Liferay

Liferay now offers two mature content modeling paths: traditional Web Content Structures and Objects, which as of 2026.Q1 power the new Headless CMS directly. Objects support text, numeric, date, picklist, relationship, attachment, rich text, and boolean fields. The new content structure builder in the Headless CMS simplifies model creation. However, schema-as-code remains unavailable — structures are defined via UI or REST API. The dual system (Classic CMS + Headless CMS) is now better delineated but still adds complexity.

Objects support one-to-many and many-to-many relationship fields between object definitions. With Objects now central to the Headless CMS, relationships are more first-class than before. Web Content retains the looser related-assets model. There is still no graph-style relationship traversal or bidirectional query from both ends in the way headless-native platforms offer. Adequate for enterprise use but behind Contentful or Hygraph.

The new Headless CMS architecture stores content as structured, reusable data via Objects rather than HTML-heavy web content. Content structures can define typed fields and relationships. Page Fragments provide UI-level composition. However, there is still no Portable Text equivalent or deep block-based composition model — rich text output remains HTML. The Objects-based approach is a meaningful step toward structured content but doesn't match headless-native platforms.

Objects support required fields, unique constraints, and picklist restrictions. Object validations can include Groovy scripts (on self-hosted/PaaS) for custom validation logic, which enables cross-field and regex-style validation for those deployment models. Web Content Structures remain limited to basic presence and type checks. The validation story has improved with Objects but is deployment-model dependent.

Liferay maintains solid versioning for Web Content with full version history, draft/approved/expired states, and revert capability. Scheduled publishing is supported. As of 2025.Q4+, Objects also support content scheduling with display, review, and expiration dates. No visual diff between versions and no content branching remain gaps.

Liferay's Page Builder with Fragments provides genuine in-context visual editing with drag-and-drop and inline content editing. Recent improvements include installing pre-built fragments from Liferay Marketplace directly within the page builder and creating multi-step forms in the Page Editor. The experience is strong for portal/intranet use cases but still less polished than Sitecore XM Cloud's Pages or Optimizely's Visual Builder.

Liferay is upgrading from AlloyEditor/CKEditor 4 to CKEditor 5 starting in 2025.Q3+, with the always-visible toolbar and standardized editing experience across the platform. CKEditor 5 is a significant UX improvement. However, output remains HTML rather than a portable AST format, and custom plugin migration from CKEditor 4 is required. Extensibility improves with CKEditor 5's architecture but the output format still limits omnichannel portability.

Documents and Media library provides folder organization, metadata, versioning, and document types. Adaptive Media generates responsive image sizes automatically. The Headless CMS integrates file types into the content structure builder. However, focal point cropping, AI tagging, and advanced DAM features remain absent. The media library UX is functional but dated compared to modern platforms.

Liferay does not offer real-time co-editing of content. Content editing uses an optimistic locking model where the last save wins, with some warning about concurrent edits. Basic commenting features exist via the platform's social features (mentions, comments on content items), but no presence indicators or conflict resolution for simultaneous editing.

Workflow remains one of Liferay's genuine strengths. Kaleo Workflow engine provides custom multi-step approval workflows with conditions, transitions, role-based assignments, and audit trails. Workflow actions now integrate with Object Actions for notifications, webhooks, and Groovy scripts. Workflows can be defined via XML or a visual designer. This is significantly more capable than most CMS platforms.

Liferay provides both REST (OpenAPI-compliant) and GraphQL endpoints. The new Headless CMS (2026.Q1) is purpose-built for headless delivery via APIs, a major architectural improvement. GraphQL APIs now support versioned endpoints and siteId via key or external reference code (2025.Q3+). REST Builder APIs are being integrated with GraphQL. API design still carries Java heritage with verbose response formats, but the headless-first CMS architecture closes the gap with API-native platforms.

Liferay Cloud includes CDN via Fastly for hosted deployments. Self-hosted instances require BYO CDN. Cache invalidation is available but not as granular as purpose-built headless platforms — it operates at page/resource level rather than per-content-entry. No edge computing or edge-side personalization capabilities. The CDN story is adequate for cloud-hosted but weak for self-hosted deployments.

Object Actions now provide clear webhook support — delivering JSON payloads to specified URLs on CRUD events with optional secret key verification. Three action types exist: Webhook (external push), Object Action Client Extension (external microservices), and Groovy Script (PaaS/self-hosted). Actions support triggers and conditions. However, webhook delivery logs, retry configuration, and payload filtering remain less mature than Contentful or Sanity's webhook systems.

The new Headless CMS (2026.Q1) is explicitly designed to decouple content from presentation and enable delivery across multiple channels via headless APIs. Objects-based content is structured and reusable rather than page-bound. This is a meaningful architectural shift from the legacy web-portal model. However, rich text still outputs HTML, legacy Mobile SDKs are aging, and no official SDKs exist for modern frameworks. The headless CMS is new and ecosystem maturity will take time.

Liferay provides user segments based on session attributes, user properties, organization membership, and custom user fields with AND/OR conditions. Analytics Cloud segments can sync to DXP for personalization. However, there is no behavioral targeting beyond session data, no real-time segmentation engine, and no CDP integration out of the box — segmentation is functional for intranet/portal personalization but not competitive for marketing use cases.

Liferay supports content personalization through Experience variants on Content Pages, allowing different segments to see different fragments and content. Fallback to default experience exists and preview per segment is available. This is page-level rather than component-level personalization, and works well for intranet role-based use cases but is less sophisticated than Optimizely or Sitecore for marketing scenarios.

Liferay DXP includes A/B Testing for Content Pages with traffic splitting and conversion goal tracking; statistical significance is calculated. Only A/B tests are supported (no multivariate), test configuration options are limited, and results depend on Liferay Analytics Cloud integration. No bandit algorithms or auto-optimization exist.

Liferay Analytics Cloud provides content recommendation capabilities based on user interest scoring and ML-detected interest topics, but this is not a full algorithmic recommendation engine. Content recommendations are mostly rule-based (related assets, similar content by category) with no cold-start handling and limited placement flexibility.

Liferay has excellent built-in search powered by Elasticsearch with full-text search, faceting, type-ahead suggestions, and Search Blueprints for visual relevance tuning (query boosting, filtering, result ranking). Search analytics are available via Analytics Cloud. This is one of Liferay's genuine competitive advantages.

Liferay's search is deeply tied to Elasticsearch — custom indexing is supported, search pipeline customization is possible via Java service overrides, and Search Blueprints provide declarative configuration. The 2026.Q1 LTS includes a native Elasticsearch 8 connector. Integration with external search platforms (Algolia, Typesense) is possible but requires significant custom development — no official connectors exist.

Liferay Commerce is a fully integrated module with product catalog, pricing engine, cart/checkout, order management, and B2B/B2C/B2B2C storefront types. The 2025.Q1 release added Unified Product Catalog Management for centralized product configuration and visibility control across channels. Marketplace payment method apps simplify payment setup. Strongest in B2B scenarios with price lists, account groups, and approval workflows.

Liferay's commerce strategy centers on its built-in Commerce module rather than external platform integration. There are no pre-built connectors for Shopify, commercetools, BigCommerce, or Salesforce Commerce Cloud — integration requires custom API development. The platform assumes you use Liferay Commerce rather than a third-party engine.

Liferay Commerce has purpose-built product content management with SKU-level content, product specifications, options (size/color/etc.), categories, and media per product. Rich product descriptions and variant handling are well-supported. Particularly strong for B2B catalogs with complex product hierarchies and account-specific pricing. Less polished than dedicated PIM solutions but tightly integrated.

Liferay Analytics Cloud is a separate SaaS product providing content performance dashboards, user behavior tracking, engagement scoring, and asset performance metrics. It's functional but requires separate setup and licensing, and isn't deeply integrated into the authoring UX. The analytics feel bolt-on rather than embedded intelligence; author productivity metrics are limited.

Liferay supports analytics integration via JavaScript tag injection through page configuration, enabling GA4 or similar. There are no purpose-built connectors for GA4, Adobe Analytics, Segment, or Amplitude. CDP integration is not native. Analytics middleware or event helpers are absent — effectively manual script injection.

Multi-site is a core Liferay strength via its Sites architecture — multiple sites share a single instance with independent or shared content, configurations, and themes. Virtual Instances provide tenant-level isolation. Asset Libraries enable cross-site content sharing. Organization hierarchy maps well to multi-site governance. Liferay's portal heritage gives it genuine advantage here.

