Liferay

The 2026.Q1 LTS release makes the Objects-based Headless CMS the primary content modeling path, with legacy Web Content and Blogs moved to maintenance mode — resolving the prior dual-system ambiguity. Content structures support text, numeric, date, upload, related content, and referenced (nested) structures, plus per-field mandatory flags, localization, and workflow assignment. Schema-as-code remains unavailable — structures are defined via UI or REST API, keeping it below headless-native leaders.

Objects support one-to-many and many-to-many relationship fields, and content structures now include related-content and referenced-structure field types, making relationships first-class in the Headless CMS. There is still no graph-style traversal or polymorphic references in the way Hygraph or Contentful offer. Adequate for enterprise use but behind headless-native platforms.

The 2026.Q1 Headless CMS stores content as structured, reusable data via Objects, and content structures can embed referenced structures — providing genuine component embedding within entries. Page Fragments provide UI-level composition. Rich text output remains HTML with no Portable Text equivalent and no unlimited block nesting, which keeps it in the adequate band rather than best-in-class.

Objects support required fields, unique constraints, and picklist restrictions, with Groovy-script validations enabling cross-field and regex-style logic on self-hosted/PaaS deployments. Content structures in the new CMS expose mandatory-field configuration. SaaS deployments rely on Client Extensions for custom validation, making the story deployment-model dependent — which caps the score despite the custom-rule capability.

Liferay maintains solid versioning with full version history, draft/approved/expired states, and revert capability, and Objects support content scheduling with display, review, and expiration dates (2025.Q4+). No visual diff between versions and no content branching remain the gaps keeping it out of the 80+ band.

Page Builder with Fragments provides genuine in-context visual editing with drag-and-drop and inline content editing, including Marketplace fragment installation within the page builder and multi-step forms in the Page Editor. The experience is strong for portal/intranet use cases but remains less polished than Sitecore XM Cloud Pages or Optimizely Visual Builder.

CKEditor 5 shipped as a release feature in 2026.Q1 behind feature flag LPD-11235 and becomes the default editor in 2026.Q2+, standardizing the editing experience platform-wide — a firmer rollout than the earlier per-field upgrade. Output remains HTML rather than a portable AST, and CKEditor 4 custom plugins require rewriting, which keeps this in the standard-WYSIWYG band.

Documents and Media provides folders, metadata, versioning, and document types; Adaptive Media generates responsive image renditions; and the new CMS organizes assets into Spaces repositories with embedded performance analytics (views, downloads). Focal point cropping, URL-based transforms, and AI tagging remain absent, keeping it below the 75+ band.

Liferay does not offer real-time co-editing. Content editing uses an optimistic locking model where the last save wins, with limited warning about concurrent edits. Basic commenting and mentions exist via social features, but no presence indicators or conflict resolution for simultaneous editing.

Kaleo Workflow remains one of Liferay's genuine strengths: custom multi-step approval workflows with conditions, transitions, role-based assignments, and audit trails, definable via XML or a visual designer. The 2026.Q1 content structures support workflow assignment per structure, and workflow actions integrate with Object Actions for notifications and webhooks. Significantly more capable than most CMS platforms.

Liferay provides OpenAPI-compliant REST and GraphQL endpoints, and the 2026.Q1 LTS Headless CMS is purpose-built for API delivery of structured Object content. GraphQL APIs support versioned endpoints and siteId via key or external reference code (2025.Q3+). API design still carries Java heritage with verbose response formats, keeping it just below API-native platforms.

Liferay Cloud includes a Fastly CDN for hosted deployments; self-hosted instances require BYO CDN. Cache invalidation operates at page/resource level rather than per-content-entry, and there is no edge computing or edge-side personalization. Adequate for cloud-hosted, weak for self-hosted.

Object Actions provide webhook support delivering JSON payloads on CRUD events with optional secret-key verification, plus Client Extension and Groovy Script action types with triggers and conditions. With Objects now powering the Headless CMS, these events cover core content operations. Delivery logs, retry configuration, and payload filtering remain less mature than Contentful or Sanity.

The 2026.Q1 Headless CMS decouples content from presentation, storing Objects-based content as structured, reusable data deliverable via REST and GraphQL — and the maintenance-mode designation for legacy Web Content confirms the headless commitment. However, rich text still outputs HTML, no official SDKs exist for modern frameworks, and the headless ecosystem is young.

Liferay deprecated local segment authoring in 2026.Q1 — new installations are read-only by default, with a deprecation window of at least one year, and Analytics Cloud is now the designated home for building and managing segments. Analytics Cloud segments (behavioral, interest-based) still sync to DXP for personalization, but native in-DXP segmentation is being removed and the replacement requires separate Analytics Cloud licensing.

Liferay supports content personalization through Experience variants on Content Pages, allowing different segments to see different fragments and content, with fallback to default experience and per-segment preview. With local segment authoring deprecated in 2026.Q1, personalization now depends on Analytics Cloud–managed segments, adding licensing and setup dependency. Remains page-level rather than component-level targeting.

Liferay DXP includes A/B Testing for Content Pages with traffic splitting and conversion goal tracking; statistical significance is calculated. Only A/B tests are supported (no multivariate), results depend on Liferay Analytics Cloud integration, and A/B testing is not supported when staging is enabled. No bandit algorithms or auto-optimization exist.

Liferay Analytics Cloud provides content recommendation capabilities based on user interest scoring and ML-detected interest topics, but this is not a full algorithmic recommendation engine. Content recommendations are mostly rule-based (related assets, similar content by category) with no cold-start handling and limited placement flexibility.

Liferay has excellent built-in search powered by Elasticsearch with full-text search, faceting, type-ahead suggestions, and Search Blueprints for visual relevance tuning (query boosting, filtering, result ranking). Search analytics are available via Analytics Cloud. This is one of Liferay's genuine competitive advantages.

Liferay's search is deeply tied to Elasticsearch — custom indexing is supported, search pipeline customization is possible via Java service overrides, and Search Blueprints provide declarative configuration. The 2026.Q1 LTS includes a native Elasticsearch 8 connector. Integration with external search platforms (Algolia, Typesense) is possible but requires significant custom development — no official connectors exist.

Liferay Commerce is a fully integrated module with product catalog, pricing engine, cart/checkout, order management, and B2B/B2C/B2B2C storefront types. Unified Product Catalog Management centralizes product configuration and channel/account visibility control, and Marketplace cloud payment apps are installable directly within DXP. Strongest in B2B scenarios with price lists, account groups, and approval workflows.

Liferay's commerce strategy centers on its built-in Commerce module rather than external platform integration. There are no pre-built connectors for Shopify, commercetools, BigCommerce, or Salesforce Commerce Cloud — integration requires custom API development. The platform assumes you use Liferay Commerce rather than a third-party engine.

Liferay Commerce has purpose-built product content management with SKU-level content, product specifications, options (size/color/etc.), categories, and media per product. Rich product descriptions and variant handling are well-supported. Particularly strong for B2B catalogs with complex product hierarchies and account-specific pricing. Less polished than dedicated PIM solutions but tightly integrated.

Liferay Analytics Cloud is a separate SaaS product providing content performance dashboards, user behavior tracking, engagement scoring, and asset performance metrics. It's functional but requires separate setup and licensing, and isn't deeply integrated into the authoring UX. The analytics feel bolt-on rather than embedded intelligence; author productivity metrics are limited.

Liferay supports analytics integration via JavaScript tag injection through page configuration, enabling GA4 or similar. There are no purpose-built connectors for GA4, Adobe Analytics, Segment, or Amplitude. CDP integration is not native. Analytics middleware or event helpers are absent — effectively manual script injection.

Multi-site is a core Liferay strength via its Sites architecture — multiple sites share a single instance with independent or shared content, configurations, and themes. Virtual Instances provide tenant-level isolation, and the new Liferay CMS adds Spaces as organizational units with team-specific access under centralized control. Liferay's portal heritage gives it genuine advantage here.

Liferay supports field-level content localization with default locale and fallback chains, supporting 50+ languages out of the box, plus in-context translation for Object form fields in the Page Editor with status tracking. The new Liferay CMS (2026.Q1) provides advanced localization per Space. Locale-specific content branching and advanced translation workflows are not available.

Liferay supports machine translation via Google Cloud Translation and Microsoft Translator, and the new Liferay CMS adds translation tooling per Space. However, there are no native TMS connectors for Phrase, Smartling, Lokalise, or Transifex — these require custom integration. Translation memory is not supported.

Liferay's Sites and Virtual Instances architecture supports multi-brand scenarios — brand-level permissions via Organizations, shared content libraries with per-brand overrides, and centralized administration are achievable. However, there is no explicit 'brand' governance concept; multi-brand is implemented through Sites configuration. Design system support is limited to theme inheritance. Brand-level analytics require separate Analytics Cloud setup per brand.

