Drupal CMS

Drupal CMS inherits Drupal 11's full Entity/Field API: 20+ core field types (text, numeric, boolean, datetime, entity_reference, file, image, link, list, email, telephone), unlimited custom content types, and schema-as-code via YAML config export and recipes. Drupal CMS 2.2 (Sep 2026) keeps Field UI and Field Group in the base template, so marketers can extend types through the UI. Polymorphic/union references still need contrib (Entity Reference Revisions), which holds it below the very top.

Core Entity Reference fields give many-to-many references across content types, with Views-based reverse traversal for querying from the other end. Entity Reference Revisions adds revision-aware references, and GraphQL contrib 5.0.0 (June 2026) improves relationship querying for decoupled builds. Not graph-native: reverse lookups must be configured in Views rather than being implicit.

Drupal Canvas composes pages from Single Directory Components and React code components with nesting, and it now maps entity fields (including multi-valued list fields) onto component props through content templates. Paragraphs remains available for field-level component content, and Layout Builder sits in core. Rich text from CKEditor 5 is still stored as HTML rather than a portable AST, which caps the score.

The Typed Data / Validation API, built on Symfony Validator, supports required, unique, length, regex, allowed-value enumeration and file type/size constraints, with custom constraint plugins for cross-field rules. Drupal CMS bundles ECA, which can add condition-based checks on save without code. Custom validators beyond that still require PHP, and there is no UI rule builder of the kind some commercial platforms offer.

Per-entity revision history with revert, Scheduler with content moderation integration, Canvas auto-save drafts, and (since Sep 2026) Trash for recovering deleted Canvas pages and content all ship preconfigured. The Diff module is not bundled, so side-by-side revision comparison needs an add-on, and there is no content branching. Moderated workflows also do not yet cover Canvas pages.

Drupal Canvas (1.12, Sep 2026) is the default editor: marketers drag and drop components on a live page, manage page variants, apply a Brand Kit (out of feature flag Sep 2026) and generate pages with Canvas AI. Drupal CMS 2.2 closes the earlier multilingual gap by bundling Canvas Translate in its new multilingual recipe, and Canvas can now preview through a decoupled frontend. Canvas Translate is still alpha and Canvas pages lack editorial workflows, so it stays below the best visual editors.

CKEditor 5 is well integrated, with per-format toolbars, media embedding, Linkit link autocomplete (bundled in Drupal CMS), code blocks and solid paste handling. Its plugin architecture is extensible. Output is an HTML blob rather than a portable AST, and custom marks or annotations need CKEditor plugin development.

Drupal CMS preconfigures the core Media Library with Focal Point, around 60 focal-point WebP image styles across nine aspect ratios wired to responsive image styles, bulk upload, SVG media, safe file deletion and AI-generated alt text. That is well beyond basic upload-and-serve. Transforms are predefined server-side derivatives rather than URL-based on-the-fly, AVIF is not configured, and there is no rights management.

There is no real-time co-editing or presence in Drupal CMS. Canvas auto-save does detect when an entity was changed elsewhere and reports a conflict instead of silently overwriting, and form auto-save protects drafts. The resolution flow itself is still behind a dev module, and CKEditor 5 real-time collaboration is a separate paid subscription that is not bundled.

Drupal CMS ships a basic editorial workflow (Draft, Published, Unpublished) auto-applied to content types, with scheduled publishing and ECA plus the Modeler UI for automated actions. Core Workflows allows extra stages and per-transition role permissions, but no review stage is preconfigured beyond what a site template adds. Workflows are not available for Canvas pages, the main marketer surface, which keeps this below the 75+ band.

Core JSON:API is spec-compliant with filtering, sorting, pagination, sparse fieldsets and includes, and GraphQL 5.0.0 went stable in June 2026. Canvas adds its own routed headless content API with structured language alternates (Sep 2026). Neither JSON:API nor GraphQL is enabled by the Drupal CMS installer, and there is no separate delivery versus management API tier.

Drupal CMS has no built-in CDN; delivery depends on the chosen host. Core cache tags enable granular purging through Varnish, Fastly or Cloudflare via the Purge ecosystem, and Canvas now attaches cache tags for Brand Kit and global CSS. There is no edge compute or guaranteed sub-second purge without hosting add-ons.

Internally, Symfony Event Dispatcher and the bundled ECA module can react to entity events without code. Outbound webhooks still come from contrib (Webhooks, Entity Webhook) and are not installed by Drupal CMS. There is no built-in retry, HMAC signing or delivery log.

Beyond core JSON:API, Canvas now has an experimental Headless module with an official SDK and adapters for Next.js, Astro, Nuxt, TanStack Start and Angular on npm, so editors can build and preview pages rendered by a decoupled app. That narrows the old gap where visual editing only worked on coupled sites. The module is experimental, the SDK is pre-1.0, it is not in the default install, rich text is HTML, and there are no mobile SDKs.

Drupal CMS 2.2.0 still ships no audience segmentation engine in any recipe or site template. Canvas 1.12 does include a first-party canvas_personalization submodule with Segment config entities and a UTM-parameter condition, but it is marked hidden (a feature flag) and Drupal CMS does not enable it. Real segmentation still runs through contrib (Smart IP/Context, External Personalization) or an external CDP, so the score stays in the external-tool band.

No personalized variant rendering is available in a default Drupal CMS 2.2 install. Canvas's hidden canvas_personalization module defines p13n switch/case components for segment-based variants, which is a promising first-party path, but it remains an unexposed feature flag with no editor preview per audience. Production personalization still needs contrib (Personalize, External Personalization) or an external decision engine.

No native A/B testing ships with Drupal CMS 2.2. Contrib options include Server-side A/B Testing, Personalize A/B and A/B Paragraphs, and hosted testing tools (VWO, Kameleoon) integrate via tag management. None are part of Drupal CMS recipes, and statistical reporting depends on external analytics.

No algorithmic recommendation engine exists in Drupal CMS. Editorial curation through entity reference fields and Views (such as the Recent Content blocks the base recipe ships) is the default path. ML-based recommendations require external services or custom builds.

The Drupal CMS Search recipe installs Search API with the database backend, auto-indexes all content types and Canvas pages on cron, and adds per-item exclusion; Canvas 1.12 added language-aware indexing for translated pages. That beats core's legacy Search module but remains database full-text: no typo tolerance, no relevance tuning UI, and facets or autocomplete need extra modules.

Because Drupal CMS search is built on Search API, swapping the DB backend for Solr, Elasticsearch/OpenSearch, Algolia, Typesense or Meilisearch is a backend change, not a rebuild. All of these backends have maintained modules with Drupal 11 support, and faceting and autocomplete are well documented. Few CMS ecosystems offer this much backend choice.

Drupal Commerce 3.x provides product catalog, cart, checkout, pricing, promotions and order management natively in the Drupal ecosystem, and recipe-based installs are available. It is not bundled in any Drupal CMS 2.2 site template or curated add-on, so it is an install-on-top capability rather than out-of-the-box.

The Shopify eCommerce module syncs products into fieldable Drupal entities with webhook/cron updates while Shopify handles checkout. BigCommerce and commercetools integrations exist in contrib but are less mature. There is no product picker at the level of dedicated composable commerce connectors.

Drupal Commerce product entities support variations, attribute-driven product types, media fields and rich text, all fieldable and revisionable. Canvas content-entity-reference props (released 1.11) let page components pull product entity data directly. It is not a PIM, but it handles editorial product content well.

Drupal CMS 2.2 has no content performance analytics. Its dashboard shows recent pages, recent content and events, plus SEO and accessibility checklists, but no page views or engagement. Contrib options such as Content Reporting and Page Performance Insight exist but are not bundled.

The curated Google Analytics add-on prompts for a Google Tag ID (GA4, GTM, Ads or Floodlight) and wires it into the Klaro consent manager so tags only fire after consent. Matomo and Segment are available as maintained contrib modules. Integration is solid for the major platforms, but event streaming from content operations still needs ECA or custom work.

Drupal supports codebase-shared multisite natively, and Domain Access lets domains share content from one database. Drupal CMS adds nothing on top: there is no multi-site console or cross-site governance, although site templates and drush site:export make spinning up consistent new sites easier.

Drupal CMS 2.2 adds a curated Multilingual recipe (content, config and interface translation, plus a setup checklist), and the installer now translates shipped configuration and pulls full interface translations. Canvas added symmetric field-level translation of page component trees, language-aware preview and a language switcher in the editor. On top of core's field-level translation and fallback, this makes it one of the strongest multilingual stacks available.

TMGMT provides TMS and MT connectors (Phrase, Smartling and XTM via provider modules, plus DeepL, Google and Microsoft), with bulk job export and import. Canvas now integrates with TMGMT, so visual page content and content templates can go through translation jobs, which closes a real gap in Canvas-built sites. TMGMT itself is not bundled in the Multilingual recipe.

