers basic cross-site portfolio management. Most enterprise multi-brand Drupal deployments rely on GA4 multi-property plus external BI (Looker Studio, Power BI) for cross-brand analytics — this is a genuine gap in the native platform.

In Drupal multisite, each site has its own Content Moderation workflow configuration, enabling independently configurable approval chains per brand. Acquia Site Factory and MEO allow per-site workflow isolation while sharing a common codebase with centralized governance enforcement. Independent editorial teams with separate roles, permissions, and publishing lifecycles per brand are well-supported as a standard multisite governance pattern. Central audit across all sites requires Acquia's platform, but per-brand workflow independence is genuine.

Acquia Content Hub provides corporate-to-brand content syndication with content tokenization for brand-specific overrides (logos, taglines injected into shared templates) and documented common syndication models. This is a paid Acquia product. The open-source path for cross-site content syndication requires custom REST API or webhook integration between Drupal sites. The Feeds module can consume content from other Drupal sites' JSON:API endpoints, but push-based syndication with controlled override points is not turnkey in open-source Drupal.

Drupal's GDPR/cookie compliance ecosystem is mature. The EU Cookie Compliance module is widely deployed. Drupal CMS ships with the Klaro Consent Management module for GDPR-compliant cookie management. Seers provides centralized cookie policy management for unlimited sites with geo-targeting. CookieYes also has geo-targeting for regional consent variations. Per-brand GDPR and cookie policies are manageable per site in multisite deployments. Accessibility compliance tooling (Editoria11y, Sa11y) is well-established. This is a genuine strength of the Drupal ecosystem.

SDC provides the open-source component infrastructure for centrally maintained building blocks with per-brand CSS custom property extensions. The sdc_styleguide module serves as a component documentation and versioning reference. Mercury component library in Drupal CMS 2.0 establishes a central baseline. Acquia Site Studio is the premium managed design system layer for multi-site, enabling a 'design system as a service' capability to spin up and style market instances at scale. Without Site Studio, update propagation across tenants is a manual/deployment concern rather than a platform feature.

SAML SP SSO module (miniOrange) supports SAML/OAuth/OIDC with Azure AD, Okta, OneLogin, and Salesforce — providing SSO across brand tenants. SCIM provisioning is available for automated user lifecycle management. Acquia Site Factory provides centralized admin with role-based access control across the portfolio. Acquia MEO enables central teams to manage permissions and push updates across all sites. Per-brand permission isolation in multisite is standard. Central admin managing all brands with autonomous brand teams requires Acquia Site Factory/MEO or custom cross-site admin tooling.

Drupal multisite shares a codebase, and each site can override content type configuration to add brand-specific fields without forking the base model — this is a documented and supported pattern. Fine-grained per-node, per-field, and per-user permissions support brand-specific model variations. Acquia's multi-site blueprint explicitly documents shared content types with per-brand configuration extensions. The limitation is that changes to shared content types require coordinated deployment across all brand sites rather than being self-service.

There is no native executive portfolio reporting dashboard in Drupal or any standard Drupal distribution. Acquia's platform provides some centralized visibility. Pantheon offers basic cross-site portfolio management. Content freshness by brand can be approximated using outdated_content module data per site, but aggregation requires external tooling. Publishing SLA adherence, cost allocation per tenant, and capacity planning dashboards all require GA4 multi-property plus Looker Studio or a dedicated BI implementation.

Drupal has a dedicated GDPR contributed module (v3.1.3, May 2026) providing Subject Access Requests, right-to-erasure, and personal-data export, plus widely-deployed cookie-consent modules (EU Cookie Compliance, Klaro, Seers) that record consent and offer withdrawal. However, the Drupal Association publishes no DPA since it is not the data processor — self-hosted software shifts all compliance to the operator. Rich ecosystem tooling but no platform-level guarantees keeps this mid-range.

Drupal itself does not sign a BAA and is not HIPAA compliant as software. It is routinely deployed in HIPAA-compliant environments when paired with certified hosting — Acquia offers a standard HIPAA BAA executable at contract time and is the leading commercial Drupal host with that posture. PHI handling depends entirely on hosting and custom implementation, so the software-level score stays at the top of the no-coverage band.

No FedRAMP authorization, no native CCPA/PIPEDA/LGPD tooling in Drupal core. Contributed modules cover multiple privacy regulations (GDPR, CCPA, CPRA, VCDPA, ColoPA, LGPD, PIPEDA), but these are third-party add-ons not core capabilities, and Acquia Cloud Next's FedRAMP Authorized status belongs to the hosting provider, not Drupal (per anti-pattern, cloud certs are not inherited). As of 2026, 19+ US states have active consumer-privacy laws, all of which fall to the operator to satisfy.

Drupal is open-source software — SOC 2 Type II applies to service organizations, not software packages, so no SOC 2 report exists or can exist for the software itself. Operators must obtain SOC 2 coverage from their hosting provider (Acquia, Pantheon, Upsun all hold SOC 2). Score reflects the open-source self-hosted reality per scoring guidance.