Documents and Media and Asset Libraries — Liferay's established DAM stack with metadata sets, version history with checkout/check-in, file expiration/review dates, and granular permissions — entered maintenance mode in 2026.Q1 in favor of the new Liferay CMS, whose Spaces-based asset management (file types, custom fields, recycle bin, workflows) is at v1 and does not yet demonstrate feature parity. Legacy DAM remains functional but frozen; key gaps of no usage tracking and no watermarking/DRM persist across both systems.

Adaptive Media generates multiple resolution variants at upload time and serves responsive images via HTML srcset/picture elements. Liferay Cloud (PaaS/SaaS) includes a Fastly-backed CDN; self-hosted requires external CDN configuration. However, there is no focal point or smart crop capability, no on-the-fly URL parameter image transformations, and WebP/AVIF is supported as input format but not auto-converted on output.

Liferay does not provide native video hosting, transcoding, or streaming infrastructure. Production video relies on External Video Shortcuts referencing YouTube, Vimeo, Facebook, or Twitch (4 platforms out of the box), a pattern carried into the new Liferay CMS. FFmpeg integration generates preview thumbnails for locally stored video files but is not production streaming. No caption or subtitle management exists within Liferay.

Content Pages with drag-and-drop Fragments are Liferay's primary authoring surface since DXP 7.3. Fragments support inline text/image editing on the canvas, Master Pages define shared layouts, and device preview modes (desktop/tablet/mobile) are available. 2024.Q4 added multi-element selection (CTRL/SHIFT); 2025.Q3 enabled Marketplace fragment packs installable directly from the Page Editor. Limitations: Fragment creation requires HTML/CSS/JS knowledge — no purely no-code component builder; Widget portlets have a different UX paradigm.

Liferay's Kaleo Workflow engine supports fully configurable multi-step approval workflows defined in XML or via visual node-based Workflow Designer. Task assignment supports specific users, roles, or organizational hierarchy; Groovy scripts fire at state transitions; SLA tracking with Workflow Metrics shows on-time vs. overdue items, velocity, and performance by step/assignee. The new Liferay CMS also supports workflow assignment to content structures with task review/approval. Full audit trail of transitions and comments is maintained.

Liferay supports scheduled publishing via Publications (branch-based, schedule a publication to go live at specific date/time), individual web content display/expiration dates, and Object entries with Publish Date, Expiration Date, and Review Date fields. However, there is no visual content calendar — Publications shows only a table list of scheduled items. Publications entered maintenance mode in 2026.Q1 with no direct replacement announced. No release bundle dependency ordering exists.

Liferay's collaboration model is entirely asynchronous — Page Comments allow editors to leave inline comments on specific fragments in the Content Page Editor (editorial-only, not published), and workflow approvals provide a review trail. The new Liferay CMS adds 'Shared with Me' areas and access controls but still no simultaneous co-editing, no presence indicators, and no content diff/compare view between versions. Last-write-wins on concurrent edits.

Liferay's Forms application (multi-page, conditional rules, validation, data storage) is in maintenance mode as of 2024.Q4 with no further feature development. The recommended path is Objects + Form Container fragments, which supports multi-step forms via stepper components and fires webhook actions on create/update. In-context translation of form fields was added in 2025.Q1. Key gaps remain: no progressive profiling, no native reCAPTCHA, and the Objects replacement requires more assembly than purpose-built form builders.

Liferay has no native email campaign builder or ESP capabilities. The official HubSpot Lead Capture connector submits lead data to HubSpot CRM, and a HubSpot Click to Chat Marketplace app exists, but this is not marketing automation. No native connectors for Mailchimp, Marketo, Eloqua, or Salesforce Marketing Cloud — all require middleware (MuleSoft connector add-on, Tray.io, or custom API work).

Liferay has no native drip campaign engine, behavioral trigger engine, or automated nurture workflows. Analytics Cloud tracks individual engagement scores and Liferay Data Platform is positioned as a B2B CDP-adjacent data hub — but neither is a marketing automation platform. The platform fundamentally relies on external MAPs (Marketo, Eloqua, HubSpot) for automation execution.

Liferay Analytics Cloud provides behavioral data collection, unified individual profiles, and ML-powered interest topic detection with segment sync back to DXP for personalization — a role elevated by the 2026.Q1 deprecation of local segments. Liferay Data Platform adds B2B-focused account-level segmentation and hierarchical organizational data. However, Analytics Cloud is a separate paid product, and there are no native connectors to Segment.io, mParticle, or Tealium — those require custom API work.

The Liferay Marketplace lists approximately 815 applications covering collaboration, commerce, document management, forms, CRM connectors, identity, and analytics, now spanning DXP Apps, Client Extensions, Low-Code Configurations, Cloud Apps, and full Solutions. Key enterprise integrations exist for Salesforce, SAP, MuleSoft, Camunda, Microsoft Office 365, Google Drive, and Atlassian. However, the catalog is modest, fragmented between legacy module-based (.lpkg) apps and client extension–based Cloud Apps, and not all apps are maintained for the latest quarterly releases.

Liferay Objects support Webhook action types delivering JSON payloads on entry create/update/delete with a configurable HMAC secret. Object Actions support conditional triggers (Groovy/field conditions) as pre-send filters. The official Camunda connector uses Liferay webhooks to trigger BPMN processes. However, webhooks are scoped exclusively to Object events — there is no platform-wide event bus covering page publish, workflow state changes, or user events. No retry/dead-letter queue is documented.

Publications provides branch-based in-context preview within a single Liferay instance (no shareable external URL) but entered maintenance mode in 2026.Q1 and does not track changes made in the new headless Liferay CMS — the two systems remain disconnected. Classic Staging (Local Live, Remote Live) is also in maintenance mode. No shareable draft preview links for non-authenticated external stakeholders exist in either the legacy stack or the new CMS.

Liferay has a mature, granular RBAC system with Regular, Site, Organization, and Asset Library role types; custom roles with permissions down to individual asset instances; field-level permissions for custom Objects; and Space-scoped roles (Space Administrator, Content Reviewer, Member) in the new Liferay CMS. SSO is comprehensive: SAML 2.0 (built-in SP/IdP), OIDC (multi-provider), OAuth 2.0, CAS, and LDAP. SCIM became GA in 2025.Q1, enabling automated user provisioning/deprovisioning with Okta and Azure AD.

Liferay DXP 2026.Q1 introduced a new API-first headless CMS replacing legacy content tools, alongside existing OpenAPI-compliant REST and GraphQL APIs with an in-admin API Explorer. 2025.Q3+ added siteKey/externalReferenceCode support to GraphQL endpoints and 2026.Q1+ moved LAR export/import onto the batch framework. Still carries Java verbosity, nested payloads, and multiple coexisting API generations — not higher until the new CMS APIs fully supersede legacy patterns.

API performance depends heavily on deployment configuration (self-hosted vs Cloud). No published SLAs for API response times. Pagination uses standard page/pageSize parameters; batch headless APIs handle bulk operations. No CDN-backed delivery tier. Performance at scale requires careful Elasticsearch and database tuning — not inherently fast without optimization.

Official SDK coverage remains thin: Java SDK, aging Android/iOS mobile SDKs, and a JavaScript client without full TypeScript support. No official Python, Go, Ruby, or .NET SDKs. Developers can self-generate clients (java, javascript, typescript-fetch) from Liferay's OpenAPI specs via openapi-generator, but no officially published, maintained typed client packages. Lower range for this item.

Liferay Marketplace at marketplace.liferay.com has a moderate catalog. 30+ integrations are natively bundled with Liferay 7.4+, covering LDAP, Salesforce, SSO providers, OpenSearch, Solr, MuleSoft, and HubSpot. Many community-maintained connectors have varying quality and update frequency. The marketplace is less vibrant than in the 6.x/7.0 era and smaller than competitors like Contentful or Sitecore.

Client Extensions are the standard extensibility model in 2026 with four categories (frontend, microservice, configuration, batch), supporting React, Vue, Angular, and Node.js without Java/OSGi knowledge; the 2026.Q1 LTS positions them as the upgrade-safe customization path, and FE client extensions gained HMR for faster iteration. Legacy OSGi extensibility (ModelListeners, ServiceWrappers, custom portlets) remains for deep customization. Limited only by the complexity of the legacy path.

Authentication remains a genuine Liferay strength. Full SAML 2.0 (SP and IdP), OpenID Connect, LDAP synchronization, MFA support and enforcement, configurable session management, and OAuth 2.0 for API access. SSO is available without top-tier plan gating. Enterprise authentication is mature and battle-tested across large organizations. Not higher because the configuration UX is complex compared to modern SaaS platforms.