Liferay supports field-level content localization with default locale and fallback chains, supporting 50+ languages out of the box. The 2025.Q1 release added in-context translation for Object form fields directly within the Page Editor with status tracking (Translated/Not Translated/Translating) via the Localization Select fragment. Locale-specific content branching and advanced translation workflows are not available.

Liferay supports machine translation via Google Cloud Translation and Microsoft Translator. The 2025.Q1 release improved in-context translation UX for Object form fields. However, there are no native TMS connectors for Phrase, Smartling, Lokalise, or Transifex — these require custom integration. Translation memory is not supported.

Liferay's Sites and Virtual Instances architecture supports multi-brand scenarios — brand-level permissions via Organizations, shared content libraries with per-brand overrides, and centralized administration are achievable. However, there is no explicit 'brand' governance concept; multi-brand is implemented through Sites configuration. Design system support is limited to theme inheritance. Brand-level analytics require separate Analytics Cloud setup per brand.

Liferay's Documents and Media combined with Asset Libraries provides cross-site global asset repositories, custom document types with reusable metadata schema field groups, full version history with checkout/check-in, file expiration/review dates, and granular role-based permissions per folder and file. AI auto-tagging is available via external provider integration. Key gaps are no asset usage tracking (which pages reference a given file) and no watermarking or DRM.

Adaptive Media generates multiple resolution variants at upload time and serves responsive images via HTML srcset/picture elements. Liferay Cloud (PaaS/SaaS) includes a Fastly-backed CDN; self-hosted requires external CDN configuration. However, there is no focal point or smart crop capability, no on-the-fly URL parameter image transformations, and WebP/AVIF is supported as input format but not auto-converted on output.

Liferay does not provide native video hosting, transcoding, or streaming infrastructure. Production video relies on External Video Shortcuts referencing YouTube, Vimeo, Facebook, or Twitch (4 platforms out of the box). FFmpeg integration generates preview thumbnails for locally stored video files but is not production streaming. No caption or subtitle management exists within Liferay.

Content Pages with drag-and-drop Fragments are Liferay's primary authoring surface since DXP 7.3. Fragments support inline text/image editing on the canvas, Master Pages define shared layouts, and device preview modes (desktop/tablet/mobile) are available. 2024.Q4 added multi-element selection (CTRL/SHIFT); 2025.Q3 enabled Marketplace fragment packs installable directly from the Page Editor. Limitations: Fragment creation requires HTML/CSS/JS knowledge — no purely no-code component builder; Widget portlets have a different UX paradigm.

Liferay's Kaleo Workflow engine supports fully configurable multi-step approval workflows defined in XML or via visual node-based Workflow Designer. Task assignment supports specific users, roles, or organizational hierarchy; Groovy scripts fire at state transitions for custom logic; SLA tracking with Elasticsearch-powered Workflow Metrics shows on-time vs. overdue items, velocity, and performance by step/assignee. Full audit trail of transitions and comments is maintained.

Liferay supports scheduled publishing via Publications (branch-based, schedule a publication to go live at specific date/time), individual web content display/expiration dates, and Object entries with Publish Date, Expiration Date, and Review Date fields. However, there is no visual content calendar — Publications shows only a table list of scheduled items. Publications entered maintenance mode in 2026.Q1 and its future roadmap is unclear. No release bundle dependency ordering exists.

Liferay's collaboration model is entirely asynchronous — Page Comments allow editors to leave inline comments on specific fragments in the Content Page Editor (editorial-only, not published), and workflow approvals provide a review trail. There is no simultaneous co-editing, no presence indicators showing who is currently editing, and no content diff/compare view between versions. Last-write-wins on concurrent edits.

Liferay's Forms application (multi-page, conditional rules, validation, data storage) is in maintenance mode as of 2024.Q4 with no further feature development. The recommended path is Objects + Form Container fragments, which supports multi-step forms via stepper components and fires webhook actions on create/update. In-context translation of form fields was added in 2025.Q1. Key gaps remain: no progressive profiling, no native reCAPTCHA, and the Objects replacement requires more assembly than purpose-built form builders.

Liferay has no native email campaign builder or ESP capabilities. The official HubSpot Lead Capture connector submits lead data to HubSpot CRM, and a HubSpot Click to Chat Marketplace app exists, but this is not marketing automation. No native connectors for Mailchimp, Marketo, Eloqua, or Salesforce Marketing Cloud — all require middleware (MuleSoft connector add-on, Tray.io, or custom API work).

Liferay has no native drip campaign engine, behavioral trigger engine, or automated nurture workflows. Analytics Cloud tracks individual engagement scores and Liferay Data Platform is positioned as a B2B CDP-adjacent data hub — but neither is a marketing automation platform. The platform fundamentally relies on external MAPs (Marketo, Eloqua, HubSpot) for automation execution.

Liferay Analytics Cloud provides behavioral data collection, unified individual profiles, and ML-powered interest topic detection with segment sync back to DXP for personalization. Liferay Data Platform adds B2B-focused account-level segmentation and hierarchical organizational data. However, Analytics Cloud is a separate paid product, and there are no native connectors to Segment.io, mParticle, or Tealium — those require custom API work.

The Liferay Marketplace lists approximately 815 applications covering collaboration, commerce, document management, forms, CRM connectors, identity, and analytics. Key enterprise integrations exist for Salesforce, SAP, MuleSoft, Camunda, Microsoft Office 365, Google Drive, and Atlassian. However, 815 is a modest catalog, there is significant fragmentation between legacy module-based (.lpkg) apps and new client extension–based Cloud Apps, and not all apps are maintained for the latest quarterly releases.

Liferay Objects support Webhook action types delivering JSON payloads on entry create/update/delete with a configurable HMAC secret. Object Actions support conditional triggers (Groovy/field conditions) as pre-send filters. The official Camunda connector uses Liferay webhooks to trigger BPMN processes. However, webhooks are scoped exclusively to Object events — there is no platform-wide event bus covering page publish, workflow state changes, or user events. No retry/dead-letter queue is documented.

Publications provides branch-based in-context preview within a single Liferay instance (no shareable external URL). Classic Staging (Local Live, Remote Live) is also in maintenance mode. Publications entered maintenance mode in 2026.Q1 and does not track changes made in the new 2026.Q1 headless CMS — the two systems are currently disconnected. No shareable draft preview links for non-authenticated external stakeholders exist.

Liferay has a mature, granular RBAC system with Regular, Site, Organization, and Asset Library role types; custom roles with permissions down to individual asset instances; and field-level permissions for custom Objects (not classic web content). SSO is comprehensive: SAML 2.0 (built-in SP/IdP), OIDC (multi-provider), OAuth 2.0, CAS, and LDAP. SCIM became GA in 2025.Q1, enabling automated user provisioning/deprovisioning with Okta and Azure AD.

Liferay offers both REST (OpenAPI-compliant) and GraphQL APIs with an API Explorer in the admin. 2025.Q3+ added siteKey/externalReferenceCode support for GraphQL endpoints, and 2025.Q1+ enabled custom Object filtering via GraphQL. Still carries Java verbosity with heavily nested payloads and inconsistent naming across API generations. Not higher due to multiple coexisting API generations and verbose response formats.

API performance depends heavily on deployment configuration (self-hosted vs Cloud). No published SLAs for API response times. Rate limits exist on Liferay Cloud but aren't prominently documented. Pagination uses standard page/pageSize parameters. Batch operations available for some endpoints. No CDN-backed delivery tier. Performance at scale requires careful Elasticsearch and database tuning — not inherently fast without optimization.

Liferay's SDK story remains weak by modern standards. Java SDK, aging mobile SDKs for Android and iOS, and a JavaScript client without full TypeScript support. No official SDKs for Python, Go, Ruby, or .NET. No auto-generated typed client SDKs from OpenAPI specs. The ecosystem is Java-centric with 3–4 official SDKs at best, placing it in the lower range for this item.

Liferay Marketplace at marketplace.liferay.com has a moderate catalog. 30+ integrations are natively bundled with Liferay 7.4+, covering LDAP, Salesforce, SSO providers, OpenSearch, Solr, MuleSoft, and HubSpot. Many community-maintained connectors have varying quality and update frequency. The marketplace is less vibrant than in the 6.x/7.0 era and smaller than competitors like Contentful or Sitecore.