Canvas 1.12 moved Brand Kit (managed colors and fonts with usage tracking) out from behind its feature flag, and page variants give theme-independent full-page templates. Both work per site, though. Cross-brand policy enforcement and shared approval workflows across brands still need Domain Access plus custom development.

The Drupal CMS base recipe preconfigures document, image, local video, remote video and SVG media types with focal point cropping, bulk media upload, file cleanup on media delete, and Trash for recovery. That is a well-organized asset library, but there is still no asset versioning UI, rights or expiry management, or metadata schemas beyond fields.

Drupal CMS ships responsive images with a broad set of preconfigured aspect-ratio image styles (1:1, 3:2, 4:3, 16:9, 9:16, hero) and focal-point cropping, and core converts styles to AVIF with a WebP fallback. Transforms are still predefined server-side styles, not URL-based on-the-fly transformations, and CDN delivery requires an external service or host.

Drupal CMS includes local video upload and oEmbed remote video media types, and remote video playback is gated by Klaro consent. There is no transcoding, adaptive streaming or caption management, so real video hosting needs Mux, Vimeo or similar.

Canvas is the default editor in Drupal CMS 2.2, and releases 1.4 to 1.12 added editable patterns, page variants (theme-independent full-page templates), Brand Kit, multi-value props and entity-data props, on top of drag-and-drop assembly with live preview and undo. The installer now offers about 20 Canvas site templates. Visual editing of decoupled frontends exists through the Canvas Headless module but is still experimental, which keeps the score below the top enterprise editors.

Drupal CMS installs Workflows and Content Moderation and uses ECA to enable moderation automatically on every new content type. Custom states, role-based transitions and revision-based audit trails come from core. There are no SLA timers, task assignment or parallel approval paths without contrib.

Scheduler handles publish and unpublish dates, integrated with moderation states, and Drupal CMS configures it automatically for new content types. There is still no calendar view or atomic release bundles in the product.

Canvas added an Activity Center with toast notifications, and Drupal CMS enables autosave on all content types. Canvas conflict detection with a side-by-side review UI has been built but still sits behind the canvas_dev_cd feature flag. There is no simultaneous editing, presence or inline commenting, so editors still rely on locking or last-write-wins.

The curated Forms recipe installs Webform with its UI, a ready contact form, and spam protection through ALTCHA (proof-of-work, replacing Friendly Captcha), CAPTCHA and Honeypot. Webform provides conditional logic, multi-step forms, submission storage with export, and handlers for CRMs and webhooks. Native form analytics are thin.

Drupal CMS ships Easy Email for templated transactional mail, but its curated add-on list contains no ESP recipe. Mailchimp, HubSpot and Marketo connectors are separate contrib modules installed through Project Browser. List sync and form-driven subscriptions work well once added, but there is no email composer or triggered campaign send built in.

Drupal CMS includes ECA (now 3.1 with a new modeler), which handles site-side event-condition-action automation, but not drip campaigns, lead scoring or nurture flows. Those come from Mautic or HubSpot integrations, which are well supported in contrib. This counts as tight integration with an external automation tool, not native automation.

No CDP is part of Drupal CMS. Segment event streaming and the External Personalization pattern for consuming CDP decisions are contrib, and Canvas's hidden personalization module only evaluates UTM-style conditions. Unified profiles and identity resolution require external tooling.

Project Browser gives in-admin access to more than 50,000 contributed modules plus a curated add-on list. The 2.2 installer offers about 21 site templates from the Drupal Association and partner agencies, including premium templates with license-key validation and a Nuxt decoupled starter. Very few CMS ecosystems are this broad.

Drupal CMS ships ECA, so content create, update, delete and state-change events can trigger HTTP calls without code, and the Webhooks contrib module adds outbound webhook configuration. There is no dedicated webhook management UI with delivery logs, signing and retry in the product; those depend on contrib configuration.

Canvas now has an experimental Headless module with a signed draft-preview model, an SDK for Next.js, Astro, Nuxt, TanStack Start and Angular, in-editor rendering of the decoupled app, multilingual preview and an OpenAPI spec. The Drupal CMS installer also offers a Nuxt decoupled starter template, and next-drupal remains mature. Branch environments and promotion still depend on the host, and Canvas Headless is not yet stable.

Drupal CMS applies core's administrator and content editor role recipes on top of one of the most granular permission systems among CMSs (per-bundle, per-operation and per-translation permissions). Field-level access, SSO (SAML, OpenID Connect, LDAP) and SCIM are available through contrib but not preconfigured. The permissions UI is complex.

Drupal CMS 2.2 (on Drupal 11.4) inherits the spec-compliant core JSON:API v1.1 module with consistent resource naming, relationships, sparse fieldsets, filtering and sorting; the contrib GraphQL module remains maintained. Canvas 1.12 adds a Canvas-owned routed content endpoint for headless apps with its own OpenAPI spec, but it sits in the experimental canvas_headless module. Core JSON:API still has no OpenAPI or interactive playground without contrib, which keeps this below purpose-built API platforms.

No vendor SLA or documented rate limits since Drupal CMS is self-hosted by default. The core engine keeps improving: Drupal 11.4 (July 1, 2026) roughly halves database queries versus 11.3 and adds Brotli compression for aggregated CSS/JS, and Drupal CMS 2.0 sites can adopt the 11.4 core line. Dynamic Page Cache and Internal Page Cache provide layered caching and JSON:API responses can sit behind Varnish/CDN, but there is still no CDN-backed delivery or built-in rate limiting out of the box — which is why this stays below CDN-delivered API platforms.

The Canvas project now publishes an official JavaScript Headless SDK on npm: @drupal-canvas/headless 0.11 (first release 2026-07-22), with adapters for Next.js, Nuxt, Astro, React, Angular and TanStack Start, alongside the official Canvas CLI and Workbench packages. The SDK is pre-1.0, backs an experimental module that Drupal CMS does not enable by default, and gets about 2K monthly downloads against 88K for the community next-drupal client. There are still no official Python, Java, .NET or Go SDKs, so this stays in the community-SDK band.

Drupal CMS can use the full Drupal.org ecosystem of 50,000+ contributed modules across payment, DAM, CRM, search, AI, email and analytics, plus a curated module set vetted for Drupal CMS. Drupal CMS 2.2.0 (2026-09-25) builds out the site template marketplace: partner templates, premium templates unlocked with license keys from third-party Composer repositories, and new bundled templates (Everbright, Mercury Demo, Forma, Lupus Decoupled Starter). Module quality varies and the maintained Drupal 11 subset is smaller, which keeps this below pure-marketplace leaders.

Extensibility is still the platform's strongest dimension. Recipes provide declarative building blocks, OOP hooks via PHP attributes modernize the hook system, and the Plugin API, Symfony DI and event subscribers extend every layer. Drupal Canvas, the default page builder in Drupal CMS, adds code components with npm imports, content entity reference props, editable page variants, external components from decoupled apps, and pluggable Canvas AI agents and tools.

SAML 2.0 (samlauth), OIDC (OpenID Connect), and OAuth2 (Simple OAuth) contrib modules are mature and available to any Drupal CMS install with no plan gating — an advantage over tier-gated SaaS competitors. MFA via the TFA module; API auth via OAuth2 bearer tokens. SSO requires contrib setup rather than turnkey configuration, which keeps this below platforms with built-in enterprise SSO.

Inherited from Drupal 11 core: hundreds of granular permissions, fully custom roles, and the node access grants system for content-instance-level access control. Field-level permissions via the Field Permissions contrib module; Content Moderation gates access by workflow state; the Group module enables audience-based access. Meets the field-level plus instance-level bar for a top-tier score; only the reliance on contrib for field-level control keeps it from higher.

Drupal CMS is open-source; certifications are hosting-provider dependent rather than inherent. Acquia holds FedRAMP + SOC 2 Type 2 + ISO 27001; Pantheon and Platform.sh hold SOC 2; Amazee.io offers ISO 27001-certified Drupal hosting. The GDPR contrib module provides consent management and DSAR tooling. HIPAA eligibility requires appropriate hosting configuration — the platform itself carries no certifications, capping this score.

Drupal core has issued 13 advisories in 2026 so far. They include the exploited highly critical PostgreSQL SQL injection (SA-CORE-2026-004), a Critical PHP object injection (SA-CORE-2026-005, June 17), and eight more moderately or less critical issues from June to September. Components that Drupal CMS bundles added their own: two Canvas improper-validation advisories (July 1) and about seven for the AI, AI Agents and AI translate modules between June and September. Coordinated disclosure, patches across all branches, the HackerOne program and Drupal CMS 2.2 encrypting AI provider keys at rest are genuine strengths, but this volume and severity push the score below the 70+ clean-history band.

Drupal CMS supports self-hosted (any PHP/MySQL environment), managed platforms (Acquia, Pantheon, Platform.sh), Docker via DDEV, and private cloud. Composer-based deployment is portable across environments with no SaaS lock-in — ideal for regulated industries. Maximum flexibility at the cost of operational complexity, which is scored in other items.