One of the most granular permission systems in the DXP space. Resource-level permissions, role-based access with Regular, Site, Organization, and Asset Library roles, individual permission assignment, content-level access control, and permission inheritance through organization hierarchy. Custom roles are fully supported. Field-level and content-instance permissions are available. The permission system is extremely flexible for complex enterprise access requirements.

Liferay's Trust Center now confirms SOC 2 Type 2 alongside ISO/IEC 27001:2022, ISO/IEC 27017:2015, ISO/IEC 27018:2019, and CSA STAR Level 1 and 2 — resolving the SOC 2 uncertainty from the prior assessment. GDPR tooling (data erasure/export), EU cloud regions, and HIPAA-eligible Cloud deployments are available. Not higher because self-hosted compliance depends on customer infrastructure and certification breadth still trails Adobe.

Liferay runs a public bug bounty on Intigriti with a formal responsible disclosure process, CVE assignment, and a maintained Known Vulnerabilities page. However, 2025 brought a steady stream of XSS CVEs (CVE-2025-43776/43777/43778/43746/43757) plus an authorization flaw (CVE-2025-62247), and CVE-2025-62248 was a regression of a previously fixed reflected XSS — a process-quality concern. Strong disclosure posture offset by high CVE volume and the regression.

Liferay offers genuine multi-deployment flexibility: Liferay SaaS (fully managed), Liferay Cloud/PaaS (AWS/Azure/GCP), self-hosted on any infrastructure, and Docker/Kubernetes deployment. The 2026.Q1 unified platform replaces separate CE/DXP installations with a single activation-key distribution across all models. Not higher because self-hosted deployments are complex and Liferay Cloud adds significant cost.

Liferay Cloud offers 99.95% uptime SLA for production with a public status page (status.liferay.cloud) including per-region uptime history. Incident record is mixed: an 11-hour partial outage in September 2025, shorter incidents in November 2025 and April 2026, and an acknowledged outage in late May 2026. Self-hosted uptime is entirely customer-managed. Not higher given the incident frequency and no vendor SLA for self-hosted.

Liferay supports horizontal scaling via clustering with cache coherence and session replication. Elasticsearch clusters handle search load. Liferay Cloud provides auto-scaling. Proven at enterprise scale (Airbus, Bosch). However, scaling requires significant infrastructure expertise — cache coherence, session management, and search index synchronization all need careful configuration. No CDN-backed content delivery layer.

Liferay Cloud provides automated backups and point-in-time recovery; self-hosted deployments need custom strategies for database, document library, and Elasticsearch indices. Content export improved in 2026.Q1+ as LAR export/import now uses the batch framework at site and instance scopes, making large exports more reliable. Still no publicly documented RTO/RPO targets, and LAR remains a proprietary format.

Liferay provides Blade CLI for scaffolding and Liferay Workspace (Gradle/Maven) for dev environment setup, with Docker-based local development. Client Extensions improved the dev loop with modern JS toolchains (Webpack, TypeScript) and HMR for frontend extensions. However, the full Liferay server must run locally, requiring significant setup and slow startup times — far from the instant-feedback loops of headless CMS platforms.

Liferay Cloud has built-in Jenkins-based CI/CD pipelines for building, testing, and deploying, with dev/UAT/prod environment management. Client Extensions integrate naturally with external CI/CD pipelines for automated deploy and rollback. Self-hosted requires custom setup; content migration via LAR remains fragile despite 2026.Q1 batch improvements. No content-as-code workflow, deploy previews, or branch environments.

Liferay Learn (learn.liferay.com) is a structured, role-based education ecosystem covering implementation, architecture, Client Extensions, headless APIs, and commerce, with structured learning paths and dedicated 2026 deprecation/breaking-change references for the Q1 LTS transition. API reference includes OpenAPI specs. Still limited by Java-centric code examples and gaps in advanced configuration docs.

Client Extensions support TypeScript via modern Webpack toolchains, and Liferay documents generating typescript-fetch clients from its OpenAPI specs via openapi-generator — a workable but DIY typed-client path. There is still no officially published typed SDK, no auto type generation from content schemas or Objects, and TypeScript is not integrated into the headless API workflow out of the box.

Liferay continues its quarterly cadence on schedule: 2026.Q1 LTS shipped March 2026 followed by 2026.Q2.0, with rapid patch releases in between (2026.Q1.5/Q1.6/Q1.7-LTS, 2026.Q2.1 within weeks of Q2.0). The GitHub repo shows commits pushed daily (last push 2026-06-10). The new headless CMS shipped GA in 2026.Q1. Not higher because quarterly major releases remain moderate vs. monthly SaaS cadences.

learn.liferay.com now maintains a structured '2026 Deprecations and Breaking Changes' reference with per-quarter sub-pages (e.g., '2026.Q1 Breaking Changes') that document maintenance-mode transitions and recommended alternatives. Quarterly release notes are published consistently. Still short of 75+ because code examples are sparse and migration guidance for complex scenarios remains incomplete.

Liferay now publishes a public roadmap at liferay.com/roadmap organized into Now/Next/Later buckets (Content Marketing Platform, AI Hub, Liferay Data Platform under 'Now') and operates a Feature Requests portal on Liferay Ask where community members vote and the product team responds with Jira ticket links. The roadmap is high-level vision without committed timelines and has no integrated voting, keeping it below the 70+ tier.

The 2026 unified platform keeps upgrades a license-key change rather than a migration, and LTS releases carry multi-year support windows. The 2026.Q1 shift of legacy tools (Web Content, Blogs, Documents & Media, Knowledge Base, Asset Libraries) into maintenance mode is documented with recommended alternatives, showing structured deprecation practice. No codemods or automated migration tooling exists, and the volume of maintenance-mode transitions imposes real planning burden on customers.

GitHub liferay/liferay-portal has 2,253 stars and 3,776 forks — modest versus headless competitors (Strapi 65k+, Payload 30k+) though the codebase is very active. The new discuss.liferay.com forum hosts the Free Tier community and shows regular activity, and liferay.dev retains a deep content archive. The Free Tier (March 2026) is drawing participants but hasn't yet materially grown the community footprint.

The new discuss.liferay.com forum shows consistent official engagement — Liferay staff post each Free Tier release (Q1.5 through Q2.1) and respond to community threads — and the Feature Requests portal gets product-team responses with Jira links. Core development remains overwhelmingly internal with rare external contributions, which caps the score.

Liferay maintains a formal partner program with a searchable directory, regional/global tiers, and developer certification, plus a new technology partnership with Camunda (June 2025). Partner strength remains concentrated in LATAM and Europe; finding Liferay-specialized agencies in North America or APAC is still harder than for AEM or Sitecore.

Third-party content is showing a modest uptick around the 2026 release model — agency blogs from Xtivia, IGNEK, Veriday, and Nirvana Lab cover 2026.Q1 LTS and the Free Tier. However, no major recent courses on Udemy/Pluralsight, sparse YouTube coverage, and much existing content still references legacy 7.x versions.

Liferay developer talent remains scarce relative to AEM, Sitecore, or mainstream JS-stack platforms, with the Java/OSGi specialization a high barrier for generalists and the pool concentrated in LATAM, Spain, and India. The Free Tier and unified platform lower the experimentation barrier, but a measurable hiring-pool effect hasn't materialized yet.

Momentum signals improved through late 2025 and 2026: IDC MarketScape named Liferay a Leader for AI-enabled full-stack CMS (2025), ISO 42001 AI-management certification landed December 2025, the Camunda partnership expanded the ecosystem, and the Free Tier shows active adoption threads each release. Headcount is stable (~1,145 as of March 2026). Visible new enterprise logo announcements remain modest, keeping this mid-range.

Liferay remains privately held (founded 2004, Pufferfish Partners sole investor) with estimated revenue of $100–500M and ~1,145 employees as of March 2026 — no layoff or acquisition news found for 2025–2026. Sustained R&D investment (unified platform, Free Tier, new CMS, AI Hub) signals health, though the R&D budget remains smaller than publicly traded competitors.

Liferay earned its 15th consecutive Gartner MQ for DXPs placement (January 2025) with improved ability-to-execute and substantially improved completeness-of-vision scores — analysts note it sits 'just shy' of the Leaders quadrant — and ranked highest of all vendors in the Authenticated Experience use case in Gartner Critical Capabilities. IDC MarketScape Leader status adds further validation. Still a Niche Player overall, with a heavily on-premise install base signaling SaaS-transition challenges.