ISO 27001 is an organizational ISMS certification not applicable to open-source software, and the Drupal Association is not ISO 27001 certified. The Drupal Security Team provides structured vulnerability management via SA-CORE advisories, coordinated disclosure, a private issue tracker, and scheduled Wednesday releases — a well-regarded process — but process maturity is not a formal ISMS certification.

No PCI DSS, CSA STAR, FedRAMP, IRAP, or other certifications at the software level — all such certifications belong to the hosting/integration layer. Drupal's Security Team advisory system (coordinated disclosure, maintainer vetting, scheduled cadence, LTS support, NIS2-aligned patch management) provides strong security governance, but Drupal is used in federal and PCI environments only through certified hosts.

Self-hosted open-source gives operators complete control over data residency — any region, jurisdiction, or infrastructure with no platform constraints, no vendor-imposed data flows, and no sub-processor dependencies. This is a genuine strength of the self-hosted model, but there are no built-in contractual guarantees or guardrails, and compliant residency requires operator expertise.

The GDPR contributed module provides self-service 'forget me' and export actions handling right-to-erasure, and content export is available via core JSON:API and the Migrate API framework. However, there is no native automated retention policy, no built-in data classification, and no documented post-termination retention period — all lifecycle controls beyond the basic GDPR module require custom development.

Drupal core includes Watchdog/Database Logging (dblog) for event logging and content revision history with full user attribution, while the core Syslog module enables native external log shipping to SIEM tools (Splunk, Loggly) for forensic-grade logging. Comprehensive compliance reporting still requires contributed modules, and default dblog is row-limited and cron-pruned (not forensic) — Syslog is the recommended path for retained audit trails.

Drupal's Claro admin theme conforms to WCAG 2.1 AA with careful spacing and keyboard navigation, the Accessibility Team follows WCAG 2.2 AA as project governance policy, author-facing interfaces target ATAG 2.0, and accessibility is a formal core gate. CKEditor 5 provides reasonable screen-reader and keyboard support. However, there is no formal third-party conformance certification — accessibility work is community-driven and best-effort.

Drupal uses the US Government's OpenACR tool to generate machine-readable, living Accessibility Conformance Reports (VPAT 2.4 Section 508 or WCAG format), and the GSA maintains a VPAT/ACR for Drupal core. However, no finalized, current VPAT/ACR is published for procurement teams from the project itself, and the core issue to add a formal ACR to core (#3335955) remains in progress — placing it in the accessibility-page-without-formal-VPAT band.

The AI module (stable 1.4.6, Aug 2026; ~14K active installs) ships AI CKEditor 5 integration and a CKEditor AI Writing Agent for in-editor generation, rewriting, tone, and summarization, and the CKEditor Premium Features module 1.8.0 (GA, March 2026) adds an AI Chat for multi-turn drafting plus AI Review that gives inline grammar/tone/clarity/style suggestions against configurable rules aligned to editorial standards. Canvas AI (default page builder in Drupal CMS 2.0, Jan 2026) generates SEO titles, metadata, and full page sections from prompts constrained to approved design-system components. Centralized brand-voice 'Context Management' remains a 2026 roadmap item rather than GA, preventing a higher score.

Multiple GA alt-text modules (ai_image_alt_text, AutoAlt.ai, AltTextLab, auto_alter, AIDmi) cover single-image and bulk generation with human-in-the-loop review inside the Drupal Media Library, and AI Automators can run Automated Image Alt Text Generation as a Views Bulk Operation across entire media libraries. AI image generation (DALL-E, SDXL via Fireworks AI provider) is supported as an AI Core operation type. Not scored higher because image generation relies on external provider configuration rather than a native, seamlessly integrated DAM workflow.

The AI module ships an AI Translate submodule for one-click in-editor AI translation, CKEditor Premium Features 1.8.0 (GA) adds AI Translate across ten languages with a dedicated review-and-manage interface, and the standalone Auto Translation module supports DeepL, Google Translate, LibreTranslate, and Drupal AI APIs with real-time and bulk node/media translation preserving layout and field structure. At least ten AI-powered translation modules are tracked. Limited evidence of brand-voice preservation across locales or automated quality scoring prevents a higher score.

SEO AI and Metatag AI modules auto-generate meta descriptions, titles, alt text, and summaries directly in the edit screen; AI SEO Analyzer delivers in-node SEO analysis with stored results. AI Automators handles SEO-friendly filenames, AI Content suggests taxonomy terms, and ECA + AI extracts keywords; Canvas AI generates SEO-friendly titles and metadata during page building. On-page SEO scoring exists but is less comprehensive than dedicated SEO platforms with full schema-markup automation.

AI Automators can execute any configured rule or AI type as a Views Bulk Operation, triggering AI-driven workflows (auto-tagging, metadata extraction, bulk summarization of migrated archives) across thousands of entities at once. AI Automators also provide field-level prompt chaining and one-button in-form actions; the Orchestration module (stable 1.0.0) bridges Drupal to external workflow platforms bidirectionally, and ECA + AI wires inference to content lifecycle events. Multiple automation features are woven into editorial workflow.