Client Extensions have matured into the standard extensibility model by 2025–2026, with four categories: frontend, microservice, configuration, and batch. They support React, Vue, Angular, and Node.js without requiring Java/OSGi knowledge. Legacy OSGi extensibility (ModelListeners, ServiceWrappers, custom portlets) remains available for deep customization. This dual model — modern Client Extensions plus deep OSGi hooks — provides exceptional extensibility breadth, limited only by the complexity of the legacy path.

Authentication remains a genuine Liferay strength. Full SAML 2.0 (SP and IdP), OpenID Connect, LDAP synchronization, MFA support and enforcement, configurable session management, and OAuth 2.0 for API access. SSO is available without top-tier plan gating. Enterprise authentication is mature and battle-tested across large organizations. Not higher because the configuration UX is complex compared to modern SaaS platforms.

One of the most granular permission systems in the DXP space. Resource-level permissions, role-based access with Regular, Site, Organization, and Asset Library roles, individual permission assignment, content-level access control, and permission inheritance through organization hierarchy. Custom roles are fully supported. Field-level and content-instance permissions are available. The permission system is extremely flexible for complex enterprise access requirements.

Liferay holds ISO/IEC 27001:2022, ISO/IEC 27017:2015, and ISO/IEC 27018:2019 certifications covering DXP and Cloud Services Platform. GDPR compliance tooling includes data erasure and export. HIPAA-eligible Cloud deployments available. Data residency depends on cloud region. The ISO certification suite is strong; SOC 2 Type II status was not independently confirmed in 2025–2026 search results. Not higher due to uncertainty around SOC 2 and narrower certification breadth vs. Adobe/Sitecore.

Liferay now operates a public bug bounty program on Intigriti with monetary rewards, and has a formal responsible disclosure process with CVE assignment. Security advisories are published regularly. However, multiple CVEs were disclosed in 2025 including XSS vulnerabilities and an unauthorized API access issue (CVE-2025-62259). The open-source Community Edition aids vulnerability discovery. Bug bounty program is a meaningful improvement over previous posture.

Liferay offers genuine multi-deployment flexibility: Liferay SaaS (fully managed), Liferay Cloud/PaaS (AWS/Azure/GCP), self-hosted on any infrastructure, and Docker/Kubernetes deployment. Client Extensions are deployable across all hosting models. This is one of the most flexible hosting models in the DXP market. Not higher because self-hosted deployments are complex and Liferay Cloud adds significant cost.

Liferay Cloud offers 99.95% uptime SLA for production environments. Public status page at status.liferay.cloud with incident history and uptime tracking per region. Last acknowledged outage was November 2025. Self-hosted uptime is entirely customer-managed. SLA details vary by subscription tier. Not higher because self-hosted has no vendor SLA and incident communication transparency is moderate compared to purpose-built SaaS platforms.

Liferay supports horizontal scaling via clustering with cache coherence and session replication. Elasticsearch clusters handle search load. Liferay Cloud provides auto-scaling. Proven at enterprise scale (Airbus, Bosch). However, scaling requires significant infrastructure expertise — cache coherence, session management, and search index synchronization all need careful configuration. No CDN-backed content delivery layer.

Liferay Cloud provides automated backups and point-in-time recovery. Self-hosted deployments need custom backup strategies for database, document library, and Elasticsearch indices. Content export via LAR files (proprietary format) and headless APIs (JSON). No publicly documented RTO/RPO targets. Data portability is moderate — complete export with permissions, workflows, and configurations remains difficult.

Liferay provides Blade CLI for scaffolding and Liferay Workspace (Gradle/Maven) for dev environment setup. Docker-based local development is supported. Client Extensions have improved the dev loop by supporting React, Vue, Angular, and Node.js with modern toolchains (Webpack, TypeScript). However, the full Liferay server must run locally, requiring significant setup and slow startup times. The experience is far from instant-feedback loops of headless CMS platforms.

Liferay Cloud has built-in Jenkins-based CI/CD pipelines for building, testing, and deploying. Environment management (dev/UAT/prod) available on Cloud. Self-hosted deployments require custom CI/CD setup. Content migration between environments via LAR files is fragile. No content-as-code workflow, no deploy previews, no schema migration CLI. Not higher due to lack of modern CI/CD patterns like branch environments.

Liferay Learn (learn.liferay.com) has evolved into a structured, role-based education ecosystem covering website implementation, application architecture, Client Extensions, headless APIs, frontend development, and commerce operations. The 2025 catalog added structured learning paths and the 2026 roadmap includes deeper advanced courses. API reference includes OpenAPI specs. Still limited by Java-centric code examples and gaps in advanced configuration docs.

Client Extensions support TypeScript via modern build toolchains (Webpack). Developers can build global JS Client Extensions with TypeScript and Webpack guardrails. However, there is no auto type generation from content schemas or Objects, no fully typed JavaScript/TypeScript SDK, and no schema-to-type tooling. TypeScript remains a secondary concern — supported for frontend Client Extensions but not integrated into the headless API developer workflow.

Liferay maintains a consistent quarterly release cadence (2025.Q1 through Q4, 2026.Q1 LTS released March 2026) with patch updates between quarters (e.g., 2025.Q4.12, 2025.Q1.22 LTS). The Community Edition GitHub repo shows roughly quarterly GA releases (ga132 in Feb 2025). New CMS feature moved from Beta in 2025.Q4 to Release in 2026.Q1, showing meaningful feature shipping. Not higher because quarterly is moderate compared to monthly SaaS cadences.

Release notes exist for each quarterly release on learn.liferay.com. Breaking change documentation is published but can be hard to find. The transparent handling of pulling the 2025.Q1.21 release due to Commerce and Objects issues, with clear communication urging immediate upgrade to Q1.22, shows improving transparency. Code examples in release notes remain sparse, and migration guides can be incomplete for complex scenarios.

Liferay still does not publish a public roadmap with community voting or a formal feature preview program. The 'One Platform, One Liferay' blog post and 2026.Q1 LTS webinar communicate strategic direction, but these are vendor-controlled channels. Feature direction is shared through blog posts, Liferay DevCon, and webinars rather than transparent community collaboration. No Canny, GitHub Discussions, or similar public feedback portal.

The 2026 unified platform model significantly simplifies the CE-to-DXP migration path — users simply apply a new activation key instead of performing a full migration. LTS releases provide 5 years of support. Backward compatibility is maintained within quarterly release streams. However, no codemods or automated migration tooling exists, and cross-stream migrations remain manual. The transparent pulling of a defective LTS update shows responsible change management.

GitHub liferay/liferay-portal has 2.2k stars and 936k commits across 141 releases — substantial codebase history but modest star count compared to headless CMS platforms (Strapi 65k+, Payload 30k+). The liferay.dev blog has 3,175 entries showing longevity. Community forums exist but engagement has declined from peak. DevCon and regional events maintain presence. The Free Tier could expand the community over time but hasn't yet.

Liferay's official team maintains an active blog presence with multiple posts per month on liferay.dev. The transparent handling of the Q1.21/Q1.22 LTS incident shows responsive communication. GitHub has 76 open PRs indicating some external activity. However, community contributions to the core remain rare — most development is internal. The open-source LGPL-licensed source code is accessible but practical community contribution velocity is low.

Liferay maintains a formal partner program with partner search functionality, regional and global partner tiers, and certification programs. The partner network is particularly strong in Latin America and Europe. However, the network is smaller than AEM's or Sitecore's, and finding Liferay-specialized agencies in North America or APAC can be challenging. The partner directory includes filtering by geography and partner type.

Third-party content about Liferay remains limited. The liferay.dev blog has 3,175 entries but these are predominantly first-party. YouTube content is sparse and often references older 7.x versions. No major recent books or courses on Udemy/Pluralsight. Conference talks are mostly at Liferay's own events. The Free Tier and unified platform could attract more content creators over time but hasn't shifted the content ecosystem yet.

Liferay developer talent remains scarce relative to AEM, Sitecore, or headless CMS platforms. The Java/OSGi specialization creates a high barrier for generalist web developers. The developer pool is concentrated in Latin America, Spain, and India. The new Free Tier (March 2026) lowers the entry barrier for developers to experiment with DXP, which could gradually expand the talent pool, but the effect is too early to measure.