Liferay DXP holds 4.4/5 on Gartner Peer Insights (DXP market, ~69 reviews, 83% willing to recommend) and 4.2–4.3 in the workplace social software market; the 2025 Gartner Voice of the Customer recognition (1 of 5 vendors) validates enterprise satisfaction. Reviewers praise customizability, the CMS, and vendor partnership; recurring complaints cover OOTB reporting gaps, licensing cost, and learning curve. Low review volume across G2 and Gartner caps confidence.

Liferay DXP pricing remains entirely sales-gated in 2026 — no public pricing for any enterprise tier, SaaS, or PaaS plan; buyers must email [email protected] for a quote. Enterprise subscriptions reportedly start at $25K–$50K/year but this is never officially published. Only the Free Tier has a clear price: $0. The request-a-quote model creates significant friction for comparison shopping.

Self-hosted DXP uses per-server-instance/per-environment subscription licensing that escalates with dev/staging/prod and clustering. SaaS plans use MALU (Monthly Active Logged-in Users) and APV (Anonymous Page Views) metrics, introducing usage-based variability. Predictable at base level, but multi-environment licensing and usage metrics create cost uncertainty at scale; the Free Tier provides a $0 alternative without enterprise features.

DXP 2026.Q1 unified CE and DXP into one modular platform gated by activation keys, and the Free Tier now includes clustering up to three nodes — a genuine improvement. However, security-critical features including multi-factor authentication, SAML SSO, and advanced search tuning require an Enterprise Subscription, which is exactly the problematic gating pattern (SSO/security behind enterprise). Free Tier patch access also stops at each quarter's stable release.

Liferay requires annual or multi-year subscriptions with no monthly billing option. The Free Tier provides a $0 entry point for development, PoC, and small-scale use, with an in-place upgrade path to enterprise (no reinstallation needed under the unified 2026 platform). No publicly documented startup program; exit and renewal provisions depend on contract negotiation.

The unified Free Tier gives everyone the same core DXP installation as enterprise: content management, sites, headless APIs, workflow, all supported databases, and clustering up to three nodes. However, activation keys are valid only 12 months and must be renewed via Liferay Marketplace, keys are domain-registered, patch eligibility ends at each quarter's stable release, and MFA/SAML are excluded. A capable free tier, but the renewal requirement, key gating, and Java infrastructure footprint keep it below lightweight open-source alternatives.

Getting to first deployed content with Liferay takes days to weeks, not hours. Setup requires a Java app server, database, Elasticsearch, activation key registration/deployment, content type definition, and theme work. Docker-based quickstart exists but still demands Java ecosystem knowledge. Liferay SaaS reduces infrastructure setup but onboarding and content modeling remain time-intensive versus headless CMS platforms.

Typical Liferay projects run weeks to many months: simple portals 4–8 weeks, moderate enterprise projects 3–6 months, complex integration-heavy deployments 9–12+ months. Implementation costs range $10K–$100K+. Reference patterns exist (intranet, self-service portal) but substantial customization is always required, keeping timelines in adequate-to-poor territory for an enterprise DXP.

Liferay developers command a 30–50% premium over generalist web developers. US salaries average ~$127K/year (~$61/hr), with freelance rates $60–$100+/hr and offshore rates $30–$60/hr. Java/OSGi skill requirements and a smaller talent pool drive rates up; ramp-up for experienced Java developers is 2–4 weeks for Liferay-specific patterns. Client Extensions are lowering the barrier slightly but the core remains specialist territory.

Self-hosted Liferay requires multi-component infrastructure — Java application server, MySQL/PostgreSQL database, Elasticsearch cluster, and optionally document storage and caching — putting production hosting at roughly $500–$2000+/month. Liferay SaaS bundles hosting into the subscription (no infra cost) and PaaS adds cloud infra usage on top, so total hosting spend is comparable to other enterprise DXPs regardless of path.

Self-hosted Liferay needs dedicated ops attention for server patching, database maintenance, Elasticsearch management, cache tuning, cluster management, and now quarterly-release upgrade cadence — realistically part-time to full-time DevOps depending on complexity. SaaS reduces this substantially but configuration and deployment management remain; PaaS removes infrastructure ops but not application-level operations.

Migration out of Liferay is moderately difficult. Content extracts via headless REST APIs in JSON, a positive, but content models, permissions, workflows, and configurations are not easily portable; the LAR export format is proprietary and custom code (OSGi modules, Fragments, Client Extensions) is platform-specific. The 2026 unification also means even free usage now runs the keyed DXP binary rather than a fully independent open-source build. No vendor migration tooling to competitors exists.

Concept count remains very high: Sites, Pages, Fragments, Widgets, Objects, Client Extensions, Asset Libraries, Roles — and the 2026.Q1 headless CMS adds Spaces while legacy Web Content/Blogs/Documents & Media persist in maintenance mode, so two content systems coexist during the transition. The strategic consolidation on Objects is positive long-term, but today developers must understand both worlds. Not lower because the Objects-centric direction genuinely reduces overlapping abstractions for greenfield builds.

Liferay Learn continues to expand with structured role-based paths, free courses for customers, partners, and community members, and new courses like 'Foundations of Modern Liferay Application Design' and 'Developing Standard Web Components' covering the Client Extensions/Objects approach. Certification programs remain active. Still no rapid 'build something in 30 minutes' quickstart, and onboarding assumes enterprise developer context, so it stays mid-range.

Client Extensions with Objects and fragments are now the stated predominant approach for all Liferay application development, letting developers use React, ES6+, npm tooling, Vue, Angular, or Spring Boot against headless APIs, and the 2026.Q1 headless CMS is explicitly API-first for any frontend framework. However, core platform customization still requires Java/Jakarta EE, FreeMarker remains the fragment templating language, and React components must often be wrapped as Web Components. Higher than before because mainstream-stack development is now the default path, not an alternative.

Sample Client Extension projects in Liferay Workspace remain the recommended starting points, with Blade CLI supporting quarterly release targeting and Jakarta upgrades. There are still no official Next.js/Nuxt/Astro starters, no one-click deployments, and no vendor-maintained reference frontend even for the new 2026.Q1 headless CMS — community GitHub examples fill the gap. Samples demonstrate individual features rather than complete applications.

Configuration surface remains enormous: portal-ext.properties with hundreds of settings, OSGi config, System/Instance/Site Settings, Elasticsearch, cache, and clustering configuration. The Jakarta EE migration (DXP 2025.Q3+, Portal 2026.Q1) and 2026.Q1 LTS breaking changes add upgrade configuration work for existing teams. Defaults suffice for basic operation but production tuning still requires specialist expertise.

The 2026.Q1 headless CMS standardizes content modeling on Liferay Objects — structured, reusable data with auto-generated headless and batch APIs, stable alphanumeric class names (since 2025.Q1), and data model export/import for cross-environment portability. Legacy Web Content Structure risks now matter less for new builds since Web Content is in maintenance mode. Automated migration tooling for breaking Object schema changes remains limited, and migrating existing Web Content to the new CMS is an open effort.

Page Builder still provides solid built-in preview and in-context editing for portal pages, with Marketplace fragments installable directly in the builder. The new 2026.Q1 headless CMS adds embedded analytics in the authoring UI but no evidence of a turnkey draft-preview mode for external Next.js/React frontends — headless preview still requires custom implementation via Client Extensions. Held at the same score: built-in editing remains good, headless preview remains DIY.

With Client Extensions + Objects now the predominant development approach and the 2026.Q1 headless CMS exposing standard APIs, generalist React/Node developers can handle a growing share of project work without OSGi or deep Java expertise. However, Java/Jakarta EE skills remain mandatory for core customization and upgrades, FreeMarker for fragments, and Liferay's active certification ecosystem reflects how proprietary the full skill set still is. Slightly higher because the accessible-extension surface keeps expanding.

A production Liferay deployment still realistically needs 3-5 people minimum: backend Java developer(s), frontend developer, and DevOps/infrastructure. The new headless CMS and Client Extensions shift work toward more accessible skills but don't reduce the infrastructure, upgrade (Jakarta/LTS), and platform-management burden that drives team size. SaaS hosting trims the ops role somewhat but enterprise deployments remain multi-role projects.

The 2026.Q1 headless CMS is explicitly designed to let marketers and content creators manage global content without heavy IT reliance, adding Spaces for team-organized repositories, AI-powered translation, and embedded analytics at the point of work; Page Builder with installable Marketplace fragments remains accessible to non-technical users. New content types (Objects) and custom layouts still typically require developer involvement, and authors need moderate training. Higher because the new CMS measurably improves editor self-service.