No inherent SLA — Drupal CMS is self-hosted by default and the customer owns uptime. Hosting-provider SLAs apply where used: Acquia Cloud Enterprise 99.95%, Pantheon 99.9%. No central status page because there is no central SaaS service. Scores appropriately lower than SaaS platforms per the self-hosted anti-pattern guidance.

Drupal is proven at massive scale (government portals, global media), and the core engine keeps getting leaner — Drupal 11.4 roughly halves database queries versus 11.3, with cold-cache lookups down to about a third of 11.0/10.6. Cache tag-based invalidation enables granular CDN/reverse-proxy management, and horizontal scaling patterns (load balancers, read replicas, Redis/Memcached, Varnish, CDN) are well documented. The ceiling is high but reaching it requires operational expertise rather than vendor-managed auto-scaling.

Configuration Management exports full site configuration as version-controlled YAML, and Drupal CMS 2.2 now keeps config outside the web root by default. Database and file backups use standard MySQL/PostgreSQL tooling or Backup and Migrate, and the Migrate API gives open-format portability without lock-in. The new drush site:export captures a site as a reusable template, not as a backup. RTO/RPO depend on the hosting environment and there is no built-in multi-region failover, so recovery targets are left to operators.

DDEV is still the officially recommended local environment: one command gives a Docker setup close to production, and new.drupal.org has dedicated Drupal CMS install docs. Drush covers config, database and cache work. Drupal CMS 2.2 ships a generic AGENTS.md in the project template for AI coding assistants. The Canvas CLI and @drupal-canvas/workbench give a local, Storybook-style component workflow, now including code components from headless codebases.

Configuration Management is built for CI/CD: all configuration moves through version control as YAML via drush config:export/import, and Drupal 11.4 roughly doubles the speed of recipe-based installs. Drupal CMS 2.2 adds drush recipe:compare, pm:clean, canary tests for recipe config consistency and PHPStan level 7 on its own CI, and Canvas adds a canvas:doctor health check and CLI push/pull for code components. Branch-based environments come from hosts such as Pantheon Multidev and Platform.sh, not from the platform itself.

Drupal CMS documentation at new.drupal.org covers getting started, DDEV installs, recipes and site building, and Drupal Canvas has its own docs site for code components, now extended with Canvas Headless guides such as multilingual sites. The api.drupal.org reference is thorough but auto-generated and not beginner-friendly. There is no interactive API playground and contrib module docs are uneven.

The official Canvas Headless SDK ships TypeScript declarations with framework adapters for Next.js, Nuxt, Astro, React, Angular and TanStack Start, and the Canvas compiler and CLI handle TSX code components. The SDK is pre-1.0 and experimental, and it does not generate types from the Drupal content model. Content-model types still depend on community tools such as the TypeScript Definition Generator and next-drupal, so this stays below the typed-SDK band.

Drupal CMS shipped 2.1.4 (Sept 1), 2.1.6 (Sept 23) and the 2.2.0 minor (Sept 25, 2026) with premium site templates, AI key encryption and a project-level AGENTS.md, while bundled Canvas released 1.8 through 1.12 between July and September and core shipped 11.4.0 through 11.4.8 since July 1. Held at 78 rather than 80 because the distribution itself went three months between 2.1.3 (June 2) and 2.1.4, and Drupal 12 has only reached alpha1 (Sept 2) with beta1 still untagged past its mid-September target.

drupal.org/project/cms/releases provides per-release notes, and the underlying history uses conventional-commit prefixes (feat/fix/chore/task) scoped to each sub-project with linked issue numbers, so 2.2.0 changes such as premium template licensing, config outside the web root and SA-2026-004 dependency floors are traceable. Core change records flag API changes with migration steps. Not 80+ because the distribution's published notes remain lighter than core's and do not consistently call out breaking changes separately.

The Drupal 12 plan is tracked in a public meta-issue that now states an early-December 2026 release, with public sub-issues for alpha1 (done), beta1 requirements, 12.0/11.5 beta targets and 12.0.0 release notes. The AI Initiative publishes a 2026 roadmap with named workstream leads, and all Drupal CMS work happens in public issue queues. Not higher because there is no community voting portal comparable to Canny.

Core deprecates APIs for at least a minor cycle with change records, has adopted a policy deferring disruptive 11.3 deprecations until Drupal 13, and ships 11.5 as an LTS alongside 12.0 so sites are not forced onto the new major. Drupal CMS manages transitions itself: 2.x shipped a Content-create menu shim and converted the Starter template to a monolith ahead of 11.4, and added canary tests for recipe config consistency. Not higher because Drupal 12 drops update paths below 11.3 and removes six core modules, so cross-major upgrades still need manual work.

Drupal remains one of the largest open-source CMS communities: 800+ Slack channels, tens of thousands of registered contributors on drupal.org, roughly 1% of all tracked websites and a strong position among top-traffic sites. Two annual DrupalCons (Chicago March 2026, Rotterdam September 2026) draw global participation. Not 90 because GitHub-star and npm-style signals are less prominent for a PHP platform than for JS ecosystems.

The AI Initiative drew 31 contributing agencies by DrupalCon Chicago 2026, with 28+ organizations pledging 23+ FTE contributors, and Drupal CMS 2.2.0 incorporated templates and fixes from many outside maintainers. DrupalCon Rotterdam 2026 ran a full program including specialized summits. Not higher because commentators have questioned DrupalCon attendance counting, and developer surveys show almost no participants under 21.

Drupal CMS 2.2.0 turned the installer into a template marketplace: about two dozen agency-built site templates are listed with 'Created by' attribution, and premium templates can be sold with license-key validation (Dripyard's Meridian Charter School lists at $899), alongside Varbase, Convivial Gov and Provus EDU starters. This sits on the tiered Drupal Certified Partner program and the AI Initiative workstreams led by QED42 and 1xINTERNET. Not 85+ because major global SIs such as Accenture and Deloitte are not Drupal Certified Partners.

Decades of tutorial content: thousands of YouTube videos, Udemy and LinkedIn Learning courses, DrupalCon session archives and extensive drupal.org documentation. Agencies (Droptica, Annertech, Stone Circle, 1xINTERNET, PreviousNext) publish steady 2026 coverage of Drupal 11.4, Drupal 12 and Drupal CMS 2.x, and trade press (TheDropTimes, CMSWire, CMSCritic) covers each release. Near the top of this metric among open-source CMSs; Drupal CMS-specific material on Canvas is still thinner than core coverage.

Drupal Jobs remains active and Drupal developers are available in volume across North America, Europe and South Asia, backed by Acquia certification and a deep agency bench. The generational pipeline is narrowing, with developer surveys showing no respondents under 21 and few with under a year of experience. Near-term availability is strong, so not lower.

Momentum is bifurcated. Drupal CMS keeps shipping and 2.2.0 widened vertical coverage (charter schools, healthcare, government, insurance, nonprofits) through partner templates, but aggregate Drupal share has declined from about 7% of CMS sites in 2013 to roughly 1.1 to 1.2% in 2026 and Shopify has passed it overall. Enterprise position holds at 6 to 7% of the top 10,000 sites. Not higher while aggregate share erodes and there are no published Drupal CMS install-growth figures.

The AI Initiative met its $1M goal in five months and grew to $1.5M with 31 contributing agencies by DrupalCon Chicago 2026, backed by the Drupal Association's Vision Fund. Non-profit governance plus Acquia as commercial anchor insulates the project from VC pressure, and the paid template channel in 2.2.0 opens a new revenue path for contributors. Not higher because the Association has itself flagged financial sustainability challenges.

Drupal CMS positions as the accessible, AI-ready open-source alternative to proprietary DXPs and site builders, with Canvas, bring-your-own-model AI and a growing site template catalogue giving it a clear story against WordPress and commercial DXPs. No current Gartner MQ names Drupal CMS, and aggregate market share keeps eroding. Clear differentiation keeps it above 60; lack of analyst recognition keeps it below 70.

G2 last showed 3.9/5 from roughly 445 to 470 reviews in mid-2026; it could not be re-verified this pass, so confidence drops to MEDIUM. Under the formula, sub-4.0 with fewer than 500 reviews lands in the 45 to 60 band. Reviews praise flexibility and customization and criticize the learning curve, coding requirements and hosting cost, which Drupal CMS 2.x targets but has not yet moved in aggregate.

Drupal CMS is free, open-source software, so there is no license cost to find out. Drupal CMS 2.2.0 added premium site templates, and their USD price is shown right in the installer's template picker ($899 for the one paid template listed), so the new paid option is transparent too. It stops short of the ceiling because total cost still means researching hosting and implementation separately, and both have wide price ranges.