Liferay is making strategic moves to improve momentum: the Free Tier democratizes access, the unified platform simplifies onboarding, and the 2025 Gartner Voice of the Customer recognition (1 of only 5 vendors) validates enterprise customer satisfaction. However, visible new logo wins remain modest, and the platform isn't generating significant buzz in the modern web/headless segment. The shift to cloud/SaaS continues but adoption signals are limited.

Liferay remains a privately held company with stable leadership and no VC pressure for rapid growth. No acquisition rumors or layoff news in 2025-2026. The company is investing in significant platform evolution (unified model, Free Tier, new CMS) which signals healthy R&D investment. Founded in 2004 with consistent operations. Financial runway appears solid, though the R&D budget is smaller than publicly traded competitors like Adobe or Sitecore.

Liferay earned recognition as 1 of only 5 vendors in the 2025 Gartner Voice of the Customer for DXP, a meaningful analyst validation. The unified platform and Free Tier are strategic moves to compete more effectively against both headless CMS platforms and larger DXPs. Liferay retains a strong position in B2B portal and intranet scenarios. However, it still faces challenges competing for modern web projects against headless platforms and for enterprise marketing against AEM/Optimizely.

Liferay DXP maintains 4.4/5 on Gartner Peer Insights with 69 reviews and 83% willingness to recommend. The 2025 Gartner Voice of the Customer recognition (1 of 5 vendors) validates strong enterprise customer satisfaction. Reviews consistently praise B2B portal capabilities, security, and scalability. Negative themes persist: high licensing cost, steep learning curve, and performance tuning complexity. The Free Tier may help address the cost perception over time. Low review volume limits confidence.

Liferay DXP pricing remains entirely sales-gated — no public pricing for any enterprise tier, SaaS, or PaaS plans. Enterprise subscriptions reportedly start at $25K–$50K/year but this is not officially published. Only the Free Tier (formerly Community Edition) has a clear price: $0. The request-a-quote model creates significant buyer friction for comparison shopping.

Self-hosted DXP uses per-environment subscription licensing that escalates with dev/staging/prod and clustering. SaaS plans now use MALU (Monthly Active Logged-in Users) and APV (Anonymous Page Views) metrics, which introduce usage-based variability. The subscription model is predictable at base level but multi-environment and usage-based metrics create cost uncertainty at scale. Community/Free Tier provides a $0 alternative but without enterprise features.

With DXP 2026.Q1, Liferay unified CE and DXP into a single modular platform. The Free Tier now shares the same core installation as enterprise, which improves feature access at the base level. However, enterprise features — clustering, professional support, security patches, Commerce modules, and advanced capabilities — remain gated behind paid subscriptions. Within paid tiers (Pro, Business, Enterprise), feature differentiation exists but is less aggressive than competitors.

Liferay typically requires annual or multi-year subscriptions with no monthly billing option. The Free Tier provides a permanent $0 entry point for development and PoC. Downgrade from enterprise to Free Tier is possible but loses support and enterprise features. No publicly documented startup program, though education/nonprofit pricing may be negotiable. Exit provisions depend on contract negotiation.

Liferay DXP 2026.Q1 introduced a unified Free Tier that replaces the separate Community Edition. Everyone now runs the same core Liferay installation — the Free Tier includes DXP core features for content management, user management, site building, and workflow. It is domain-locked (tied to a registered domain or localhost) and permanent. This is an improvement over the old CE/DXP split, as Free Tier users now get the same core platform as enterprise. The Java stack still requires more infrastructure than lightweight alternatives.

Getting to first deployed content with Liferay takes days to weeks, not hours. Initial setup requires server provisioning (Java app server, database, Elasticsearch), configuration, content type definition, and theme development. Docker-based quickstart exists but still requires Java ecosystem knowledge. Liferay Cloud/SaaS reduces infrastructure setup but onboarding and content modeling remain time-intensive compared to headless CMS platforms.

Typical Liferay projects range from weeks to several months depending on scope. Simple portal implementations take 4–8 weeks; moderate enterprise projects run 3–6 months; complex deployments with integrations extend to 9–12+ months. Implementation costs range from $10K to $100K+. Reference architectures for common patterns (intranet, self-service portal) exist but substantial customization is always required.

Liferay developers command a 30–50% specialist premium over generalist web developers. US salaries range $115K–$175K ($130K average), with freelance rates at $60–$100+/hr. Offshore rates are $30–$60/hr. The Java/OSGi skill requirements and smaller talent pool drive rates higher. Certification is recommended for production work, adding training cost. Ramp-up for experienced Java developers is 2–4 weeks for Liferay-specific patterns.

Self-hosted Liferay requires significant multi-component infrastructure: Java application server, MySQL/PostgreSQL database, Elasticsearch cluster, and optionally document storage and caching layers. This creates substantial hosting costs ($500–$2000+/month for production). Liferay SaaS and PaaS options (formerly LXC) reduce infrastructure management but add significant subscription cost on top of license fees. Total hosting bill is comparable to other enterprise DXPs.

Self-hosted Liferay requires dedicated ops attention for server patching, database maintenance, Elasticsearch management, cache tuning, and cluster management — realistically part-time to full-time DevOps depending on complexity. Liferay SaaS reduces this substantially but still requires configuration management and deployment knowledge. Liferay PaaS reduces infrastructure ops but not application-level operations. More ops burden than SaaS-only platforms.

Migration out of Liferay is moderately difficult. Content can be extracted via headless REST APIs in JSON format, which is a positive. However, the complete content model, permissions, workflows, and configurations are not easily portable. LAR export format is proprietary. Custom code (OSGi modules, Fragments, Client Extensions) is platform-specific. No vendor-provided migration tooling to competitors exists. The open-source base provides source-level access but practical migration cost remains high.

Liferay still has a steep learning curve with many platform-specific concepts: Sites, Pages, Fragments, Widgets, Objects, Client Extensions, Web Content, Asset Libraries, Organizations, Roles. Client Extensions reduce the need to understand OSGi internals for extension development, but the overall concept count remains very high. The mental model is still far from mainstream web development — it's a Java portal server with its own paradigms. Not lower because Client Extensions genuinely simplify the extension story.

Liferay Learn has expanded with structured, role-based learning paths covering website implementation, application architecture, content strategy, frontend development, and commerce. Courses like 'Mastering Data Modeling with Liferay Objects' and 'Mastering Liferay Workspaces and Tooling' provide guided onboarding. Certification programs exist. However, the learning path remains long with no quick 'build something in 30 minutes' experience, and onboarding assumes enterprise developer context.

Client Extensions now allow developers to use React, Node.js, Angular, Vue, or Spring Boot for extensions without deep OSGi knowledge — a meaningful improvement. However, these must be wrapped as Web Components or standalone services interfacing via headless APIs. Core platform development still requires Java. FreeMarker remains the fragment templating language. The platform is moving toward mainstream frameworks for extensions but the core remains Java enterprise niche.

Liferay provides sample Client Extension projects as starting points and updated Blade CLI supports quarterly release targeting. Liferay Workspace provides standardized project structure. However, there are no Next.js/Nuxt/Astro starters, no one-click deployment options, and no equivalent of modern headless CMS starter kits. React apps must be manually wrapped as Web Components. Sample projects demonstrate individual features rather than complete applications.

Configuration surface area remains enormous: portal-ext.properties with hundreds of settings, OSGi configuration, System Settings, Instance Settings, Site Settings, database configuration, Elasticsearch configuration, cache settings, clustering config. The Jakarta EE 10 migration (required for 2025.Q3+) adds another configuration dimension for upgrading teams. Defaults are reasonable for basic operation but production tuning requires extensive expertise.

Liferay Objects have improved with stable alphanumeric class names (2025.Q1+) replacing random numeric IDs, improving portability across environments. Export/import capabilities for object data models now exist. Web Content Structure changes still require caution with existing content. Service Builder schema changes still need database migrations. Objects are more forgiving for schema evolution than traditional approaches but automated migration tooling for breaking changes remains limited.

Liferay's Page Builder provides solid built-in preview and in-context editing for portal/intranet pages. Marketplace fragments can now be installed directly within page builder, expanding available components. For headless delivery to external frontends, preview integration still requires custom implementation — no turnkey preview mode for Next.js or React frontends. Client Extensions can bridge this gap but require development effort.

Client Extensions reduce specialization requirements for extension development — developers can use React, Node.js, or Spring Boot without deep OSGi expertise. However, Java remains mandatory for core platform customization, and the Jakarta EE 10 migration adds complexity for existing teams. FreeMarker knowledge still required for fragments. Certification is strongly recommended. The specialization bar has lowered for extensions but remains high for full platform development.