The Jakarta EE migration is now in active rollout with 2026.Q1 LTS shipped as the recommended target. Community migration guides warn to 'budget 2x your estimated time' — Jakarta transform plus Service Builder regeneration and theme rebuilds routinely surface surprises, and the Workspace Jakarta upgrade tool still requires manual review of missed references and XML descriptors. Not lower because the LTS landed with mature tooling and improved documentation; not higher because every customization-heavy install faces this compile-breaking namespace migration.

CVE volume remains high — recent disclosures include CVE-2025-62267 (stored XSS) and CVE-2025-62264 (reflected XSS), with vulnerabilities spanning 7.2 GA through 2024.Q4.7, and third-party scanners note 'growing CVE volume and limited patch paths for older versions.' Advisories are transparent (liferay.dev known-vulnerabilities) and service release updates now ship monthly (e.g., 2026.05.15). Not higher because self-hosted patching remains manual and CE non-subscribers only receive the .0 release each quarter; not lower because cadence is regular and risk-based prioritization is documented.

The mandatory javax-to-jakarta migration is now unavoidable — 2025.Q3 onward is Jakarta-only and all customers must migrate custom code, dependencies, and XML descriptors on Liferay's timeline. The 'One Platform, One Liferay' 2026 release model also restructures CE/DXP release access. Not lower because Liferay provided a multi-release runway, migration tooling, and a clear LTS landing point; not higher because the migration scope touches every line of custom javax code and is compulsory.

Self-hosted Liferay still requires Java runtime, application server, database, and Elasticsearch, and the Jakarta transition forces coordinated third-party library updates across that stack. Cloud Native Experience (Kubernetes, Terraform, Helm, Argo CD) standardizes infrastructure management for teams that adopt it, but it adds its own toolchain rather than shrinking the dependency tree. Not higher because OSGi bundle management and the multi-service footprint persist; not lower because CNE and PaaS meaningfully automate provisioning.

Cloud Native Experience now ships Unified Observability — product-aware metrics and Grafana dashboards for system health and resource consumption — plus HPA and self-healing Kubernetes, and the Liferay Cloud Console provides environment monitoring, logs, and automated backups for PaaS. Self-hosted deployments outside CNE still need custom JVM, database, and Elasticsearch monitoring. Slightly higher than before because product-aware dashboards are now a packaged offering; not higher because adoption requires the CNE/PaaS stack and bare self-hosted installs get nothing built in.

Ongoing content operations still require moderate manual attention — content structure maintenance, taxonomy management, and asset library organization need periodic work, and orphaned content or broken references require manual cleanup. No new content hygiene automation appeared in the 2025-2026 quarterly releases. Not lower because the governance tooling (workflows, expiry, permissions) is mature; not higher because hygiene relies on editorial discipline rather than automated detection.

CNE's Horizontal Pod Auto-scaling and self-healing clusters reduce capacity-management effort for cloud-native deployments, and Liferay SaaS/PaaS handle baseline scaling automatically. Self-hosted deployments still demand active cache configuration, database query optimization, Elasticsearch tuning, and JVM garbage collection management to maintain performance at scale. Not higher because custom tuning remains necessary even on managed deployments with heavy customization; not lower because the automated scaling story is genuinely improving.

Reviews remain mixed in 2026: some customers praise quick responses and helpful account representatives/architects, while others report support delays and documentation gaps. Quality support remains gated behind premium tiers (Standard/Premium/Platinum) and Community Edition has no official support. Not lower because a meaningful share of enterprise customers report genuinely good experiences; not higher because delay complaints and tier gating persist.

Liferay consolidated community chat onto Slack (~1,861 registered users) with active vendor participation around Jakarta migration and the 2026 release model, but that user count confirms a thin community relative to WordPress or Drupal ecosystems. Stack Overflow coverage is moderate for common questions and sparse for advanced topics. Not lower because vendor staff actively engage on Slack and liferay.dev blogs; not higher because overall community volume keeps declining and G2 reviewers call the community limited.

Quarterly releases plus a monthly service-release stream (e.g., 2026.05.15 service release updates) give subscribers a regular fix pipeline, and steady CVE remediation shows active security response. However, CE non-subscribers only receive the .0 release each quarter, so bug fixes can wait months, and non-critical bugs still persist across multiple quarterly releases. Not higher because community-reported issue responsiveness remains mixed and feature requests move slowly.

Liferay's Page Builder with Fragments provides drag-and-drop layout and in-context editing. The Content Marketing Platform (CMP) lets marketers launch landing pages and microsites without leaving the platform, and automated A/B testing is available for conversion optimization. The new headless CMS released in 2026.Q1 does not change the page-building experience. Fragment development still requires developer involvement for new layouts, keeping it below dedicated marketing DXPs like Optimizely or Sitecore XM Cloud.

Liferay lacks a dedicated campaign management module with campaign calendars or multi-channel coordination. The CMP adds content workflow capabilities and the Content Dashboard Performance tab provides asset-level engagement metrics, but content scheduling remains the primary campaign-like feature. Marketing teams still require external tools for true campaign orchestration.

Liferay supports meta title/description per page, sitemap generation, OpenGraph metadata, and friendly URL management. The Page Audit tool (powered by Google PageSpeed Insights) provides SEO and accessibility recommendations per page. The AI Assistant helps craft SEO-friendly headlines and meta descriptions. Structured data (JSON-LD) still requires custom implementation, redirect management is basic, and there is no SEO scoring or keyword validation tool.

A/B testing for page optimization and AI Insights surfacing behavior-driven improvement opportunities are available, with the Forms module handling basic lead capture. However, there is no native CTA management, no conversion tracking, no UTM parameter awareness, and no lead scoring or nurture workflows, making external tooling necessary for performance marketing.

Liferay retains a mature personalization engine: audience segmentation by behavior, demographics, location, and custom attributes; content page personalization via Experiences; AI-driven personalized dashboards; and real-time segment evaluation. However, as of 2026.Q1 local segment authoring inside DXP is deprecated — new installations are read-only by default and segmentation work must move to Liferay Analytics Cloud. While Analytics Cloud is first-party, this adds a SaaS product dependency for self-hosted customers and transition friction during the deprecation window, slightly weakening the previously fully self-contained personalization story.

Liferay provides native A/B testing for content pages, testing headline variants, layouts, and CTAs with statistical significance tracking and winner detection. Tests are managed within the platform and synced automatically with Analytics Cloud for result reporting against bounce rate and click metrics, with winner publishing as the new default. The capability is solid for content-level experimentation but does not extend to full-funnel or server-side feature flagging.

CMP provides content calendaring and workflow to reduce cycle time. AI Assistant helps draft blog posts, knowledge base articles, and structured page layouts, accelerating initial content creation. Fragment-based page building allows template cloning and reuse. The new object-based headless CMS (Release status in 2026.Q1) promises a more modern authoring interface but is too new to change velocity outcomes, and legacy Web Content is now in maintenance mode, creating a transitional period. New page layouts still require developer-built Fragments.

Liferay's API-first architecture enables create-once, publish-everywhere delivery, and the new 2026.Q1 headless CMS strengthens this: content is stored as structured, reusable data built on Liferay Objects and consumable on DXP pages, external applications, or any channel via headless APIs. CMP is built for multichannel and multisite management, enabling content distribution to web, mobile apps, and connected devices from a single authoring environment.

Liferay Analytics Cloud integrates with DXP to provide visitor behavior tracking, content performance metrics, and segment-level analytics within a Liferay-native interface. The Content Dashboard Performance tab surfaces per-asset engagement metrics. Page Audit tool provides SEO performance signals. However, Analytics Cloud is a separate SaaS product and connection with GA4, Adobe Analytics, or Mixpanel requires tag-based integration and relies on external dashboards for reporting.

Style Books enforce design tokens (colors, typography, spacing) at the site level, and Fragment Libraries provide approved, reusable components that constrain what marketers can assemble. Brand guardrails are enforced through the component palette rather than locked style overrides. This is functional but marketers can still override some styling within allowed component configurations, making it short of full lock-down brand governance.

Liferay supports Open Graph and Twitter Card metadata per page, enabling proper social preview cards across platforms. There is no native social scheduling, push-to-social workflow, or social media management integration. UGC embeds require custom development. Social proof widgets are not native. Basic OG/meta tag management covers the fundamentals but no social publishing workflow is available.

Liferay Documents and Media provides a functional DAM layer with Asset Libraries for cross-site sharing, image transformations, tagging, metadata, and search. The AI Assistant can generate image alt text and descriptions. Documents and Media moved to maintenance mode in 2026.Q1 with asset management transitioning to the new headless CMS, but existing capabilities remain supported. Rights management and usage tracking are limited compared to dedicated DAM platforms.

