Umbraco

Umbraco's Document Type system offers 30+ built-in property editors with Content Composition for reusable property groups. Umbraco 16 added property value presets, movable properties between tabs, and reintroduced Document Type inheritance. Limitations remain: no native union/polymorphic field types, and complex nested schemas require Block Editor or Element Types rather than being first-class.

Content Picker, Multi-Node Tree Picker, and Media Picker provide cross-document relationships. These remain unidirectional — Umbraco does not natively track back-references. For bidirectional lookups, developers must build custom code or query indexes. No changes in v15–17 to the relationship model.

Block List and Block Grid provide solid component-based page composition with nested block support and Element Types for reusable schemas. Block Grid adds layout control with columns, rows, and areas. The RTE (now TipTap) still outputs HTML rather than portable AST. Not as deep as Sanity's Portable Text but a strong block-based composition system for a traditional CMS.

Property-level validation is built into every property editor — required fields, regex patterns, min/max for numeric types, character limits. Custom validators via C# validation attributes and INotificationHandler for cross-field validation. The system is solid for standard use cases but complex business logic still requires backend development.

Full revision history per document with rollback, draft/published dual state, and scheduled publishing. Umbraco Workflow 16 introduced Alternate Versions — editors can now maintain multiple concurrent versions of a document without blocking the main published version, effectively providing content branching. This addresses the previously noted gap. Still requires the commercial Workflow add-on for branching capability.

The Bellissima backoffice is now mature in Umbraco 17 LTS with WCAG accessibility improvements, but there is still no true in-context page editing — editing happens in the backoffice panel, not on the live page. Block Grid provides drag-and-drop content composition. Third-party visual builders (ByteEditor, uSkinned) exist but are not core platform features.

TipTap replaced TinyMCE as the default RTE in Umbraco 16 due to TinyMCE's license change. TipTap is a more modern editor with improved table editing (add/remove columns, resize, merge/split cells), better extensibility, and MIT licensing. Internal link management and media embeds remain well-integrated. Output is still HTML rather than portable AST, which limits structured content portability.

The Media section provides a structured media library with type-based organization, built-in focal point and Image Cropper. The new Media Delivery API enables headless access to media items with metadata (dimensions, focal point, crops). Still no built-in DAM with rights management, AI tagging, or metadata workflows. External DAM integrations available via community packages.

Umbraco still has no real-time co-editing capability. Presence indicators and conflict resolution are targeted for Q2 2026 but are not yet released as of March 2026. Currently, editing the same content item simultaneously results in last-writer-wins overwrite with no conflict detection or prevention.

Significant improvement via Umbraco Workflow 16: Alternate Versions allow editors to work on parallel versions of documents, and Release Sets enable grouping and scheduling multiple content changes as a single publishing batch with task tracking. These features bring Umbraco closer to enterprise DXP workflow capabilities. However, they require the commercial Workflow add-on and are behind feature flags. Core still limited to draft/published.

The Delivery API (REST) now includes a dedicated Media Delivery API with filtering, metadata access, and security controls. Umbraco Compose (separate product, launched Feb 2026) provides GraphQL via a data orchestration layer, but core CMS remains REST-only. The REST API is well-designed with filtering, sorting, expansion, and preview mode. GraphQL via community packages (HotChocolate-based) is available but not first-party.

No built-in CDN in Umbraco CMS itself. Umbraco Cloud leverages Azure CDN for static assets. Umbraco Compose includes a Global CDN but is a separate product. Self-hosted deployments require external CDN configuration. No cache tag–based granular invalidation or edge computing capabilities in the core CMS.

Native webhook system (since v13) with configurable outbound webhooks triggered by content events (published, unpublished, deleted, saved). The internal .NET notification system via INotificationHandler remains comprehensive for server-side integrations. Umbraco Forms also supports webhooks for form submissions. Webhook delivery reliability (retries, failure logging) remains basic. No HMAC signing or advanced filtering in core.

The Delivery API plus new Media Delivery API enable fully headless delivery for any frontend framework. ASP.NET Core rendering supports coupled/hybrid delivery. Umbraco Compose adds a data orchestration layer for composable architectures. However, official frontend SDKs remain limited, RTE output is still HTML (not format-agnostic), and the headless developer experience is less polished than purpose-built headless CMSs.

No native audience segmentation in open-source core. Umbraco Engage (first-party commercial add-on, acquired 2024) provides rule-based segmentation with Deploy support for moving segments between environments, Forms and Commerce integration, and a headless Engage API. Paid license required — not in MIT core.

No native personalization in open-source Umbraco. Umbraco Engage provides rule-based personalization with behavioral triggers and visual workflow builder, Deploy support for moving config between environments, and a headless API for decoupled personalization scenarios. Still a paid commercial add-on, not core functionality.

No built-in A/B testing in core. Umbraco Engage includes A/B testing with Deploy support for test configuration portability across environments, integrated with Commerce and Forms surfaces. Requires commercial Engage license — external tool needed without it.