A production Liferay deployment still realistically needs a minimum team of 3-5 people: backend Java developer(s), frontend developer, and DevOps/infrastructure person. Client Extensions don't fundamentally reduce team size requirements for production deployments — they shift some work to more accessible technologies but the infrastructure and platform management needs remain. Complex deployments need larger teams with specialized roles.

The Page Builder remains relatively accessible for non-technical users, now enhanced with the ability to install pre-built fragments from Liferay Marketplace directly within the builder. Content authors still need moderate training for content management workflows. Marketing teams are less autonomous than with purpose-built marketing DXPs. Content authors often still need developer support for new content types or custom page layouts.

Liferay upgrades remain painful. The mandatory Jakarta EE migration (javax→jakarta) starting with 2025.Q3 is explicitly described as 'not a weekend project' requiring dedicated time and resources for medium-to-large implementations. G2 reviews cite a team of 8 engineers taking two months for a 7.0→7.1 upgrade. Liferay provides a Blade/Workspace migration command but quarterly breaking changes continue. Not lower because within-stream quarterly updates are smoother and tooling is improving.

Liferay published 80 security vulnerabilities in 2025 alone, including multiple stored XSS (CVE-2025-43740, CVE-2025-43807), reflected XSS, and missing authorization issues. Quarterly security advisories are transparent and patches are included in fix packs. Liferay Cloud receives more automatic patching. Self-hosted patching remains manual and disruptive, requiring testing cycles. Not lower because disclosure is active and patch cadence is regular; not higher due to the high CVE volume and manual self-hosted process.

The Jakarta EE namespace migration is the largest forced migration event in Liferay's recent history — all customers must eventually upgrade from javax to jakarta. Liferay recommends waiting for 2026.Q1 LTS but has made clear there will be no future non-Jakarta releases. Legacy API deprecations (Service Builder to headless) continue. Multiple features moved to Maintenance Mode in 2025-2026 quarterly releases. Not lower because Liferay is providing migration tooling and a reasonable timeline; not higher because the migration scope is substantial and unavoidable.

Self-hosted Liferay still requires Java runtime, application server (Tomcat/WildFly), database, Elasticsearch, and optionally a document store. The new Cloud Native Experience (CNE) toolkit using Terraform, Helm charts, and ArgoCD standardizes infrastructure management and reduces manual dependency coordination. However, the dependency count remains high and the Jakarta EE transition adds temporary dependency complexity. OSGi bundle management persists as an internal complexity factor.

Liferay Cloud Platform now includes DevOps CI/CD tools, automated backups, and real-time logs. Cloud Native Experience adds Horizontal Pod Auto-scaling (HPA) and GitOps-driven monitoring. Self-hosted deployments still require comprehensive custom monitoring for JVM, database, Elasticsearch, and cache. Integration with APM tools (Dynatrace, New Relic) is available but requires configuration. Slight improvement over previous assessment due to CNE automation capabilities.

Ongoing content operations in Liferay require moderate attention. Content structure maintenance, taxonomy management, and asset library organization need periodic work. Orphaned content and broken references still require manual cleanup. No significant new automation for content hygiene has been introduced. The content operations tooling is functional but not as automated or self-healing as modern SaaS platforms.

Cloud Native Experience introduces automated scaling with HPA and standardized infrastructure blueprints, reducing some performance management burden for cloud-hosted deployments. Liferay Cloud handles some caching and scaling automatically. Self-hosted deployments still require active cache configuration, database query optimization, Elasticsearch tuning, and JVM garbage collection management. Not higher because custom tuning remains necessary even on cloud deployments.

Customer reviews show mixed experiences. Long-term customers report support has improved over the years, but others report 8-week wait times for upgrade assistance. Tiered support (Standard, Premium, Platinum) means quality support is gated behind premium tiers. Community Edition has no official support. Complex or novel issues can still have slow resolution. Not lower because some customers report genuine improvement; not higher because wait times and tier gating persist.

Liferay Community Slack is actively being used for Jakarta migration feedback, showing some vendor engagement. However, overall community forum activity has continued to decline. Stack Overflow coverage is moderate for common questions but sparse for advanced topics. The community is thin compared to major CMS platforms like WordPress or Drupal. G2 reviews note the support community is limited, leading to coding-related problems.

Bug fix turnaround continues to vary significantly. The 80 CVEs disclosed in 2025 suggests active security response, but non-critical bugs can persist across multiple quarterly releases. Liferay Cloud issues get faster attention. Self-hosted issues can take weeks to months for resolution. Fix packs are released with quarterly cadence but community-reported issues have mixed response quality. Feature requests continue to move slowly.

Liferay's Page Builder with Fragments provides drag-and-drop layout and in-context editing. The Content Marketing Platform (CMP) lets marketers launch landing pages and microsites without leaving the platform, and automated A/B testing is available for conversion optimization. Fragment development still requires developer involvement for new layouts, keeping it below dedicated marketing DXPs like Optimizely or Sitecore XM Cloud.

Liferay lacks a dedicated campaign management module with campaign calendars or multi-channel coordination. The CMP adds content workflow capabilities and the Content Dashboard Performance tab provides asset-level engagement metrics, but content scheduling remains the primary campaign-like feature. Marketing teams still require external tools for true campaign orchestration.

Liferay supports meta title/description per page, sitemap generation, OpenGraph metadata, and friendly URL management. The Page Audit tool (powered by Google PageSpeed Insights) provides SEO and accessibility recommendations per page. The AI Assistant helps craft SEO-friendly headlines and meta descriptions. Structured data (JSON-LD) still requires custom implementation, redirect management is basic, and there is no SEO scoring or keyword validation tool.

A/B testing for page optimization and AI Insights surfacing behavior-driven improvement opportunities are available, with the Forms module handling basic lead capture. However, there is no native CTA management, no conversion tracking, no UTM parameter awareness, and no lead scoring or nurture workflows, making external tooling necessary for performance marketing.

Liferay has a mature native personalization engine: audience segmentation by behavior, demographics, location, and custom attributes; content page personalization via Experiences; AI-driven personalized dashboards and content recommendations; and real-time segment evaluation. Analytics Cloud provides behavioral data to feed personalization rules. This is genuine enterprise personalization without requiring a separate CDP for most scenarios.

Liferay provides native A/B testing for content pages, testing headline variants, layouts, and CTAs with statistical significance tracking and winner detection. Tests are managed within the platform and integrated with Analytics Cloud for result reporting. The capability is solid for content-level experimentation but does not extend to full-funnel or server-side feature flagging. Auto-winner promotion is available.

CMP provides content calendaring and workflow to reduce cycle time. AI Assistant helps draft blog posts, knowledge base articles, and structured page layouts, accelerating initial content creation. Fragment-based page building allows template cloning and reuse. However, new page layouts still require developer-built Fragments, and approval workflows add overhead for regulated content. Speed is adequate but not sub-hour for net-new page types.

Liferay's API-first architecture enables create-once, publish-everywhere delivery. CMP is built for multichannel and multisite management, enabling content distribution to web, mobile apps, and connected devices from a single authoring environment. Headless APIs (REST and GraphQL) deliver content to any digital touchpoint. Channel-specific content renditions and structured content models support multi-channel delivery natively.

Liferay Analytics Cloud integrates with DXP to provide visitor behavior tracking, content performance metrics, and segment-level analytics within a Liferay-native interface. The Content Dashboard Performance tab surfaces per-asset engagement metrics. Page Audit tool provides SEO performance signals. However, Analytics Cloud is a separate SaaS product and connection with GA4, Adobe Analytics, or Mixpanel requires tag-based integration and relies on external dashboards for reporting.

Style Books enforce design tokens (colors, typography, spacing) at the site level, and Fragment Libraries provide approved, reusable components that constrain what marketers can assemble. Brand guardrails are enforced through the component palette rather than locked style overrides. This is functional but marketers can still override some styling within allowed component configurations, making it short of full lock-down brand governance.

Liferay supports Open Graph and Twitter Card metadata per page, enabling proper social preview cards across platforms. There is no native social scheduling, push-to-social workflow, or social media management integration. UGC embeds require custom development. Social proof widgets are not native. Basic OG/meta tag management covers the fundamentals but no social publishing workflow is available.