Liferay provides multi-language content management, translation workflows with third-party connector support, locale-specific URL management, and per-locale content scheduling. Content can be maintained in multiple languages with approval workflows per locale. However, transcreation-specific workflows (market-level campaign variants, region-specific promo calendars) are not native — generic localization is applied to marketing content rather than purpose-built marketing localization.

Liferay offers out-of-the-box connectors for Salesforce (CRM), SAP, and Microsoft 365, with flexible API/webhook integration for other systems. Analytics Cloud provides some behavioral data. However, there are no pre-built connectors for marketing automation platforms (Marketo, Pardot, Eloqua, HubSpot), ad platforms, or CDP systems. MarTech integration typically requires custom API development or third-party iPaaS solutions, limiting the native connector breadth.

Liferay Commerce provides genuine product content management with catalogs, SKU/variant modeling, product specifications, options, and rich media per product. The 2026 commerce roadmap emphasizes advanced PIM-style catalog tooling, centralized product configuration management at scale, and bulk updates with master configurations. ML-based predictive analytics power personalized product recommendations and order forecasting. B2B-specific features — customer-specific pricing, multi-level account hierarchies, account-gated catalog views — remain strong differentiators.

Liferay Commerce provides category management, product display widgets, ML-powered suggested product groups, personalized recommendations, and smart loyalty score alerts. These are functional for B2B catalog merchandising but search merchandising remains basic and content-driven commerce experiences (e.g., shop-the-look, editorial overlays) still require custom development.

Liferay's commerce strategy is self-contained — Liferay Commerce is the intended path rather than integrating with external platforms. There are no pre-built connectors for Shopify, commercetools, BigCommerce, or Salesforce Commerce Cloud, and integration with these platforms requires custom API development. This is a weakness for composable commerce architectures.

Liferay's integrated CMS and Commerce layer allows combining editorial content with product data on the same page — product display widgets can be embedded within CMS content pages. Buying guides and product-adjacent editorial are achievable. However, shoppable content (inline add-to-cart within editorial), lookbooks, and shop-the-look experiences are not first-class authoring patterns and require custom Fragment development.

Because Liferay Commerce is native to the DXP, checkout pages are standard CMS pages built with the Page Builder. CMS-managed content — trust badges, promotional banners, upsell widgets — can be placed in cart and checkout pages through the same authoring interface. This is a meaningful advantage over headless-only platforms. However, injecting dynamic CMS content into specific transactional flow steps (e.g., post-add modals) without template changes still requires developer work.

Liferay Commerce includes an account portal where customers can view order history, credit limits, and account documentation — providing basic post-purchase content. Smart loyalty score alerts and ML-driven recommendations can surface post-purchase upsell content. However, CMS-managed order confirmation pages, delivery tracking content, product onboarding sequences, and review solicitation workflows triggered by order events are not native capabilities.

B2B commerce content is Liferay Commerce's strongest suit. Native capabilities include customer-specific pricing display, multi-level account hierarchies with account-gated catalog visibility, quote-request workflows, contract pricing, spec sheets per product, and gated product documentation. Liferay maps complex relationships like parent-child companies so each entity operates independently across channels while staying governed. These are purpose-built B2B content features, not repurposed B2C capabilities.

Liferay Commerce uses Elasticsearch for product search with faceted filtering, category-based navigation, related product display, and search landing pages. Search Blueprints allow content managers to customize result ranking and content blending. AI-powered relevance improvements are included. Content-product search blending is possible within the unified CMS+Commerce environment. Synonym management and search analytics are supported.

Liferay Commerce supports promotional pricing, discount rules, and tiered pricing structures. CMS-managed promotional banners and product spotlights can be scheduled through the Page Builder. Personalized promotion targeting based on audience segments and intent signals is available. However, countdown timers, promo code display widgets, and channel-specific promotional content management are not native features and require custom development.

Liferay Commerce supports multiple storefronts with multicurrency and multilingual configurations, enabling region- or brand-specific commerce experiences from a single instance. Shared product catalogs with storefront-specific editorial and pricing are achievable, and 2026 roadmap work on centralized product configuration across multiple channels, order types, and accounts strengthens this pattern. However, storefront-specific editorial governance adds operational complexity and there is no dedicated multi-storefront content management dashboard.

Liferay Commerce supports image galleries, multiple media per product, and video embeds on product pages. The Documents and Media system handles image transforms. However, there is no native 360-degree product viewer, AR/3D model integration, or image hotspot functionality. Advanced visual commerce experiences require third-party integrations or custom development. This reflects Liferay's B2B focus where visual richness is less critical than account management depth.

Liferay Commerce is not designed for marketplace or multi-vendor commerce scenarios. There are no native seller profile management, seller-contributed product descriptions, review aggregation, or content moderation tools for multi-vendor scenarios. Liferay's B2B commerce model assumes a single seller with multiple buyer organizations — not a marketplace model. Implementing marketplace seller content would require extensive custom development.

Liferay Commerce supports multicurrency display, multilingual product descriptions, and locale-specific storefront configurations. Generic localization infrastructure applies to product content. Country-specific pricing rules and multilingual catalog management are supported. However, regulatory content (EU labeling, CA Prop 65), locale-specific promo calendars, and currency-aware editorial content blocks are not purpose-built features — they require configuration and some custom work.

Liferay Analytics Cloud and the Commerce analytics module provide order forecasting, product-level purchase analytics, and ML-driven engagement insights. Content-to-commerce attribution is partially achievable by correlating content engagement data from Analytics Cloud with order data from Commerce. However, direct revenue attribution to content pages, content-assisted conversion paths, and product content performance dashboards are not native — they require custom reporting or BI tool integration.

Access control remains one of Liferay's strongest capabilities, reflecting its portal heritage. Granular resource permissions, organization-based access hierarchies, role-based content visibility, user group management, SSO integration (SAML, OIDC, LDAP), and department/site-level access control are all deeply supported. For intranet scenarios, Liferay's permission model is best-in-class among DXP platforms.

Liferay provides purpose-built knowledge management through the Knowledge Base application (hierarchical articles, versioning, search), Wiki, Message Boards, and strong taxonomy/tagging. Search Blueprints surface relevant knowledge, and AI-powered search improves discovery. Content lifecycle management (review dates, expiry) is available for knowledge articles. For enterprise knowledge management, Liferay remains one of the strongest DXP options.

Employee portal capabilities remain Liferay's strongest use case: AI-driven personalized dashboards, notifications, social features (blogs, message boards, mentions), announcements, workflow-driven approvals, and mobile access. Out-of-the-box connectors for Microsoft 365, Google Drive, Salesforce, and SAP enhance the digital workplace experience. Customer deployments like Toll Global Express and Coach demonstrate frontline-inclusive intranet patterns. LDAP/AD directory integration is mature.

Liferay supports targeted internal communications with announcements, department-level news feeds, role-based audience targeting for content visibility, and alert notifications. Mandatory-read workflows and read-receipt tracking are achievable through the Workflow engine. The platform provides solid internal comms infrastructure for enterprise intranets. Purpose-built features like read receipts and acknowledgment dashboards require workflow configuration rather than being out-of-the-box.

Liferay has a native people directory integrated with the organization hierarchy and user profile system. Employee profiles can include skills, contact information, and organizational position. Organization hierarchy reflects reporting structures. HR system integration (Workday, BambooHR) is possible via API but no pre-built connectors exist. A visual org chart widget is available as a marketplace app but is not in the core platform.

Liferay's Documents and Media provides document versioning, metadata, taxonomy, and workflow-based approval. The Knowledge Base supports policy-style content with versioning and review workflows. Mandatory-acknowledgment flows can be configured through the Workflow engine. Automated content expiry and review reminders require custom workflow configuration. This covers the functional basics of policy management but lacks turnkey SOP tracking and audit trail dashboards.

Liferay's BPM and Workflow engine can automate onboarding content delivery sequences — role-specific task checklists, staged content access, and new-hire notification workflows are achievable. The platform's role-based personalization can surface role-specific onboarding dashboards. However, progressive 30/60/90-day content journeys, LMS-connected learning paths, and HR-triggered new-hire portals require workflow configuration and potentially custom development, rather than being turnkey.

Liferay's Elasticsearch-powered search provides AI-enhanced relevance, faceted filtering, Search Blueprints for customizable ranking, and synonym management. Search covers all Liferay content types natively. Federated search can be extended to index external systems (SharePoint, Confluence) via custom connectors. AI-powered semantic search improvements have been added in recent releases. Search quality for internal content volumes is strong.

Liferay DXP supports mobile delivery through responsive web and headless APIs, with customer deployments (Toll Global Express, Coach) demonstrating frontline mobile intranet patterns. The platform supports push notifications and mobile-optimized layouts. However, a dedicated native Liferay intranet app (comparable to Unily, Staffbase, or Viva Engage) is not part of the core product — mobile access is primarily via responsive web browser or custom-built mobile apps using the headless APIs. Offline support is not native.