With no license there is no API metering, no seat count and no vendor bandwidth overage, and hosting is priced on its own. The optional bundled amazee.ai provider moves to flat monthly plans after its trial, and bring-your-own-key AI means model spend goes through the buyer's own provider account. The main unpredictability is implementation: 3-year TCO commonly runs 1.7 to 2.6 times the initial build.

Every Drupal CMS feature, including Canvas, recipes, the AI tooling and 21 of the 22 site templates in the installer, is free with no tiers. Two paid add-ons now appear in the default path, though both are optional: the bundled amazee.ai AI provider is a 30-day trial that becomes a paid plan (bring-your-own-key avoids it), and 2.2.0 added license-key-gated premium partner templates. Neither locks a core production capability.

There is no software contract, so a team can stop using Drupal CMS at any time without penalty. Hosting contracts are with third parties and many bill monthly (Pantheon from ~$50/mo per site). Only enterprise managed hosts such as Acquia impose annual negotiated terms, and that is a hosting choice, not a platform requirement.

Drupal CMS is free forever for any use, including commercial, with no capability limits or time limits. The free Drupal CMS Launcher desktop app runs the full platform locally with no hosting spend and no command-line setup, and budget hosting starts around $5/month.

The free Launcher gets a working local site running in minutes, and the installer now offers 22 site templates across SaaS, nonprofit, education, government, healthcare, events, insurance and news, plus a Nuxt decoupled starter. Drupal CMS 2.2.0 added a command to export a Launcher-built site, which shortens the step from local prototype to hosted site. Production still needs hosting to be provisioned, which keeps it short of the sub-hour SaaS ceiling.

Site templates and the Canvas visual builder bring simple marketing sites down to days rather than weeks, and the template library now covers most common verticals from agencies such as Kanopi, Vardot, Annertech, Promet and Zoocha. Real custom projects still run long, though: small sites 4 to 8 weeks, content-led marketing sites 6 to 14 weeks, mid-size builds 3 to 6 months and enterprise builds 5 to 9 months.

Drupal expertise still costs noticeably more than general web development. 2026 North American rates run $80 to $250/hour, and top-tier partners bill $150 to $250/hour against $80 to $120 for general PHP developers, roughly a 25 to 50% premium. The talent pool is smaller than WordPress's, though offshore and hybrid teams ($35 to $85/hour) bring blended costs down.

Hosting is never included, so every deployment adds infrastructure spend. Small sites run on budget shared hosting ($5 to $50/mo), and Drupal CMS ships a cPanel project template aimed at that market, but most production sites use managed Drupal hosting ($50 to $500/mo) or self-managed cloud servers with a CDN. Large enterprise portals can pass $50,000/year.

Running Drupal CMS still takes steady maintenance: core and module security updates, PHP version changes and database upkeep. September 2026 alone brought three Drupal CMS patch releases and a raised core minimum for a security advisory. Automatic updates help smaller sites, but 2026 guidance still budgets 15 to 25% of build cost per year, and self-hosted sites need at least a part-time ops person.

Drupal CMS is open source and stores data in standard MySQL or PostgreSQL databases, so there is little platform lock-in. Content leaves via Views Data Export, JSON:API/REST or a database dump, and configuration exports as YAML. Moving to another platform still takes ETL work, and Canvas page layouts are stored in a Drupal-specific component structure that other systems cannot read directly.

Drupal CMS 2.0 (2026-01-28) makes Canvas the default no-code page builder in a new user's first five minutes, and an AI admin chatbot can now create content types, taxonomy terms, and fields conversationally — both lowering the entry surface. However, custom development still requires the full entity/field/hook/Views/services stack (nodes, blocks, Views, entities), keeping concept density well above the <5-concept ideal; 2026 guides still call Drupal's the steepest learning curve of any major CMS. Held at 50 because the underlying concept model is unchanged for developers doing real work.

Drupal CMS has a dedicated getting-started hub (new.drupal.org/docs/drupal-cms) with a pre-configured DDEV path, plus the official Drupal CMS Launcher, a standalone Windows/macOS/Linux desktop app that installs and opens a working Drupal CMS site with no Docker, Composer or external dependencies (v1.0.9, Mar 2026). Drupal CMS 2.2 adds a generic AGENTS.md to the project template for AI-assisted development. Not higher because there is still no in-app guided tour or structured first-party learning path; docs remain spread across new.drupal.org, project.pages.drupalcode.org and Drupalize.me, and the Launcher is positioned for evaluation and site building rather than production.

Canvas is built on Single Directory Components (Twig/JS/CSS packaged per component) and now has a first-party Canvas Headless SDK with framework adapters for Next.js, Astro, Nuxt, TanStack Start and Angular (@drupal-canvas/headless-next 0.8.0, Sept 2026), alongside JSON:API in core and next-drupal. Custom backend work still requires Drupal's Symfony/PHP entity, service and hook model, which takes a PHP developer months to reach proficiency. Up +2 for the headless adapters; capped because they are 0.x and the canvas_headless module is still flagged experimental.

The Drupal CMS 2.2 installer now offers 22 site templates from a canonical list, 21 of them free: Starter, Byte, the new Everbright and Mercury Demo templates, and partner templates from Kanopi, Vardot, OpenSense Labs, Annertech, Promet, QED42 and others, including decoupled options (Lupus Decoupled Starter, drunomics Nuxt Starter). A site template starter kit and `drush site:export` let teams package their own. Not higher because there is no vendor-maintained Next.js starter with CI/deployment config, and quality across partner templates is uneven.

Drupal CMS ships pre-configured for DDEV (.ddev/config.yaml bundled), so local setup is effectively configure drupal11 project type, `ddev start`, and `composer create-project drupal/cms`. Production still requires Composer dependency management, database config, settings.php/settings.local.php environment handling, and Drush for many admin operations — a config surface far heavier than SaaS platforms — and non-DDEV setup remains poorly documented per community reports.

Drupal's entity/field system has no field count limits, and Configuration Management (config export/import) provides version-controlled schema deployment. Field type changes on populated content still require migration scripts via the migrate API, but tooling support makes schema evolution lower-risk than platforms without migration paths. No material changes in Drupal CMS 2.0 to this layer.

Canvas is the default editing experience in new Drupal CMS installs, with drag-and-drop, live preview and responsive previews and no setup for traditional deployments. For decoupled builds, the new Canvas Headless SDK lets Canvas embed the frontend app with draft-aware preview sessions and drag-and-drop on the app's own registered components, configured largely through env vars (CANVAS_SITE_URL, CANVAS_EDITOR_ORIGINS); next-drupal 2.1.0 remains the other route. Up +2; not higher because headless visual editing is 0.x/experimental and still requires frontend code changes.

Canvas, Site Templates, and Single Directory Components mean site builders and frontend implementers need less bespoke Drupal theming knowledge — SDC's Twig/JS/CSS packaging is familiar to frontend devs. Custom module development still demands Drupal-specific PHP (entity API, services, OO hooks — still proprietary patterns) requiring 1–3 months of ramp-up, so generalist React/TypeScript developers cannot be productive on backend work without significant investment. No certification is required.

Drupal CMS 2.0's launch messaging claims marketing teams can 'launch fully branded, professional websites in days instead of weeks' using templates and Canvas, and Byte proves a solo builder can ship a production template-based site in minutes. Production implementations with custom functionality still typically need 2–3 roles (Drupal backend, frontend, DevOps/hosting), and enterprise builds more. The floor has dropped meaningfully; the ceiling for custom work has not.

Canvas gives marketers drag-and-drop page building with live preview and the Mercury component library, and the Drupal CMS 2.0 AI admin chatbot now handles structural site-building tasks — creating content types, defining taxonomy terms, adding fields, plus AI-assisted alt text — reducing developer dependency beyond just page assembly. Recipes and Site Templates further let admins add features without code. Bumped +1 as the chatbot moves structural changes (not only content) into non-developer reach; capped because custom components and third-party integrations still route through developers.

Once installed, Drupal CMS is a standard Drupal site updated the usual way, and the 2.x line has shipped as small point releases (2.1.1 through 2.1.6, then 2.2.0 on 2026-09-25) with no required migration steps. Automatic Updates handles core patch releases, and Canvas's Automatic Component Instance Updates keep prop and slot changes from breaking content. Not higher because recipes still have no update path, and the Drupal 12 upgrade (stable planned for the week of 2026-12-07, only 12.0.0-alpha1 tagged so far) is Composer-driven and drops update paths below 11.3.

The process is still exemplary: PSAs pre-announce critical release windows (PSA-2026-09-21 before the 2026-09-23 contrib batch), and Drupal CMS 2.1.6 shipped the same day to raise minimum Webform and Project Browser versions after critical RCE and CSRF advisories. The volume is the issue: 13 core advisories in 2026 (SA-CORE-2026-005 Critical, 2026-06-17) plus a steady stream against bundled modules, including Canvas (two in July), the AI module family, AI CKEditor, Editoria11y, Webform and Project Browser. Lowered because Automatic Updates only covers core patch releases, so operators still have to patch the wide contrib set Drupal CMS bundles by hand, often within tight exploit windows.