Liferay Documents and Media provides a functional DAM layer with Asset Libraries for cross-site sharing, image transformations, tagging, metadata, and search. The AI Assistant can generate image alt text and descriptions. Rights management and usage tracking are limited compared to dedicated DAM platforms. For marketing volumes, it is adequate for most mid-market scenarios but lacks advanced rights management, expiry workflows, and brand portal features of enterprise DAMs.

Liferay provides multi-language content management, translation workflows with third-party connector support, locale-specific URL management, and per-locale content scheduling. Content can be maintained in multiple languages with approval workflows per locale. However, transcreation-specific workflows (market-level campaign variants, region-specific promo calendars) are not native — generic localization is applied to marketing content rather than purpose-built marketing localization.

Liferay offers out-of-the-box connectors for Salesforce (CRM), SAP, and Microsoft 365, with flexible API/webhook integration for other systems. Analytics Cloud provides some behavioral data. However, there are no pre-built connectors for marketing automation platforms (Marketo, Pardot, Eloqua, HubSpot), ad platforms, or CDP systems. MarTech integration typically requires custom API development or third-party iPaaS solutions, limiting the native connector breadth.

Liferay Commerce provides genuine product content management with catalogs, SKU/variant modeling, product specifications, options, and rich media per product. ML-based predictive analytics power personalized product recommendations and order forecasting. B2B-specific features — customer-specific pricing, multi-level account hierarchies, account-gated catalog views — remain strong differentiators.

Liferay Commerce provides category management, product display widgets, ML-powered suggested product groups, personalized recommendations, and smart loyalty score alerts. These are functional for B2B catalog merchandising but search merchandising remains basic and content-driven commerce experiences (e.g., shop-the-look, editorial overlays) still require custom development.

Liferay's commerce strategy is self-contained — Liferay Commerce is the intended path rather than integrating with external platforms. There are no pre-built connectors for Shopify, commercetools, BigCommerce, or Salesforce Commerce Cloud, and integration with these platforms requires custom API development. This is a weakness for composable commerce architectures.

Liferay's integrated CMS and Commerce layer allows combining editorial content with product data on the same page — product display widgets can be embedded within CMS content pages. Buying guides and product-adjacent editorial are achievable. However, shoppable content (inline add-to-cart within editorial), lookbooks, and shop-the-look experiences are not first-class authoring patterns and require custom Fragment development.

Because Liferay Commerce is native to the DXP, checkout pages are standard CMS pages built with the Page Builder. CMS-managed content — trust badges, promotional banners, upsell widgets — can be placed in cart and checkout pages through the same authoring interface. This is a meaningful advantage over headless-only platforms. However, injecting dynamic CMS content into specific transactional flow steps (e.g., post-add modals) without template changes still requires developer work.

Liferay Commerce includes an account portal where customers can view order history, credit limits, and account documentation — providing basic post-purchase content. Smart loyalty score alerts and ML-driven recommendations can surface post-purchase upsell content. However, CMS-managed order confirmation pages, delivery tracking content, product onboarding sequences, and review solicitation workflows triggered by order events are not native capabilities.

B2B commerce content is Liferay Commerce's strongest suit. Native capabilities include customer-specific pricing display, multi-level account hierarchies with account-gated catalog visibility, quote-request workflows, contract pricing, spec sheets per product, and gated product documentation. These are purpose-built B2B content features, not repurposed B2C capabilities, providing genuine differentiation for manufacturers, distributors, and industrial B2B organizations.

Liferay Commerce uses Elasticsearch for product search with faceted filtering, category-based navigation, related product display, and search landing pages. Search Blueprints allow content managers to customize result ranking and content blending. AI-powered relevance improvements are included. Content-product search blending is possible within the unified CMS+Commerce environment. Synonym management and search analytics are supported.

Liferay Commerce supports promotional pricing, discount rules, and tiered pricing structures. CMS-managed promotional banners and product spotlights can be scheduled through the Page Builder. Personalized promotion targeting based on audience segments and intent signals is available. However, countdown timers, promo code display widgets, and channel-specific promotional content management are not native features and require custom development.

Liferay Commerce supports multiple storefronts with multicurrency and multilingual configurations, enabling region- or brand-specific commerce experiences from a single instance. Shared product catalogs with storefront-specific editorial and pricing are achievable. However, storefront-specific editorial content management (separate teams managing each storefront's editorial layer) adds operational complexity, and there is no dedicated multi-storefront content management dashboard.

Liferay Commerce supports image galleries, multiple media per product, and video embeds on product pages. The Documents and Media system handles image transforms. However, there is no native 360-degree product viewer, AR/3D model integration, or image hotspot functionality. Advanced visual commerce experiences require third-party integrations or custom development. This reflects Liferay's B2B focus where visual richness is less critical than account management depth.

Liferay Commerce is not designed for marketplace or multi-vendor commerce scenarios. There are no native seller profile management, seller-contributed product descriptions, review aggregation, or content moderation tools for multi-vendor scenarios. Liferay's B2B commerce model assumes a single seller with multiple buyer organizations — not a marketplace model. Implementing marketplace seller content would require extensive custom development.

Liferay Commerce supports multicurrency display, multilingual product descriptions, and locale-specific storefront configurations. Generic localization infrastructure applies to product content. Country-specific pricing rules and multilingual catalog management are supported. However, regulatory content (EU labeling, CA Prop 65), locale-specific promo calendars, and currency-aware editorial content blocks are not purpose-built features — they require configuration and some custom work.

Liferay Analytics Cloud and the Commerce analytics module provide order forecasting, product-level purchase analytics, and ML-driven engagement insights. Content-to-commerce attribution is partially achievable by correlating content engagement data from Analytics Cloud with order data from Commerce. However, direct revenue attribution to content pages, content-assisted conversion paths, and product content performance dashboards are not native — they require custom reporting or BI tool integration.

Access control remains one of Liferay's strongest capabilities, reflecting its portal heritage. Granular resource permissions, organization-based access hierarchies, role-based content visibility, user group management, SSO integration (SAML, OIDC, LDAP), and department/site-level access control are all deeply supported. For intranet scenarios, Liferay's permission model is best-in-class among DXP platforms.

Liferay provides purpose-built knowledge management through the Knowledge Base application (hierarchical articles, versioning, search), Wiki, Message Boards, and strong taxonomy/tagging. Search Blueprints surface relevant knowledge, and AI-powered search improves discovery. Content lifecycle management (review dates, expiry) is available for knowledge articles. For enterprise knowledge management, Liferay remains one of the strongest DXP options.

Employee portal capabilities remain Liferay's strongest use case: AI-driven personalized dashboards, notifications, social features (blogs, message boards, mentions), announcements, workflow-driven approvals, and mobile access. Out-of-the-box connectors for Microsoft 365, Google Drive, Salesforce, and SAP enhance the digital workplace experience. LDAP/AD directory integration is mature.

Liferay supports targeted internal communications with announcements, department-level news feeds, role-based audience targeting for content visibility, and alert notifications. Mandatory-read workflows and read-receipt tracking are achievable through the Workflow engine. The platform provides solid internal comms infrastructure for enterprise intranets. Purpose-built features like read receipts and acknowledgment dashboards require workflow configuration rather than being out-of-the-box.

Liferay has a native people directory integrated with the organization hierarchy and user profile system. Employee profiles can include skills, contact information, and organizational position. Organization hierarchy reflects reporting structures. HR system integration (Workday, BambooHR) is possible via API but no pre-built connectors exist. A visual org chart widget is available as a marketplace app but is not in the core platform.

Liferay's Documents and Media provides document versioning, metadata, taxonomy, and workflow-based approval. The Knowledge Base supports policy-style content with versioning and review workflows. Mandatory-acknowledgment flows can be configured through the Workflow engine. Automated content expiry and review reminders require custom workflow configuration. This covers the functional basics of policy management but lacks turnkey SOP tracking and audit trail dashboards.

Liferay's BPM and Workflow engine can automate onboarding content delivery sequences — role-specific task checklists, staged content access, and new-hire notification workflows are achievable. The platform's role-based personalization can surface role-specific onboarding dashboards. However, progressive 30/60/90-day content journeys, LMS-connected learning paths, and HR-triggered new-hire portals require workflow configuration and potentially custom development, rather than being turnkey.