Liferay does not have a native LMS or e-learning module. Learning content can be hosted in the platform via Web Content, Knowledge Base, and structured content types. The Workflow engine can track content consumption for basic completion flows. Integration with LMS platforms (Cornerstone, Workday Learning, SAP SuccessFactors Learning) is possible via API but no pre-built connectors exist in the core product. Micro-learning and certification tracking require external LMS.

Liferay has a mature social layer for enterprise intranets: blogs, message boards, comments, reactions, mentions, forums, polls/surveys, idea submission (app), and community spaces (sites) per department or interest group. Peer recognition programs can be built on the platform. Blogs moved to maintenance mode in 2026.Q1 but remain fully supported. Social features are native and purpose-built for the intranet use case, not bolted-on widgets.

Liferay provides out-of-the-box connectors for Microsoft 365 (including Teams integration), Google Drive, Salesforce, and SAP. Document co-editing via SharePoint/OneDrive integration is supported. Teams notifications and Slack webhooks are achievable. The integration depth provides a meaningful single-pane experience for employees, embedding Office documents and enterprise application content within the intranet. Bot-driven integrations require custom development.

Liferay supports content expiry dates, workflow-based review cycles, and archival states for web content and knowledge base articles. Content ownership assignment and expiry notifications can be configured. Stale content flagging and automated review reminders require workflow configuration rather than being turnkey. The overall lifecycle management is functional for intranet governance but below purpose-built intranet platforms with automatic stale content dashboards.

Liferay Analytics Cloud provides content engagement metrics, visitor behavior tracking, and segment-level analytics applicable to intranet measurement. Page-level view data, engagement heatmaps, and failed search term analysis are available. Department-level content performance segmentation is achievable via Analytics Cloud segments aligned to organization groups. Dedicated intranet adoption dashboards and ROI reporting are not turnkey — they require custom Analytics Cloud dashboard configuration.

Liferay supports multi-tenancy through Virtual Instances (separate users, sites, configurations, database/schema-level data separation, and domains) and Sites for lighter isolation. Cross-tenant administration is available to an Omni Admin while local administrators manage their own instances. Virtual Instances share the same JVM, which limits true physical isolation for strict regulatory requirements. As of 2026.Q1, using multiple domains requires an Enterprise Subscription — a licensing rather than architectural constraint.

Fragments can be shared cross-site via Fragment Libraries, Style Books provide brand-level theming per site, and Asset Libraries enable shared content across sites. However, there is no explicit brand override mechanism for shared components — per-brand customization requires site-specific fragment variants — limiting native cross-brand design system support.

Liferay's organization hierarchy, site administration model, and role-based permissions provide a functional governance framework. The 2025 IDC MarketScape recognized Liferay for attribute-driven multisite publishing, cascade publishing, visual workflow design, quality gates, and life-cycle automation across content supply chains — confirming governance depth. Virtual Instances enable centralized governance with local variation across regions, brands, or business units. There is still no purpose-built multi-brand governance dashboard.

Multiple brands can share a single Liferay instance, providing infrastructure cost sharing. The 2026.Q1 unified platform (single modular distribution with activation keys replacing separate CE and DXP installations) reduces operational overhead and provides a free tier with quarterly feature releases. However, multiple domains for Virtual Instances now require an Enterprise Subscription, licensing costs still scale with deployment size, and each brand requires independent theme development and content operations.

Style Books provide per-site design token configurations (colors, typography, spacing) enabling genuine per-brand visual identity on a shared component foundation. Each site can have its own Style Book assignment, and Fragment Libraries can be brand-filtered. This supports per-brand theming at the platform level while sharing the underlying component structure. Custom theme development is still required for full brand differentiation beyond Style Book tokens.

Liferay supports per-brand localization through site-level language configurations, translation workflows with approval chains, and locale-specific content scheduling. However, brand-aware translation approval (where Brand A's French team approves translations independently of Brand B's French team) requires careful Workflow configuration per site — it is not a turnkey brand-x-locale governance model. Regional legal content governance per brand requires custom workflow design.

Liferay Analytics Cloud can be configured to aggregate data across sites (brands) within a single DXP instance, providing per-site and comparative engagement metrics. Publishing cadence and content velocity can be monitored per site. However, there is no executive portfolio dashboard that presents brand-level performance side-by-side out of the box — cross-brand aggregation requires custom Analytics Cloud segment and workspace configuration.

Liferay's visual Workflow Designer allows independently configured approval chains per site (brand), enabling brand teams to manage their own publishing workflow while central administrators retain audit oversight. Workflow instances can be scoped to specific sites and content types. Central workflow audit logs are available at the system level. Per-brand workflow autonomy with central auditability is a genuine capability.

Liferay supports cascade publishing and attribute-driven multisite publishing — recognized by IDC MarketScape 2025 as key strengths. Asset Libraries enable corporate-level content shared across brand sites with site-level override capability. Content can be pushed from a master site to child brand sites with controlled local adaptation. This covers the core corporate-to-brand syndication pattern, though the override granularity per content element is limited.

Liferay provides per-site compliance configurations — cookie consent management, GDPR features, and accessibility settings can be configured per Virtual Instance or site. Virtual Instances separate data at the schema level, supporting regional and business-specific regulatory compliance. Publishing guardrails (e.g., preventing GDPR-non-compliant publishing) are achievable via Workflow quality gates. Data residency is configurable in Liferay Cloud deployments. However, turnkey per-brand/region compliance rules with automated publishing guardrails are not a native self-service feature.

Liferay provides a centrally maintained design foundation through Fragment Libraries (shared components) and Style Books (design tokens). Fragment Libraries can be versioned and updated centrally, with updates propagating to consuming sites. Style Books provide brand-level extensions of the central token set. This covers the core federated design system pattern. However, version governance (preventing specific brands from using older Fragment versions) and brand extension without forking are limited.

Liferay's Virtual Instance and Organization hierarchy enable central admin management of all brands with autonomous brand-level team administration. The Omni Admin can manage all Virtual Instances from a single control plane while local administrators oversee users, sites, and content for their own portals. SSO (SAML, OIDC) operates across all instances. The model effectively provides central governance with delegated brand autonomy.

Liferay's Web Content Structures can be shared across sites, providing a base content model usable by multiple brands, and the new object-based headless CMS (2026.Q1) stores content as structured, reusable data that may improve model sharing over time. Site-specific structure variations allow some per-brand customization. However, extending a shared base model per brand without forking (e.g., Brand A adds a video field independently of Brand B) is still not natively supported — model changes typically require forking the base structure.

Liferay does not provide an out-of-the-box executive portfolio reporting dashboard spanning multiple brands/sites. Content freshness by brand, publishing SLA adherence, and cost allocation per tenant are not native reporting dimensions. Analytics Cloud provides per-site engagement data but requires custom configuration to aggregate into portfolio-level executive views. Operational reporting across the brand portfolio requires custom BI tool integration (Tableau, Power BI).

DPA applies by default to cloud customers in EEA, UK, Latin America, and Mexico, with SCCs implemented for cross-border transfers; other customers can request it. Liferay now publishes a detailed sub-processor table (entities, locations, functions, transfer mechanisms) with 10 days' notice before new appointments, closing the prior transparency gap. EU residency via Frankfurt, London, and Hamina (Finland) regions, plus built-in Personal Data Erasure dashboard. Meets the 80 threshold for DPA + EU residency + SCCs + public sub-processor list.

Liferay's Trust Center lists HIPAA alongside ISO 27001/27017/27018, SOC 2 Type 2, and CSA STAR Level 2, and the healthcare industry page now explicitly documents Business Associate Agreement capability under HIPAA with SaaS, PaaS, or self-hosted deployment options for PHI control. Healthcare use cases are well-documented in the customer base. Not 70+ because BAA terms and plan eligibility are not published as a self-service legal document — 'BAA capability' is softer than a standing BAA offer.

GDPR built-in with DPA and erasure tooling; CCPA via DPA; LGPD coverage implied by default DPA application to Latin America plus São Paulo hosting region. Spain's Esquema Nacional de Seguridad (ENS) is newly listed on the Trust Center — a meaningful regional framework addition. Still no FedRAMP authorization, IRAP, C5, or HITRUST despite government and healthcare customers. Score reflects GDPR + CCPA + LGPD + ENS breadth without FedRAMP.

Current SOC 2 Type 2 attestation, independently verified since 2019, covering Liferay PaaS, SaaS, Analytics Cloud, and Managed Services. Reports available to customers upon request, and the DPA allows a recent SOC report to substitute for customer audits. Not 85+ because the specific Trust Service Criteria covered beyond Security are still not publicly documented.