Drupal 11.5.0 ships alongside 12.0.0 as a long-term support release supported into mid to late 2028, so Drupal CMS operators can skip the next major rather than being forced onto it. Drupal 12 pushes disruptive API deprecations to Drupal 13, Drupal CMS 2.x already runs on 11.3+ so the Drupal 10 EOL (2026-12-09) does not touch it, and the 1.x to 2.0 move needed no action. Not higher because Drupal 12 still removes six core modules and update paths below 11.3, and recipes offer no upgrade path at each major step.

Drupal CMS runs the full Composer-managed PHP/Symfony stack (PHP 8.3+, MySQL/MariaDB/PostgreSQL, Twig, Guzzle) and layers on Canvas, the Mercury component library, the AI module family with provider modules, Webform, Project Browser and a long list of recipe-installed contrib. The 2026 advisory record shows how much of that tree needs patching: the bundled AI, Canvas, Webform and Project Browser modules all had advisories between June and September. Lowered slightly because the added surface is now visibly producing security churn.

The status report and Automatic Updates readiness checks remain the main built-in operational signals. Drupal CMS ships no APM, alerting or observability dashboard, so production monitoring needs external tools (New Relic, Datadog, uptime checks) or a managed host's instrumentation. Unchanged.

Drupal CMS bundles the Editoria11y accessibility checker and curated SEO tooling, and Canvas component instance updates reduce breakage when components change. Automated hygiene such as orphan detection, broken reference alerts and content expiry still needs extra contrib or manual editorial discipline. Unchanged.

Core 11.3 and later deliver the large throughput gains drupal.org describes (26 to 33 percent more requests on the same setup), which buys headroom before tuning. Cache tags and contexts, Varnish or CDN setup and database tuning remain operator work on self-hosted installs, while managed Drupal hosts absorb much of it. Unchanged.

The Drupal Association offers no support SLA for Drupal CMS; formal support comes from Drupal hosts (Pantheon, Upsun and others) or contracted agencies. That is a notable gap for a product aimed at marketers and site builders. Good support requires a paid hosting or agency arrangement. Unchanged.

Dedicated #drupal-cms-support and #drupal-cms-development Slack channels are active with Drupal Association staff taking part, and the drupal_cms and canvas issue queues move quickly. Slightly below classic Drupal because Canvas and recipe-specific answered questions are still thinner than core's two-decade archive. Unchanged.

Velocity is visibly strong: Canvas went from 1.2 to 1.12 in 2026, Drupal CMS shipped 2.1.5 to fix a fatal Starter install error and 2.1.6 on the day of the September critical contrib advisories, and 2.2.0 followed two days later. Security fixes land on pre-announced dates with clear advisories. Raised from 48 on this record; not higher because there is no SLA for non-security bugs and Drupal CMS relies on a smaller maintainer team than core.

Drupal CMS 2.0 (launched January 28, 2026) ships Canvas 1.0 — a drag-and-drop visual page builder that is now the default editing experience, offering live preview, component-based layout design, and AI-assisted page generation ('Build me a landing page'). The Byte site template provides a preconfigured B2B SaaS marketing site out of the box, and the Mercury component library supplies common building blocks. Marketers can compose pages from hero banners, card grids, and CTA blocks without touching code. Not quite 80+ because Canvas is new and the component library is still maturing.

Drupal CMS provides content scheduling (publish/unpublish dates) and content moderation workflows but has no native campaign management module — no multi-channel coordination, campaign analytics dashboard, or campaign lifecycle tooling out of the box. Contrib modules (Campaign Monitor, Mailchimp recipe) extend this but do not constitute a campaign management system. Scores above headless CMS (30–35) only because of scheduling and moderation.

Drupal CMS's base recipe, which every site template builds on, installs a full SEO stack at install time: Metatag with Open Graph and Twitter Cards, Pathauto, Redirect plus Redirect 404 tracking, Simple XML Sitemap, dedicated SEO title/description/image fields on content, the SEO Checklist, and Yoast SEO for real-time on-page analysis stored in a per-node SEO analysis field. The previous score held back because real-time SEO feedback was thought to be contrib only; Yoast SEO actually ships preconfigured. Schema.org structured data still needs an add-on, which keeps it below the high 80s.

The Forms recipe installs Webform and Webform UI with ALTCHA, CAPTCHA and Honeypot spam protection, so marketers get a real form builder and lead capture with submission views out of the box, and site templates such as Byte ship newsletter sign-up blocks. ECA (installed in the base recipe) can react to form submissions for simple follow-up automation. There is no UTM-aware content, CTA performance tracking or conversion reporting inside the CMS; conversion measurement lives in GA4 via the Google Analytics recipe.

Drupal CMS ships no personalization. Canvas has a canvas_personalization submodule, but as of Canvas 1.12.0 it is still marked hidden (a feature flag, not a supported feature), and no Drupal CMS recipe or site template enables it. Rule-based targeting requires adding the Smart Content contrib module through Project Browser. Acquia's commercial personalization products are out of scope for this entry. Scores at the top of the no-native-personalization band because a contrib path exists and Canvas personalization is actively in development.

The Server-side A/B Testing module provides a genuine Drupal-native experimentation framework: server-side variant execution to eliminate flicker, content-based experiments using existing Drupal entities as variants, SEO-safe canonical handling, and GA4/GTM integration (experiment data exposed via drupalSettings, analytics events triggered). A/B Paragraphs 1.0.0-beta3 (February 2026) enables paragraph-level content variant testing, and the stable Kameleoon module offers a third option. Statistical analysis and winner selection still live in GA4 or external tools — no native stat-sig reporting or auto-winner in core. Scores in the 'experimentation via tight integration' band rather than the no-capability floor.

Canvas is the default editor and has kept accelerating page production: content templates render node types through Canvas, page variants (Canvas 1.12) give editable full-page templates, autosave and Trash protect drafts, Media Library bulk upload and focal point cropping speed asset handling, and Scheduler with content moderation integration handles timed publishing. The AI recipe adds a Canvas page builder agent that places components from a prompt. Reaches 70 because marketers can clone, assemble and schedule pages without a developer; not higher because approval shortcuts and bulk page operations are basic.

Drupal CMS provides RESTful and GraphQL JSON:API for headless/decoupled delivery to web, mobile, and other digital channels. Content structured in Drupal can be served to multiple front-end applications, IoT devices, and digital touchpoints via APIs. However, multi-channel is API-driven requiring front-end development per channel — no native social push, email, or SMS delivery from the CMS. Scores above purely headless CMS peers because Drupal's web-first experience is mature, and API delivery to additional channels is well-documented.

Drupal CMS 2.0 includes one-click Google Analytics 4 and Google Tag Manager recipe integrations — no technical setup required. Matomo and other analytics platforms have contrib modules. However, content performance metrics (engagement data, content decay, top-performing pages) remain in external analytics tools — no native analytics dashboard within the CMS. Scores above 45 because GA4 and GTM are genuinely one-click in CMS 2.0, a meaningful improvement over manual tag installation.

Canvas 1.11 to 1.12 added Brand Kit, a site-level store of brand colors and fonts exposed as CSS variables and colour props, with usage tracking before deletion. Combined with the Mercury component library and theme-defined component props, marketers pick from approved components and brand colours rather than free-form styling. It is still guidance more than enforcement: there is no hard lock preventing an editor from choosing an off-brand layout, and code components can bypass the kit. Moves into the lower 60s on the strength of a platform-level brand token store.

The SEO Tools recipe provides OG and Twitter/X card meta tag management for social preview cards. Contrib modules exist for social sharing widgets, social feed embeds (Twitter, Facebook), and basic social media integration. No native social scheduling or push-to-social workflow exists in Drupal CMS 2.0 — social distribution requires external tools (Buffer, Hootsuite). Scores at the standard 'OG plus social sharing' tier for traditional CMS platforms.

The base recipe configures a Media Library with image, document, local video, remote video and SVG media types, bulk upload, focal point cropping, responsive image styles and media file cleanup on delete. That is a working marketing asset store with transforms, but rights management, expiry and usage reporting across pages are not included, and enterprise DAM requires an integration module. Acquia DAM is an Acquia product and does not count here.

Drupal CMS has one of the strongest multilingual frameworks in open-source CMS: core Language, Content Translation, Interface Translation, and Configuration Translation modules provide field-level translation, locale-specific content scheduling, and per-language URL structures. The Translation Management Tool (TMGMT) contrib module adds translation workflow, professional translation service integrations, and transcreation workflows. Regional cookie consent and compliance can be managed per locale via contrib. Not 65+ because transcreation UI and market-level scheduling are contrib rather than recipe-ready.