No native recommendation engine in core or established first-party add-on. Basic related content via IPublishedContentQuery by tags or document type is manual curation only. No ML-powered or collaborative-filtering recommendations without external service integration.

Examine (Lucene.NET-based) is Umbraco's built-in search, providing full-text indexing, fuzzy matching, field boosting, and custom indexers. A new search abstraction with built-in faceted search support is on the Umbraco roadmap but not shipped in 17.x. Current Examine provides adequate search for small-to-medium sites without advanced relevance tuning or ML ranking.

Examine's abstraction layer supports alternative backends via Examine.ElasticSearch and ExamineX (Azure AI Search, Elasticsearch). The planned search abstraction on the Umbraco roadmap will simplify provider replacement. Current extensibility is solid through C# interfaces but requires developer implementation for non-Examine backends.

Umbraco Commerce (first-party paid add-on) provides product catalog, cart, checkout, order management, payment and shipping providers, multi-currency and multi-store support, and a Drop-in Cart feature for simplified storefront setup. Smaller extension ecosystem than purpose-built commerce platforms; requires paid license.

Umbraco's commerce integration story is primarily via its own Umbraco Commerce add-on rather than deep connectors to external platforms. No pre-built Shopify, commercetools, or BigCommerce connectors available. Custom API integration required for external commerce platforms.

With Umbraco Commerce, product content is managed via Document Types with variant support for attributes, pricing, and stock. Commerce nodes integrate with the standard content tree and benefit from Umbraco's flexible content modeling. Bulk product management and PIM-level features remain limited. Requires Commerce add-on license.

No built-in analytics in open-source core. Umbraco Engage provides content performance analytics with visitor profiling and behavioral tracking integrated across Forms and Commerce surfaces. Umbraco Commerce includes an order/revenue analytics dashboard. Both require commercial licenses — analytics depth is limited without them.

GA4, GTM, and Matomo integration via template-based script injection. Community packages exist for common analytics platforms. No middleware-level analytics hooks or event streaming built in. Sufficient for most sites but not deeply integrated compared to platforms with native analytics event APIs.

First-class multi-site support within a single installation: multiple content trees with domain-based routing, independent navigation, and per-site templates. Culture and hostname assignments allow multiple sites from one CMS instance with shared media library. Well-established and stable capability.

Strong multilingual support built into core: field-level language variants with per-property translation, configurable mandatory and fallback behavior, culture-to-domain assignment, and locale-specific publishing. Umbraco 17 added consistent UTC date handling with timezone support, improving i18n accuracy. Variant UI is intuitive and well-integrated.

Umbraco.Community.TranslationManager package provides TMS integration for workflow-based translation. Community connectors for Smartling and Memsource exist at varying maturity. No official first-party TMS marketplace integrations; translation workflow relies on community packages rather than supported first-party connectors.

Multiple sites within one installation represent multiple brands with separate templates, stylesheets, and content trees. Section-level and content-tree user permissions enable per-brand editorial team isolation. No native 'brand' concept — brand separation is built from site structure and permission layers. Shared components via partial views.

Umbraco's media library provides folder-based organization, auto-populated image metadata (width, height, file path), and an Image Cropper property editor with focal point support. No asset versioning, usage tracking across content, rights/expiry management, or metadata schema customization. Falls into the basic file storage + some organization tier; external DAM (QBank, IntelligenceBank) required for advanced DAM needs.

Umbraco uses ImageSharp-based image processing with GetCropUrl for on-the-fly cropping and resizing with focal point preservation. WebP and AVIF output is supported via ImageSharp. No built-in global CDN — cloud-hosted installations rely on provider-level CDN (Azure/AWS). External Cloudinary or Imgix required for advanced transformation pipelines or global edge delivery.

No native video hosting, transcoding, or adaptive streaming. Video files can be uploaded to the media library but only as raw files — no thumbnail generation, caption management, or streaming delivery. YouTube/Vimeo/Mux embedding required for video playback. Scores in the 'requires external embedding' tier.

Block Grid Editor (Umbraco 11+) provides grid-based block composition with a structured editor panel and backoffice preview, but is code-first — developers must configure all block types. Block List Editor is simpler and less visual. No drag-and-drop WYSIWYG out of the box; ByteEditor 4.0 (third-party commercial) adds a true visual layer. No built-in visual editor for headless frontends.

Umbraco Workflow (first-party paid add-on, v17.1.1 March 2026) provides multi-stage approval workflows with configurable approval groups, thresholds, granular permissions model (since v17.0.0), audit trail, and per-document-type configuration. Integrates with Teams, Slack, and Jira. Solid offering but requires paid license and lacks the deep custom-state flexibility of enterprise DXP workflow engines.

Scheduled publish and scheduled unpublish (embargo/expiry) are built into Umbraco core for all document types. Timezone conversion is supported. No native visual calendar view for all scheduled items across the site (community Scheduled Content Dashboard package exists). No release bundles for atomic multi-item publishing.