Liferay's Elasticsearch-powered search provides AI-enhanced relevance, faceted filtering, Search Blueprints for customizable ranking, and synonym management. Search covers all Liferay content types natively. Federated search can be extended to index external systems (SharePoint, Confluence) via custom connectors. AI-powered semantic search improvements have been added in recent releases. Search quality for internal content volumes is strong.

Liferay DXP supports mobile delivery through responsive web and headless APIs. A mobile features product sheet is available, and the platform supports push notifications and mobile-optimized layouts. However, a dedicated native Liferay intranet app (comparable to Unily, Staffbase, or Viva Engage) is not part of the core product — mobile access is primarily via responsive web browser or custom-built mobile apps using the headless APIs. Offline support is not native.

Liferay does not have a native LMS or e-learning module. Learning content can be hosted in the platform via Web Content, Knowledge Base, and structured content types. The Workflow engine can track content consumption for basic completion flows. Integration with LMS platforms (Cornerstone, Workday Learning, SAP SuccessFactors Learning) is possible via API but no pre-built connectors exist in the core product. Micro-learning and certification tracking require external LMS.

Liferay has a mature social layer for enterprise intranets: blogs, message boards, comments, reactions, mentions, forums, polls/surveys, idea submission (app), and community spaces (sites) per department or interest group. Peer recognition programs can be built on the platform. Social features are native and purpose-built for the intranet use case, not bolted-on widgets.

Liferay provides out-of-the-box connectors for Microsoft 365 (including Teams integration), Google Drive, Salesforce, and SAP. Document co-editing via SharePoint/OneDrive integration is supported. Teams notifications and Slack webhooks are achievable. The integration depth provides a meaningful single-pane experience for employees, embedding Office documents and enterprise application content within the intranet. Bot-driven integrations require custom development.

Liferay supports content expiry dates, workflow-based review cycles, and archival states for web content and knowledge base articles. Content ownership assignment and expiry notifications can be configured. Stale content flagging and automated review reminders require workflow configuration rather than being turnkey. The overall lifecycle management is functional for intranet governance but below purpose-built intranet platforms with automatic stale content dashboards.

Liferay Analytics Cloud provides content engagement metrics, visitor behavior tracking, and segment-level analytics applicable to intranet measurement. Page-level view data, engagement heatmaps, and failed search term analysis are available. Department-level content performance segmentation is achievable via Analytics Cloud segments aligned to organization groups. Dedicated intranet adoption dashboards and ROI reporting are not turnkey — they require custom Analytics Cloud dashboard configuration.

Liferay supports multi-tenancy through Virtual Instances (separate users, sites, configurations, database schemas, and domains) and Sites for lighter isolation. Cross-tenant administration is available to super-admins. Virtual Instances share the same JVM, which limits true physical isolation for strict regulatory requirements — logical isolation only.

Fragments can be shared cross-site via Fragment Libraries, Style Books provide brand-level theming per site, and Asset Libraries enable shared content across sites. However, there is no explicit brand override mechanism for shared components — per-brand customization requires site-specific fragment variants — limiting native cross-brand design system support.

Liferay's organization hierarchy, site administration model, and role-based permissions provide a functional governance framework. The 2025 IDC MarketScape recognized Liferay for attribute-driven multisite publishing, cascade publishing, visual workflow design, quality gates, and life-cycle automation across content supply chains — confirming governance depth. There is still no purpose-built multi-brand governance dashboard; governance is achieved through general administration tools.

Multiple brands can share a single Liferay instance, providing infrastructure cost sharing. The 2026 unified platform (replacing separate CE and DXP distributions with one modular core) reduces operational overhead. However, licensing costs still scale with deployment size, and each brand requires independent theme development and content operations. Economics are moderate — better than separate instances but not strongly optimized for scale.

Style Books provide per-site design token configurations (colors, typography, spacing) enabling genuine per-brand visual identity on a shared component foundation. Each site can have its own Style Book assignment, and Fragment Libraries can be brand-filtered. This supports per-brand theming at the platform level while sharing the underlying component structure. Custom theme development is still required for full brand differentiation beyond Style Book tokens.

Liferay supports per-brand localization through site-level language configurations, translation workflows with approval chains, and locale-specific content scheduling. However, brand-aware translation approval (where Brand A's French team approves translations independently of Brand B's French team) requires careful Workflow configuration per site — it is not a turnkey brand-x-locale governance model. Regional legal content governance per brand requires custom workflow design.

Liferay Analytics Cloud can be configured to aggregate data across sites (brands) within a single DXP instance, providing per-site and comparative engagement metrics. Publishing cadence and content velocity can be monitored per site. However, there is no executive portfolio dashboard that presents brand-level performance side-by-side out of the box — cross-brand aggregation requires custom Analytics Cloud segment and workspace configuration.

Liferay's visual Workflow Designer allows independently configured approval chains per site (brand), enabling brand teams to manage their own publishing workflow while central administrators retain audit oversight. Workflow instances can be scoped to specific sites and content types. Central workflow audit logs are available at the system level. Per-brand workflow autonomy with central auditability is a genuine capability.

Liferay supports cascade publishing and attribute-driven multisite publishing — recognized by IDC MarketScape 2025 as key strengths. Asset Libraries enable corporate-level content shared across brand sites with site-level override capability. Content can be pushed from a master site to child brand sites with controlled local adaptation. This covers the core corporate-to-brand syndication pattern, though the override granularity per content element is limited.

Liferay provides per-site compliance configurations — cookie consent management, GDPR features, and accessibility settings can be configured per Virtual Instance or site. Publishing guardrails (e.g., preventing GDPR-non-compliant publishing) are achievable via Workflow quality gates. Data residency is configurable in Liferay Cloud deployments. However, turnkey per-brand/region compliance rules with automated publishing guardrails are not a native self-service feature.

Liferay provides a centrally maintained design foundation through Fragment Libraries (shared components) and Style Books (design tokens). Fragment Libraries can be versioned and updated centrally, with updates propagating to consuming sites. Style Books provide brand-level extensions of the central token set. This covers the core federated design system pattern. However, version governance (preventing specific brands from using older Fragment versions) and brand extension without forking are limited.

Liferay's Virtual Instance and Organization hierarchy enable central admin management of all brands with autonomous brand-level team administration. Super-admins can manage all Virtual Instances from a single control plane. SSO (SAML, OIDC) operates across all instances. Brand teams can be granted admin rights scoped to their site(s). The model effectively provides central governance with delegated brand autonomy.

Liferay's Web Content Structures can be shared across sites, providing a base content model usable by multiple brands. Site-specific structure variations allow some per-brand customization. However, extending a shared base model per brand without forking (e.g., Brand A adds a video field to the global article structure independently of Brand B adding a comparison table) is not natively supported — model changes typically require forking the base structure.

Liferay does not provide an out-of-the-box executive portfolio reporting dashboard spanning multiple brands/sites. Content freshness by brand, publishing SLA adherence, and cost allocation per tenant are not native reporting dimensions. Analytics Cloud provides per-site engagement data but requires custom configuration to aggregate into portfolio-level executive views. Operational reporting across the brand portfolio requires custom BI tool integration (Tableau, Power BI).

Liferay provides a Data Processing Addendum (DPA) that applies by default to SaaS, PaaS, and Analytics Cloud customers in EEA, UK, Latin America, and Mexico; others can incorporate it. DPA includes SCCs and sub-processor due diligence with annual review. Built-in Personal Data Erasure dashboard and consent management. EU data residency via Frankfurt region. Not 80+ because sub-processor list is not prominently public and DPA auto-applies only to certain regions.

Liferay's compliance documentation lists HIPAA alongside SOC 2 and ISO 27001 as part of their infrastructure compliance program. Healthcare portal use cases are well-documented in their customer base. However, a formal publicly-accessible BAA document is not prominently published, and healthcare-specific configuration guidance is limited. Not 70+ because BAA availability is not explicitly documented for self-service.

GDPR compliance built-in with DPA and erasure tooling. CCPA covered via DPA amendments. CSA STAR Level 2 third-party audit adds credibility. No formal FedRAMP authorization despite US government customer base. No IRAP, C5, or HITRUST certifications documented. Score reflects GDPR + CCPA coverage with CSA STAR but without FedRAMP or broad regional framework coverage.

Liferay holds SOC 2 Type II attestation, independently verified since 2019. Covers Liferay PaaS, SaaS, Analytics Cloud, and Managed Services on Liferay Infrastructure. Reports available upon request to customers. Annual audit cadence maintained. CSA STAR Level 2 attestation is conducted alongside SOC 2 criteria. Not 85+ because specific TSC coverage details beyond Security are not publicly documented.