Out of the box Drupal CMS 2.x offers the Google Analytics recipe (GA4 and Google Tag Manager) and ECA, a no-code event-condition-action engine that can fire on content and form events for orchestration. The curated recommended add-ons list no longer includes a Mailchimp recipe, so email/MAP, CRM (HubSpot, Salesforce) and CDP connections all come from contrib modules added through Project Browser. Mid-band: generic event triggers plus one preconfigured MarTech category.

Drupal CMS ships no commerce: none of its recipes or its 22 installer site templates include Drupal Commerce. Commerce 3.x can be added through Composer or Project Browser and brings product types, attribute-based variations, per-variation media and taxonomy, and the redesigned 3.3 order management UI, all on the same entity system Drupal CMS uses. The capability is real and mature, but it is an add-on rather than something Drupal CMS preconfigures, and Canvas has no product-specific components, so this sits below the Drupal core entry.

Drupal Commerce provides category management, promotion and discount engines, and scheduled pricing — reasonable for an open-source commerce layer. However, there are no native search result merchandising tools, AI-driven cross-sell/upsell content blocks, or visual merchandising interfaces. Category management and promotional content scheduling exist but require custom development for advanced merchandising. Scores above 35 because Commerce's promotion engine is real.

Drupal Commerce is the natural commerce layer, but it is not bundled, and there is no maintained first-party connector for Shopify, commercetools or BigCommerce in Drupal CMS. External commerce platforms connect through contrib modules or custom JSON:API work, with no product picker in Canvas. Scores in the lower mid band: an integration path exists but is not a product capability.

With Drupal Commerce added, product entities can be referenced inside Canvas pages and editorial content, so buying guides and shoppable articles are possible. Canvas does not ship product card or add-to-cart components, and no site template demonstrates editorial commerce, so the pattern has to be built by a developer before marketers can compose it. Lands in the 'possible but not first-class' band.

Drupal Commerce provides some CMS-manageable elements in the checkout flow — trust badges, promotional messaging, and upsell blocks can be placed on cart and checkout pages via Drupal's block system. However, there is no dedicated CMS-controlled content injection layer for transactional flows — checkout templates are primarily Commerce-controlled and require developer changes to introduce CMS-managed content blocks. Scores above the floor because the underlying Drupal block architecture technically enables content in checkout, but it's not a turnkey feature.

Drupal Commerce provides a customer dashboard where order history, address book, and payment management are accessible — and CMS content can be surfaced in this area via Drupal's block/view system. Order confirmation emails are templated and can include CMS-managed content. However, CMS-managed post-purchase sequences tied to order events (delivery tracking, review solicitation, loyalty content) require custom development or contrib modules. Scores above the floor because the Commerce customer portal exists.

Drupal's role and access system handles gated documentation and account-based content, and Commerce plus the Commerce Pricelist and B2B contrib modules add customer-specific pricing and quote flows. None of this is preconfigured in Drupal CMS, which slightly lowers the score versus the previous round, but B2B builds on Drupal are well established.

Drupal Search API with Solr or Elasticsearch backend enables faceted product and content search, taxonomy-driven filtering, and search result blending of editorial and product content. Commerce-specific search landing pages are achievable via Views and Search API. Synonym management and search result merchandising require contrib customization. Scores at mid-range because Search API is powerful but requires significant configuration and no native blended content-product search UI exists out of the box.

Drupal Commerce ships with a promotion engine supporting time-based activation, percentage/fixed discounts, promo codes, tiered pricing, and scheduled pricing rules. Sale banners and countdown timers can be managed via Drupal's block and scheduling system. Channel-specific targeting requires additional configuration. The promotion engine is genuinely capable for an open-source platform. Not 60+ because channel-specific content targeting and countdown timer components require contrib.

Multiple storefronts are achievable through Drupal Commerce's multi-store support or Drupal multisite, with shared product entities and per-store editorial content. It requires Commerce plus architectural setup, and Drupal CMS adds nothing specific for storefront separation, so it sits in the 'possible with some duplication' band.

Drupal's media library supports image galleries, video embedding, and basic image transforms. Product images with multiple angles are manageable. However, there is no native 360-degree product viewer, AR/3D model support, or image hotspot functionality in Drupal Commerce or Drupal CMS 2.0. These advanced visual commerce features require third-party integrations (Cloudinary, Viuer) or custom development. Scores above the floor because multi-image galleries and video on product pages are achievable without custom code.

Drupal Commerce marketplace capability exists via contrib (Commerce Marketplace module, custom multi-vendor setups) but is not a first-class out-of-the-box feature. Seller profiles, seller-contributed product descriptions, and content moderation at marketplace scale are achievable but require significant developer configuration. No turnkey marketplace content management solution ships with Drupal CMS 2.0. Scores in the 30s — not at the floor because the Drupal ecosystem has documented B2B marketplace deployments.

The Multilingual recipe adds content, config and interface translation plus Canvas translation, which applies to Commerce product and variation entities once Commerce is installed; Commerce itself handles currencies and translatable store emails. Locale-specific product copy and regional legal blocks are therefore achievable, but market-specific promo calendars and regulatory content types must be built.

Drupal Commerce integrates with GA4 via the Google Analytics module, enabling basic ecommerce tracking (product views, add-to-cart, purchases). However, there is no native content-to-revenue attribution within the CMS — connecting which editorial pages assisted conversions requires GA4 or external analytics configuration. No content performance dashboard within Drupal CMS surfaces commerce conversion data. Scores at 35 as a CMS with GA4 ecommerce tracking available but no native content-commerce analytics.

Drupal CMS inherits core's granular access control (per-bundle and per-operation permissions, content moderation states, unpublished access) and preconfigures Administrator and Content Editor roles. Department- or team-level audience visibility needs the Group or a node-access contrib module, and SSO needs a SAML or OpenID Connect module, neither of which Drupal CMS installs. Still well above simple public/private, but the audience-based piece is an add-on.

Revisions, content moderation workflows, Scheduler, Trash for recoverable deletes, taxonomy with Tagify, and the Search recipe (Search API with a database backend) give Drupal CMS a sound base for a knowledge site. There is no review-date or expiry lifecycle, and the default database search is basic. The previous score leaned on Open Intranet's RAG search, which belongs to a separate distribution and is not part of Drupal CMS.

Drupal CMS is aimed at public marketing sites, and none of its 22 site templates is an intranet or employee portal. What exists natively is login, user pictures, an admin dashboard and comments. News feeds, employee directories, notifications and personalized dashboards must be built with Views and contrib. Mature Drupal intranet products (Open Intranet, Open Social) are separate distributions with their own install profiles, so they are not credited to Drupal CMS. Scores above headless peers because Drupal's authenticated-user model and Views make a portal buildable without a custom frontend.

Internal news can be published as articles with scheduling and moderation, and audience targeting is possible with access-control modules, but Drupal CMS has no announcement targeting, read receipts or acknowledgment tracking. The SMS and messenger features cited previously come from Open Intranet, a separate distribution. Basic news publishing with some targeting.

User accounts with pictures and fields plus Views allow a basic staff directory to be built, but Drupal CMS ships no directory, org chart or HR integration. The Healthcare template's provider directory shows the pattern for public listings, not employee directories.

Drupal provides revision history on all content, content moderation workflows (draft/review/publish), and scheduled content review via the Content Planner module. Document publishing with version control is achievable. However, there is no native mandatory-acknowledgment tracking, policy expiry reminders, or formal SOP management workflow in Drupal CMS 2.0 or Open Intranet. Policy management is possible via Drupal's content structures but requires custom configuration to match dedicated policy management tools.

Onboarding pages can be assembled from content types, Canvas pages and role-restricted menus, but Drupal CMS has no role-specific paths, checklists or progressive disclosure. The Courses recipe credited previously belongs to Open Intranet, not Drupal CMS.

The Search recipe preconfigures Search API with a database backend, indexes Canvas pages and all content types, and supports per-item exclusion; Solr or Elasticsearch backends and facets are contrib additions. There is no federation to SharePoint, Confluence or Drive and no AI relevance in the default install. Adequate internal search with basic faceting once facets are added.

Mercury and the site templates are responsive, and the Gin admin theme works on mobile, so staff can read and edit from phones. There is no native app, push notification or offline support, and the SMS reach credited previously came from Open Intranet rather than Drupal CMS.

Training content can be hosted as pages and documents, but Drupal CMS has no course, completion-tracking or LMS integration features. The previous score credited Open Intranet's Courses recipe, which is not part of Drupal CMS. Basic learning content hosting only.

Core comments are available and the Forms recipe's Webform covers polls and surveys, but Drupal CMS has no reactions, forums, peer recognition, idea submission or community spaces. Those features (Kudos, Ideas) belong to Open Intranet. Basic commenting plus surveys.

Drupal CMS can reach workplace tools through ECA actions and contrib modules for Microsoft Entra ID, Google and Slack, but it installs none of them and has no Teams or Slack cards. The Microsoft 365 and Google Workspace integrations credited previously are Open Intranet features. Basic webhook-style integration only.