AI Agents module (GA) ships built-in config agents (Field Type, Content Type) with 30+ across the ecosystem, no-code agent creation, exportable config entities, BPMN.io visual modeling, and human-oversight gates; Canvas AI agents build complete page templates from design-system components. AI 1.4.x adds a Slack Chat processor and lays groundwork for a planned AI Agents processor. Fully autonomous agents (e.g., the Views agent) remain experimental and human-in-the-loop, Background Agents remain a 2026 roadmap item, and there is no single named, marketed agent product, capping the score.

AI Content Advisor (contrib GA) covers content quality assurance, editorial reviews, compliance and accessibility auditing, brand-guideline validation, and historical comparison reports; AI Content Strategy adds strategic recommendations and AI Content Lifecycle tracks review status. However, there is still no built-in performance-driven content gap analysis, ROI attribution, or stale-content detection dashboard; the 2026 'Intelligent Website Improvements' roadmap feature remains planned, not shipped.

AI Content Advisor covers quality assurance, compliance checking, brand-guideline validation, accessibility auditing, and historical reporting, CKEditor AI Review adds inline grammar/tone/style checks against editorial rules, and AI Automators run quality/compliance operations as Views Bulk Operations across hundreds-to-thousands of pages. AI External Moderation integrates OpenAI's moderation API and AI Guardrails (global, streaming-aware, input-length checks) enforce safety/compliance without code. Not higher because dedicated thin/duplicate-content detection and the roadmap 'Advanced Governance' batch-approval/versioning features are not yet GA.

The AI Search submodule integrates AI vector embeddings with Search API using chunking strategies for long content, with VDB provider modules for Milvus, Pinecone, Qdrant, pgvector, SQLite, and Azure AI Search (SQLite still the only stable module). AI Similar Content provides real-time related-content recommendations and production semantic search runs on Acquia Cloud. Overall semantic search is assembled from multiple modules rather than a single cohesive native feature, keeping it in the beta/add-on range.

No native ML personalization engine exists in Drupal comparable to Bloomreach Loomi or Sitecore CDP. Personalization is assembled from the Orchestration module + AI Agents + ECA wired to external services (Amazon Personalize, OpenAI, TensorFlow), where AI evaluates behavior signals and adjusts recommendations via external push/pull. This is integration-driven rather than a built-in predictive ML segment/recommendation engine; Drupal's structured-data advantage provides strong foundations but no native ML layer.

The original MCP module (v1.2.3, stable) supports STDIO and HTTP transports with OAuth on Drupal 10/11 and is merging into the newer MCP Server module (built on the official PHP MCP SDK, config-driven and static approaches), which is in active development but still has no stable release. MCP Studio offers no-code MCP tool creation. Both remain community-maintained rather than official Drupal Association projects, holding the score in the community-server band even as the MCP spec finalized (2026-07-28).

BYOK/BYOM is the foundational design principle of Drupal AI: the module requires users to supply their own API keys via the Key module and bundles none. 48+ providers are supported including self-hosted options (Ollama, LMStudio, LiteLLM) and amazee.ai Private AI for full data sovereignty, with different models configurable per operation type. AI 1.4.x adds a normalized chat interface plus failover/routing groundwork and Drush generate commands for custom providers, and AI Guardrails enforce data-residency controls on outbound data.

The AI API submodule exposes providers and models via REST for headless consumption, the plugin architecture allows swapping providers without touching site logic, and ECA wires no-code-to-PHP AI workflows; AI Agents Modeler API enables BPMN.io graph-based agent workflows. AI 1.4.x adds Drush generate commands for providers/automators/guardrails plus agentic skill tooling for Claude Code and Codex that auto-generates integrations following Drupal AI best practices. Not higher because there is still no dedicated AI SDK or documented LangChain/LlamaIndex/CrewAI compatibility.

AI Guardrails enforce checks globally across AI assistants and on streaming responses in real time, add token-length input limits to block denial-of-wallet attacks, and apply compliance/data-residency policies without code. AI Logging captures full metadata (prompt, model, vendor, params, timestamps, user ID, output) for audit trails, OpenTelemetry export sends traces to Datadog/Grafana/Sentry, AI External Moderation filters content, and agents respect Drupal RBAC with human-in-the-loop by default. Not higher because hallucination detection, IP indemnification, and prompt-template governance remain absent.

The AI Observability module (1.4.x) exports spans, traces, and metrics via OpenTelemetry to production monitoring tools (Datadog, Grafana, Sentry), and a Langfuse integration module adds request tracing, token-usage analytics, response times, and model-performance benchmarks. AI Logging tracks per-user, per-provider, per-operation metrics with full request/response capture. Not higher because the admin-facing AI usage report UI (issue #3535260) remains incomplete and cost/credit management dashboards are not yet shipped.