Liferay holds ISO/IEC 27001:2022 (certificate ISMS-LS-5319, 2025 certificate document published) with scope covering development, operations, maintenance, and delivery of the DXP and Cloud Services Platform — platform scope, not just infrastructure. Also certified ISO/IEC 27017:2015 and ISO/IEC 27018:2019 for cloud PII processing, audited by A-LIGN. Meets the 80+ threshold for platform-scope ISO 27001 plus ISO 27018.

CSA STAR Level 1 (CAIQ) and Level 2 (SOC 2-based attestation) confirmed in the CSA registry, with a separate Liferay PaaS listing added July 2024; CSA Trusted Cloud Provider designation. Spain ENS is newly documented on the Trust Center, and ISO 27017 plus HIPAA round out the portfolio. Still no PCI DSS, FedRAMP, or Cyber Essentials Plus, which caps the score at 70.

Liferay Cloud offers region choice across US, EU (Frankfurt, Hamina), UK (London), Brazil (São Paulo), India (Mumbai), and Australia (Sydney), with each environment independently placeable for granular data sovereignty. Backups are restricted to the instance's data region and never leave it. On-premise/self-hosted DXP provides complete residency control. Meets the 78+ threshold for multiple regions with contractual guarantees.

Post-termination retention is now explicitly documented: customers have 14 days to retrieve data after subscription end, with permanent deletion 30 days after termination; Analytics Cloud retention defaults to 13 months and is configurable. Built-in Personal Data Erasure dashboard provides self-service right-to-erasure with APIs for third-party integration, plus data portability export. Meets the 75+ threshold for self-service export + documented retention + API-based erasure.

Comprehensive audit framework captures logins, password and entitlement changes, group membership, and content operations, with output in CSV or JSON. Native SIEM integration via Splunk, ELK stack, Syslog audit message processor, and CloudAMQP. DPA additionally grants customer audit rights with documentation support. Meets 75+ for comprehensive logs with native SIEM integration.

Liferay publishes a dedicated 'DXP Admin Experience Accessibility Conformance Report 2025' based on VPAT 2.5 — formal conformance documentation specifically covering the authoring/admin interface, alongside a Sites Experience ACR. Conformance evaluated with automated static analysis plus manual testing using screen readers, magnifiers, and speech recognition. Exceeds the 70 threshold given current, authoring-specific formal documentation.

Current VPAT-based ACRs are publicly downloadable for procurement: the August 2024 report (VPAT 2.5) plus separate 2025 Admin Experience and Sites Experience conformance reports and a 7.4 2024-Q3 report. Dedicated accessibility compliance page maintained with Section 508 coverage via the VPAT framework. Meets 70+ for current, public VPAT/ACR availability; not higher because ATAG 2.0 assessment is not documented.

AI Creator remains GA in the Web Content editor (ChatGPT via user's own OpenAI key, with tone and word-count controls), and the newly launched AI Hub (public beta, June 2026) adds built-in AI writing tasks directly in Liferay CMS — change tone, fix grammar, summarize text — plus a Content Site Generator in development for AI-assisted multi-page site creation with natural language edits in the page editor. Still no documented brand voice guardrails or custom prompt template governance, and the newer writing tasks are beta, holding the score in the basic-generation band.

AI Creator integrates DALL-E for image generation from text prompts with results stored directly in the DAM — a genuine native AI image pipeline, GA. Auto-tagging of images and documents at ingest via OpenNLP, Google Cloud, and Microsoft Cognitive Services providers partially covers discoverability. No dedicated auto alt-text generation or AI video processing documented, keeping this mid-band.

Bulk automated translation via Google Cloud Translation and Amazon Translate is built into the localization workflow (categories, images, structures, and content in bulk), with side-by-side review, and AI Hub agent templates can auto-translate content on publish. No brand voice preservation across locales or translation quality scoring documented, which keeps this in the basic-MT band.

Auto-tagging of web content, documents, blogs, and images via OpenNLP, Google Cloud, and Microsoft Cognitive Services is GA, and the Page Audit Tool surfaces SEO/accessibility diagnostics via Google PageSpeed Insights. SEO titles, meta descriptions, canonicals, and hreflang are configurable and localizable in the UI but are manually authored — no AI generation of SEO copy or schema suggestions documented, capping this at partial automation.

Multiple AI assists are woven into editorial: auto-tagging on publish, automated multi-language translation, AI Insights recommendations, and AI Hub's custom task creation plus a centralized AI Assistant chat that coordinates tasks against DXP search context. The AI Hub pieces are beta and the assists still operate as discrete features rather than a unified editorial AI workflow.

Liferay AI Hub officially launched June 3, 2026 as a standalone SaaS product in PUBLIC BETA — low-code agent studio, pre-built agent templates (content creation, compliance review, service triage), multi-agent orchestration chaining specialized agents into end-to-end workflows, and MCP-based data access. However, human review checkpoints and event-driven triggers are explicitly 'coming in later releases,' and the product is beta, not GA — the rubric caps beta agentic capability at 50. Previous score assumed GA status; corrected to the top of the beta band given the strong launch plus the open-source AI Tasks orchestration layer.

AI Insights analyzes user behavior and content performance to surface real-time layout and content strategy recommendations (e.g., proactive surfacing of renewal content, frustration detection triggers), and the Content Dashboard provides taxonomy-based content analytics. Still no AI-driven content gap analysis, topic clustering, or editorial priority scoring comparable to dedicated content intelligence dashboards.

The Page Audit Tool surfaces SEO and accessibility issues via Google PageSpeed Insights — useful but rule-based and external-API-driven rather than AI-native. AI Hub use cases mention 'automated compliance review' as an agent template scenario, but it is a beta building block, not a shipped audit product. No AI quality scoring, brand voice compliance checking, or duplicate/thin content detection documented.

Liferay Enterprise Search ships production semantic search — text embeddings stored in Elasticsearch via txtai or Hugging Face providers with cosine/dot-product similarity — and the 2026.Q1 LTS native Elasticsearch 8 connector now shipping adds Reciprocal Rank Fusion (RRF) hybrid keyword+vector search. Held below 65 because semantic search remains an LES paid add-on rather than base-DXP functionality.

Content and product recommendations driven by role, history, and behavior are GA, AI Insights adds ML-based layout optimization suggestions, and AI Hub lists 'predictive audience segmentation' among its agent use cases — but that capability is public-beta agent tooling, not a shipped ML personalization engine. Segment rules remain primarily configurable rather than ML-predicted, with no cold-start handling or personalization performance analytics documented, so this stays in the AI-assisted band.

Liferay DXP ships an official MCP server with live documentation covering GitHub Copilot, Cursor, and Claude Desktop configuration, but as of 2026.Q2 it still requires the beta feature flag LPD-63311 — confirmed unchanged in current docs. AI Hub additionally consumes MCP servers for agent data access, showing committed protocol investment. The persistent beta flag keeps this at the top of the announced/beta band rather than the GA band.

Liferay's AI stack is BYOM-first with no bundled proprietary model: AI Creator uses a user-supplied OpenAI key, and AI Hub's launch confirms an open, model-agnostic architecture connecting Anthropic, Google, and OpenAI models with the ability to swap or add models without rebuilding agents. AI Tasks adds Ollama and Hugging Face local-model support. No explicit data residency controls for the AI pipeline documented, holding the score below 75.

Strong developer AI tooling: official MCP server (beta), AI Hub's low-code studio with custom task creation and MCP-based connectivity to any compatible system, AI Tasks providing LangChain4J orchestration, and comprehensive headless REST APIs. No dedicated AI SDK, LlamaIndex integration docs, or RAG-optimized content delivery endpoint documented, keeping this below the dedicated-AI-SDK band.

AI Hub's June 2026 launch materially strengthens governance: every AI interaction is logged in a full audit trail, agents operate on behalf of authenticated DXP users so they can only access permission-scoped data, and the platform is designed for GDPR data locality, HIPAA access controls, and SOC 2 audit readiness — on top of Liferay's ISO/IEC 42001 AIMS certification. Score held just above the band floor because brand voice enforcement, hallucination detection, and human-in-the-loop gates are not yet shipped (review checkpoints are slated for later releases) and AI Hub is public beta.

AI Hub introduces a centralized dashboard to monitor agent usage, track performance, and control costs — metrics include average response time, task completion time over time, and memory/disk consumption per agent. This is Liferay's first real AI observability layer, but it ships in a public-beta product, covers agent operations rather than per-user AI consumption or prompt effectiveness, and BYOK token cost tracking still lives in the provider's console — keeping this at the top of the minimal band.