Drupal CMS provides content scheduling (publish/unpublish dates), revision history, content moderation workflow (draft/review/published/archived states), and the Content Planner module for editorial scheduling. The 2026 Drupal AI roadmap proposes background agents that autonomously flag outdated articles, but these are roadmap items, not shipped features. Automated review reminders for stale content and systematic archival workflows still require contrib rather than being native to CMS 2.0. Scores at 50 because the moderation states and scheduling exist, but automated freshness enforcement needs additional setup.

Drupal intranet deployments rely on GA4 or Matomo for basic page view analytics, accessible in external tools rather than within the CMS/intranet interface. There is no native intranet analytics dashboard in Open Intranet or Drupal CMS showing department-level engagement, failed search terms, or adoption metrics. Search analytics are available in Drupal Search API but require additional configuration to surface insights. Scores at 35 — above the floor because Search API logs are available, but below 45 because there is no purpose-built intranet engagement dashboard.

Drupal Multisite provides silo-based isolation: each site gets its own database, configuration, files, and domain while sharing a single codebase. Three architectural modes exist (multi-tenant shared DB, hybrid, multi-instance). This is genuine isolation at the application level, though not a SaaS-native multi-tenant architecture with guaranteed zero data leakage at the infrastructure layer. Adequate for enterprise multi-brand but requires ops discipline to maintain isolation.

Drupal Multisite shares a single codebase, allowing themes, modules, and Canvas component libraries to be maintained centrally and consumed by all brand instances. Drupal distributions and install profiles can enforce shared design tokens and templates. Canvas 1.0 (with the Mercury component library) introduces a component system that further enables cross-brand reuse, and the Site Template Marketplace pilot (DrupalCon Chicago 2026) adds reusable site foundations. However, there is no native UI for 'global content' pushed to multiple sites — this requires custom sync or a contrib approach like Config Split. Federation is workaround-based rather than first-class.

Across a Drupal multisite estate, governance comes from a shared codebase, shared recipes and site templates (Drupal CMS 2.2 can export a site as a reusable template with drush site:export), config management and consistent roles. There is no console enforcing standards or approvals across brands. Acquia Site Factory and similar commercial layers are out of scope for this entry, so the score drops from the previous round.

Drupal CMS is open source (GPL, no per-brand licensing fees), meaning additional brands add only infrastructure costs rather than license costs. A shared multisite codebase further reduces maintenance overhead across brands. Self-hosted or cloud-hosted via commodity providers. Compare to proprietary DXPs where each brand instance can cost six-figure license fees. The economics strongly favor Drupal for multi-brand scale, limited only by developer/hosting costs which remain relatively fixed.

Each brand site can run its own theme or Mercury sub-theme and, since Canvas 1.12, its own Brand Kit of colours and fonts applied to shared components through CSS variables. Shared components with per-site brand tokens meet the platform-level theming bar, though there is no single console managing brand kits across a portfolio.

Drupal CMS supports multilingual content per brand site in a multisite setup — each site can have its own language configuration, translation workflows, and regional legal content. Per-brand translation approval workflows are achievable via content moderation and TMGMT. However, there is no native brand-locale intersection governance — managing Brand A's French translations separately from Brand B's French translations with different approval chains requires custom workflow configuration rather than being a native platform feature.

Drupal CMS has no native cross-brand analytics dashboard. Each site in a multisite setup sends analytics independently to GA4, Adobe Analytics, or other external tools. Portfolio-level aggregation requires manual setup in Google Analytics 360 (roll-up properties), custom reporting, or third-party analytics aggregation tools. The 2026 Context Control Center proof of concept shows some cross-site data awareness but is experimental. Scores at 30 — not at the absolute floor because GA4 is one-click per site and cross-property reporting is possible externally.

In a Drupal multisite setup, each site can have independently configured content moderation workflows via Config Split — Brand A can have a 4-stage editorial review while Brand B has a simple draft-publish workflow. However, central auditability across brand workflows requires custom reporting or contrib — there is no native cross-brand workflow audit console. Scores at 48 because per-brand workflow configuration is genuinely possible and documented, but central oversight is a gap.

Drupal CMS has no corporate-to-brand syndication. Sharing content between sites requires contrib such as Entity Share or custom JSON:API sync, with no override-point model. Acquia Content Hub is a commercial Acquia product and is no longer credited here.

Each site in a Drupal multisite can have independently configured cookie consent (EU Cookie Compliance module), accessibility settings, data residency preferences (via hosting), and GDPR-related modules. Per-brand compliance configuration is therefore achievable. However, there are no platform-level publishing guardrails that prevent non-compliant content from being published — compliance is enforced through configuration discipline rather than automated checks. Scores at 45 because per-brand compliance configuration is real but guardrails are manual.

A central Canvas component library (SDC and code components, with version hashes tracked per component instance), shared Mercury theme, per-site Brand Kits and exportable site templates give a workable federated design system, with updates propagated through Composer and Git. Versioning and override management happen in code, not in a design-system UI.

Multisite can share or isolate user tables, and SSO across brand sites is possible with SAML or OpenID Connect contrib modules, but Drupal CMS installs neither and has no central console for per-brand teams. Acquia Site Factory's central user management is out of scope for this entry. Basic per-site user management with limited central oversight.

Drupal's shared multisite codebase allows content types to be defined centrally and shared across brand sites. Brand-specific field extensions are achievable via contrib (Field Group, per-site Config Split) but currently require forking the base content type configuration — there is no native 'extend without fork' inheritance model for content types in Drupal. Config Split mitigates this but adds complexity. Scores at 48 because shared base models are real but per-brand extension without forking is a workaround rather than a first-class feature.

There is no portfolio reporting in Drupal CMS. Each site has its own dashboard and GA4 property, and freshness or SLA reporting across brands needs external BI. The previous score credited Acquia Site Factory's management views, which are out of scope.

Drupal CMS installs the Klaro! consent manager in its base recipe for every site template, with a placeholder privacy policy page linked from the consent modal, and Klaro 3.1 (July 2026) added category-based consent and Google Consent Mode v2. However, the Drupal Association issues no DPA, sub-processor list or residency terms for the open-source product, so GDPR contracts are the deploying organization's responsibility, and Klaro still stores consent client-side only with no server-side proof of consent (issue #3549264, open as of 2026-09), which falls short of GDPR Article 7 without added logging.

The Drupal Association does not issue Business Associate Agreements, and there is no HIPAA-eligible service offering for the open-source product. HIPAA compliance for Drupal is achieved only at the hosting/ecosystem level — e.g., Acquia signs a BAA and maps SOC 2 controls to HIPAA — not at the platform level. Drupal CMS itself provides no BAA and no documented HIPAA-eligible infrastructure.

Drupal remains the dominant CMS for US government (NASA, USDA, VA, FDA, FCC and hundreds of federal properties) and is recognized for easing FedRAMP and Section 508 compliance paths — but FedRAMP authorization applies to the hosted system boundary (Acquia, GovDataHosting), not the open-source product, so it cannot be inherited. GDPR and CCPA are achievable via the GDPR module and Klaro. No IRAP, C5, PCI-DSS, or HITRUST certifications exist for the core software.

Drupal CMS is open-source software distributed by the Drupal Association; no SOC 2 Type 2 attestation exists for the platform itself, and 2026 searches confirm no Drupal Association certification. Hosting providers (Acquia, Pantheon, Platform.sh) hold their own SOC 2 Type 2 reports covering hosting infrastructure, not the Drupal CMS software product. Per scoring guidance for open-source self-hosted platforms, the customer is wholly responsible.

No ISO 27001 certification exists for Drupal CMS as open-source software or for the Drupal Association in scope of the platform. ISO 27001-certified Drupal hosting (amazee.io, Acquia) refers to the hosting provider's ISMS, not the CMS software — the anti-pattern of inheriting hosting certifications applies. Customers deploying on certified infrastructure gain that coverage, but Drupal CMS itself neither holds nor conveys the certification.

No third-party security certifications (CSA STAR, PCI DSS, Cyber Essentials, FedRAMP) apply to the Drupal CMS open-source product. The compensating factor remains strong: a dedicated 20+ member Drupal Security Team with a structured public advisory process, scheduled security release windows, a 25-point vulnerability severity scale, and coordinated disclosure — exceeding typical open-source practice. This positions Drupal CMS above minimally-maintained OSS but well below certified commercial platforms.

As self-hosted open-source software, Drupal CMS provides complete data residency flexibility — organizations can deploy in any region or on-premises with no vendor constraining data location, an intrinsic advantage over SaaS platforms. However, there are no vendor-issued contractual residency guarantees because there is no vendor-customer hosting relationship. CDN and sub-processor data flows are determined entirely by the deploying organization's infrastructure choices.