Liferay holds ISO/IEC 27001:2022 certification with platform scope covering development, operations, maintenance, and delivery of DXP and Cloud Services Platform. Also certified ISO/IEC 27017:2015 and ISO/IEC 27018:2019 for cloud PII processing. Certified by A-LIGN. Scope covers 254 individuals. Meets the 80+ threshold for ISO 27001 platform scope plus ISO 27018.

CSA STAR Level 2 third-party attestation (active, updated Aug 2025) is a meaningful additional certification beyond SOC 2 and ISO 27001. CSA Trusted Cloud Provider designation. HIPAA compliance listed in portfolio. ISO 27017 adds cloud-specific security controls. No PCI DSS, FedRAMP, Cyber Essentials Plus, or ENS documented. Solid but not the broadest additional cert portfolio.

Liferay Cloud offers multiple global hosting regions: US (Oregon), EU (Frankfurt), UK (London), Brazil (São Paulo), India (Mumbai), Australia (Sydney), and Dubai. Each environment can be placed in a different region for granular data sovereignty. On-premise Liferay DXP provides complete data residency control. Cross-region disaster recovery available. Meets 78+ threshold with multiple regions and contractual guarantees.

Built-in Personal Data Erasure dashboard provides self-service right-to-erasure for personal data. Data portability export for user data. Content lifecycle management with versioning and expiration workflows. DPA documents retention terms. Better than most competitors due to purpose-built GDPR tooling. Not 75+ because automated bulk export tooling and post-termination retention specifics are not prominently documented.

Comprehensive audit framework enabled by default. Captures user login/logout, password changes, entitlement changes, group membership, content operations. Output in CSV or JSON format. SIEM integration via Splunk, ELK stack, Syslog audit message processor, and CloudAMQP. Configurable audit event types. Enterprise portal heritage means audit was designed for compliance from early versions. Meets 75+ for comprehensive logs with native SIEM integration.

Liferay publishes an Accessibility Conformance Report (ACR) based on VPAT 2.4, with the most recent version dated August 2024 and updated July 2025. Conformance evaluated using automated static analysis tools and manual testing with assistive technologies (screen readers, screen magnifiers, speech recognition). This constitutes formally documented WCAG 2.1 AA conformance for the authoring UI, meeting the 70+ threshold.

Liferay publishes a current VPAT/ACR publicly available for procurement evaluation, with versions from 2023Q2 and 2024 downloadable from their website. Dedicated accessibility compliance page at liferay.com/accessibility-compliance/digital-experience-platform. Section 508 conformance addressed. Documentation updated on Liferay Learn portal (July 2025). Meets 70+ threshold for current VPAT/ACR available for procurement.

Liferay ships a native AI Creator tool embedded in the Web Content editor and Documents & Media application, using ChatGPT for text generation via the user's own OpenAI API key. Content authors can generate articles from natural language prompts without leaving the editor. The feature is GA but requires users to supply their own OpenAI key, is locked to a single provider, and has no documented brand voice controls, custom prompt templates, or bulk generation capability.

Liferay AI Creator integrates DALL-E for image generation from text prompts, storing results directly in the DAM — a genuine native AI image pipeline. TensorFlow and OpenNLP providers auto-tag documents and images at ingest for improved discoverability. No dedicated auto alt-text generator is documented separately; image tagging partially covers that role. No video AI processing found.

Liferay supports automated translation via Google Cloud Translation and Amazon Translate integrations. AI Hub agents can be configured to auto-translate newly published pages into multiple languages on publish — making this an agent-driven AI/MT capability beyond a manual TMS connector. No evidence of brand voice preservation, bulk translation quality scoring, or confidence metrics across locales.

Auto-tagging using TensorFlow and OpenNLP populates taxonomy tags on web content, documents, and images at publish time. AI Hub agents extend this with pipeline-driven metadata enrichment. The Page Audit Tool integrates Google PageSpeed Insights for SEO and accessibility diagnostics. However, there is no evidence of AI-generated meta descriptions, title tags, or on-page SEO copy suggestions — the metadata automation is tagging-focused, not SEO copy generation.

Several AI workflow automations are woven into editorial: auto-tagging on content publish via AI Hub agents, AI Insights for real-time layout and content strategy recommendations, automated multi-language translation on publish, and support ticket routing via AI Hub templates. Multiple lightweight AI assists exist but none are tightly integrated into a unified editorial AI workflow; each operates as a discrete feature.

Liferay AI Hub is a GA SaaS product with a low-code visual agent builder, marketplace templates for common use cases (translation, chatbots, sentiment analysis, content tagging), and the ability to connect to any LLM provider. AI Tasks (open-source, LangChain4J) provides deeper orchestration with MCP support and integration with external tools. The combination of a named product with a marketplace and an orchestration layer puts Liferay solidly in the 55–75 range; held below 65 because governance gates and complex multi-step pipelines are not prominently documented.

AI Insights analyzes user behavior and content performance to surface real-time page layout and content strategy recommendations for marketers. The Content Dashboard provides taxonomy/category-based content analytics. These features provide useful content intelligence but fall short of AI-driven content gap analysis, topic clustering, or editorial priority scoring found in more advanced platforms.

The Page Audit Tool surfaces SEO and accessibility issues by integrating Google PageSpeed Insights — useful but rule-based and external-API-driven rather than AI-native. No evidence of AI-powered quality scoring, brand voice compliance checking, or AI-assisted duplicate/thin content detection. Content audit capabilities remain taxonomy-driven.

Liferay Enterprise Search (LES) includes production-grade semantic search: text embeddings stored in Elasticsearch using txtai (self-hosted) or Hugging Face providers, with cosine similarity/dot product scoring. The 2026.Q1 LTS release introduces Reciprocal Rank Fusion (RRF) for hybrid keyword+vector search. DevCon 2025 featured a dedicated session on this capability. Held below 65 because semantic search is an LES paid add-on, not included in base DXP.

Liferay provides content and product recommendations driven by user role, purchase history, browsing behavior, and most-viewed content. AI Insights adds ML-based page layout optimization suggestions. However, there is no dedicated ML personalization engine comparable to Bloomreach Loomi or Sitecore CDP; segment rules appear primarily configurable rather than ML-predicted, and cold-start handling or personalization performance analytics are not documented.

Liferay DXP 2025.Q4 ships an official MCP server behind a beta feature flag (LPD-63311), with documented configuration for GitHub Copilot (VS Code), Cursor, and Claude Desktop. Official documentation is live on learn.liferay.com and a DevCon 2025 session publicly demonstrated the integration. The beta flag prevents a higher score — the scoring rubric places announced/beta MCP at 25–45; strong official docs with working examples push this to the upper edge of that band.

Liferay's architecture is BYOM-first: no proprietary AI model is bundled. AI Creator requires a user-supplied OpenAI API key. AI Hub explicitly supports ChatGPT, Gemini, and Claude as selectable LLM providers. AI Tasks supports Anthropic, Vertex AI, OpenAI, Ollama, and Hugging Face (including local models). This multi-provider flexibility across the AI stack is comprehensive. No explicit data residency controls documented for the AI pipeline, which holds the score below 75.

Liferay provides strong developer AI tooling: AI Tasks uses LangChain4J for orchestration with MCP support, enabling integration with external agent frameworks; AI Hub exposes agent configuration via API; the platform's headless REST APIs are comprehensive and MCP-ready. Compatibility with LangChain via LangChain4J is documented. No dedicated AI SDK, LlamaIndex integration docs, or RAG-optimized content delivery endpoint is documented, keeping the score below 65.

Liferay AIMS (AI Management System) received ISO/IEC 42001 certification in 2025, the international standard for AI management systems — a meaningful governance signal. However, specific product features for AI audit trails (who triggered AI, what was generated), brand voice enforcement on AI output, hallucination detection, or IP indemnification are not prominently documented in public product docs. ISO 42001 addresses process governance but does not substitute for in-product AI safety controls.

No evidence found of AI usage dashboards, AI credit or cost tracking, per-user AI consumption metrics, or model performance analytics in Liferay's product documentation or public materials. Liferay Analytics Cloud provides general behavioral and content analytics but no AI-specific observability layer. BYOK model means cost tracking is delegated to the provider's own dashboard (e.g., OpenAI usage console).