Out of the box, Drupal CMS gives site owners full control of their data: the base recipe bundles the Trash module (soft delete and restore), core user cancellation can delete an account together with its content, and the 2.2 `drush site:export` command exports a whole site as a recipe. The GDPR module's export and 'forget me' workflows exist, but they are a contrib add-on that Drupal CMS does not install, so there is no ready-made self-service data subject request portal. Retention after deletion follows the deployer's own policy, not a vendor schedule.

The Drupal CMS base recipe enables core Database Logging (dblog), which records content operations, user actions and login events in an admin report. Core Syslog forwards logs to a SIEM through the system syslog daemon, and the stable Admin Audit Trail contrib module (1.0.13, Sept 2026) adds entity and configuration change logging, but neither is enabled by default and there is no native SIEM push connector. The tamper-evident audit_trail module is still dev-only, and dblog trims rows by count, so production deployments need a deliberate log pipeline.

Drupal's Claro admin theme documents WCAG 2.1 AA conformance, accessibility is enforced as a core merge gate (keyboard navigation, screen reader support, focus management), and the project follows the latest WCAG recommendation (2.2 AA) with an ATAG 2.0 target for authoring interfaces. Drupal CMS 2.0 (Jan 28, 2026) made the Canvas drag-and-drop visual editor the default authoring experience and added AI-assisted alt text with human review, but Canvas's accessibility conformance is not yet formally documented, preventing a higher score.

Drupal.org maintains a dedicated accessibility page documenting WCAG 2.2 AA targets and ATAG 2.0 commitments, and the GSA maintains a VPAT for Drupal core (with community OpenACR/VPAT tooling under CC BY-SA), supporting government procurement. However, no single current, product-level VPAT/ACR for Drupal CMS 2.0 (including the new Canvas builder) is published on drupal.org for direct procurement use — a formal core ACR remains an open issue (#3335955), and third-party Drupal ACRs are implementation-specific.

Drupal CMS 2.x's AI Assistant recipe preconfigures Canvas AI, which builds pages from a prompt, plus the ai_agents chatbot. The in-editor CKEditor assistant is not bundled: in AI 1.5.0 (Sept 25 2026) the ai_ckeditor submodule is deprecated in favour of a standalone project that is still at 1.5.0-beta4, and AI Automators ship in the installed ai package but come unconfigured. Scores 66 because prompt-driven page generation works out of the box, but rewriting, summarising and brand-voice controls in the editor need modules the installer does not set up.

The AI recipe installs ai_image_alt_text, grants content editors 'generate ai alt tags' by default, and gates the feature behind a Klaro consent app, so alt-text generation works on first install. AI 1.5.0 adds rich-text image description to Automators and lets providers declare their text-to-image formats. Image generation still goes through Field Widget Actions and the provider (DALL-E and similar), which the installer does not configure. Scores 54 because only alt text is turnkey, and there is no smart crop or AI video processing.

Neither the Drupal CMS AI recipe nor the multilingual recipe installs AI translation. The one-click ai_translate submodule is deprecated in AI 1.5.0 and has moved to a standalone ai_translate project (1.4.2 stable, Sept 2026), and the contrib ai_content_translation module handles structured content. Automators can batch-translate through Views Bulk Operations. Scores 55, which puts it in the basic-MT-hookup band: the capability is a stable add-on rather than part of the preconfigured localisation workflow, and it has no quality scoring or cross-locale brand-voice controls. The previous round credited contrib modules as native.

Out of the box Drupal CMS generates AI alt text, and its base recipe ships Yoast SEO real-time analysis and the SEO Checklist, but those two are rule-based, not AI. AI-written meta titles, descriptions and taxonomy tags need AI Automators to be configured on fields (AI 1.5.0 adds a setup-automators agent skill) or the contrib ai_seo or contentai modules. Scores 56, the partial-automation band. The previous round's 62 treated contrib SEO modules as bundled.

AI Automators ship in the installed ai package and support auto-tagging, summarisation, OCR, transcription and chained pipelines. They can run in bulk through Views Bulk Operations, and AI 1.5.0 adds configurable queue items per cron run and guardrails on Automators. None of it is configured by default: the Drupal CMS recipe enables only alt text, the site-building chatbot and Canvas AI. Scores 64 because the automation is broad and a site builder can enable it without code, but the installer does not build it into editorial work, and there is no smart scheduling or duplicate detection.

The AI recipe installs ai_agents and puts a 'Drupal Agent' chatbot in the admin toolbar. The chatbot runs site-building functions such as creating fields and content types, and its permissions can be set per role. Canvas 1.11 and 1.12 (Aug and Sept 2026) built a Canvas Page Agent and a component agent with a Tools dropdown and chat history, but these sit in canvas_dev_ai behind an aiDevMode flag. AI 1.5.0 added agent skills and ChatMemory plugins. Scores 55 because agents are GA and preconfigured, but the shipped agent builds sites rather than running editorial pipelines, and the page-building agent is not released.

Drupal CMS ships no AI content intelligence. The bundled ai_dashboard covers AI configuration, not content performance, and the base recipe's dashboard and SEO Checklist are not AI. Gap analysis and stale-content detection come from contrib modules such as ai_content_strategy and ai_seo, or from custom agents. Scores 38, the basic band, because nothing preconfigured does topic clustering, performance scoring or editorial prioritisation.

AI 1.5.0 adds a configurable Moderation Guardrail plugin and a semantic topic-matching mode for the RestrictToTopic guardrail. Automators can classify or validate many entities at once through Views Bulk Operations. The older ai_validations and ai_external_moderation submodules are now deprecated, and that functionality has moved into AI core and standalone projects. Drupal CMS bundles Editoria11y, but its accessibility checks are rule-based, not AI. Scores 42 because moderation-style auditing at scale is possible, but there is no brand-voice or quality audit suite.

The Drupal CMS Search recipe installs keyword-only search (search_api + search_api_db) and nothing AI. Vector search is an add-on: in AI 1.5.0 the ai_search submodule is deprecated and marked experimental, and it has moved to a standalone ai_search project still at alpha (2.0.0-alpha2, 1.3.0-alpha5 on Sept 23 2026). Backends include the stable MariaDB VDB provider (1.0.1) and Elasticsearch hybrid search. AI 1.5.0 also adds an AI reranking processor for Search API. Scores 48 because production-grade parts exist, but semantic search is an alpha add-on that nothing preconfigures.

Drupal CMS has no ML personalization engine. Canvas's canvas_personalization module is still hidden as of Canvas 1.12 (Sept 2026), and it is rule-based page variants, not predictive. Smart Content plus a custom engine remains partner-built work. Scores 28 because nothing ships for predictive segments, next-best-content or cold-start handling.

Drupal CMS does not bundle an MCP server. The contrib mcp_server module was rewritten on the official MCP PHP SDK and is now 2.0.0-beta5 (Sept 23 2026), with STDIO and HTTP transports and plugin-based tools, prompts and resources. OAuth2 scopes, the admin UI and the Tool API bridge are now separate companion projects, and Tool API is still 1.0.0-beta10. The older mcp module has been stable at 1.2.3 since Nov 2025. Scores 42, the beta band: the server does a lot, but the maintained line is not stable and nothing preconfigures it.

The Drupal CMS installer asks which provider to use, amazee.ai, OpenAI or Anthropic, and since March 2026 it encrypts provider keys at rest with easy_encryption. The amazee.ai default is a 30-day trial that becomes a paid plan. Behind that, the ai module's provider abstraction supports dozens of providers, including self-hosted Ollama and LM Studio, and provider failover. Scores 80 for real multi-provider BYOK with local-model options; not higher because data residency depends on the chosen provider.

The ai module gives developers function-call plugins, Tool API integration and drush scaffolding. AI 1.5.0 adds agent skills, ChatMemory plugins, per-instance context overrides on function calls, multimodal embeddings in the API Explorer and token-usage metadata. The Drupal CMS project template now ships an AGENTS.md for coding agents, and JSON:API is inherited from core. Scores 68 because the extension surface is rich and well documented, but Tool API is still beta and there is no dedicated AI SDK or LLM-optimised delivery endpoint.

AI 1.5.0 builds on the global guardrails, streaming guardrails and input-length limits from the 1.4 line. It adds a configurable Moderation Guardrail plugin, semantic topic matching, regex validation and guardrails on Automators, and AI calls are logged through ai_observability. The Drupal CMS recipe itself routes AI features through Klaro consent, encrypts provider keys, and sets agent permissions per role. Scores 70, top of the good-governance band; not 75+ because there is no IP indemnification or hallucination confidence scoring.

AI Metering reached stable 1.0 in August 2026 (1.0.2, Aug 14). It adds pre-flight cost estimates, per-user monthly token quotas with fallback to a local model, a usage dashboard, a per-call log with CSV export and a personal usage block for editors. AI 1.5.0 adds gen_ai.* OpenTelemetry semantic conventions to ai_observability. Scores 55 because cost, quota and per-user tracking now exist inside Drupal, but AI Metering is a contrib add-on that Drupal CMS does not install, and there is no quality-trend or prompt-effectiveness analytics.