No native real-time collaborative editing or presence indicators. Umbraco uses last-publish-wins versioning — simultaneous editors overwrite each other, with prior versions in history for rollback. A V10-era community package provides informational notifications only. Umbraco Workflow enforces sequential control via approval state but is not real-time collaboration.

Umbraco Forms (first-party paid add-on) provides a drag-and-drop form builder with conditional logic on fields, submission storage, GDPR compliance, custom workflows, spam protection (reCAPTCHA), and webhook/integration hooks on submission. No progressive profiling or multi-step form wizard patterns documented. Forms integrates with Umbraco Engage for behavioral tracking.

No native email sending capability. Marketplace includes pre-built Mailchimp and HubSpot connectors, plus ActiveCampaign community packages. Forms submissions can trigger webhooks to ESP platforms. Integration depth is connector/webhook-based rather than subscriber list sync with content push or triggered campaign sends from CMS events.

Umbraco Engage (commercial add-on) provides behavioral triggers, a visual marketing automation workflow builder, first-party visitor profiling, and segmentation. No drip campaign orchestration or explicit lead scoring documented. Engage is positioned as behavioral personalization/analytics rather than a full marketing automation platform. Requires commercial license.

No native CDP. Umbraco Engage provides first-party behavioral profiling stored on the customer's own server (GDPR-aligned), but is not a true customer data platform — no unified customer profiles across channels, no identity resolution, no Segment or mParticle integration. External CDP requires custom integration.

Umbraco has a long-established package ecosystem (20+ years) across marketplace.umbraco.com and our.umbraco.com/packages, spanning CRM, analytics, DAM, search, commerce, marketing, and AI categories (2026 AI category added to Package Awards). Active HQ investment with first-party add-ons (Commerce, Workflow, Forms, Engage). Smaller than WordPress but healthier governance than many traditional CMS ecosystems.

Native webhooks in core covering content published, unpublished, deleted, and media events. Configurable per content type, with extensible custom events via WebhookEventBase<TNotification>. Umbraco Commerce adds its own webhook events. No explicit documentation of signed payloads, retry logic, or webhook filtering in current docs. Solid coverage of key events with extensibility.

Content Delivery API supports draft preview mode. Multiple preview environments configurable via backoffice (v12.3+) with UI configuration improving in upcoming major version. Branch-based preview deployments supported via CI/CD integration. No shareable preview links with temporary access tokens. Solid draft preview for headless frontends but limited branch environment automation.

Umbraco has custom user roles with section-level and content-tree ACL. SAML and OIDC SSO are supported with role mapping from identity providers and auto-linking. No native SCIM support (SSOJet third-party required). No documented field-level permissions. Good role model with SSO but missing SCIM and field-level granularity compared to enterprise DXPs.

The Delivery API follows REST conventions cleanly with predictable endpoint patterns, consistent JSON responses, content expansion via query parameters, and filtering/sorting/pagination support. OpenAPI spec published at /umbraco/swagger. Umbraco 17.3 adds batch read endpoints for documents, media, members, and data types, improving bulk data retrieval. No GraphQL support limits flexibility compared to schema-driven headless CMSs, but it is a well-designed REST API.

No published SLAs for self-hosted deployments. Performance depends on hosting infrastructure, output caching (ASP.NET Core), and CDN setup. Umbraco Cloud (Azure + Cloudflare) provides better baseline performance. Rate limiting is self-managed. Batch operations were not natively supported until 17.3.0-RC batch read endpoints. Umbraco 17.x includes key-based caching for data type/template repositories and hybrid cache optimizations, improving server-side performance.

No official multi-language SDKs for external consumption. The .NET backend has a rich internal API via IPublishedContent and services, but there are no official JavaScript, Python, or Go client SDKs. Community-maintained TypeScript clients and Next.js starters exist but are not official. TypeScript types must be manually defined or generated from the OpenAPI spec. This remains a meaningful gap compared to headless CMSs with polished official SDKs in 6+ languages.

marketplace.umbraco.com hosts curated packages covering common integration needs: SEO, Forms, analytics, media providers, search, CRM integrations, and content delivery helpers. The marketplace is significantly smaller than Drupal's module ecosystem but has solid coverage for mid-market use cases. NuGet packages extend this further. Quality varies across packages and some are single-maintainer projects. The curated marketplace has improved discoverability over the legacy our.umbraco.com packages site.

Umbraco's extensibility is strong and dual-layered. Server-side: IComposer, IComponent, INotificationHandler patterns, custom health checks, background jobs via ASP.NET Core DI. Client-side: the Bellissima backoffice (v14+) uses Lit/Web Components/TypeScript with a declarative manifest system (umbraco-package.json) for custom property editors, dashboards, sections, and entity actions. Umbraco 17.3 adds entity actions on collection cards. This is a genuine App Framework, not just API extensibility.

Umbraco supports OAuth2/OIDC for backoffice SSO via ASP.NET Core Identity (compatible with Azure AD, Okta, Auth0, Google Workspace). Member authentication for frontend uses ASP.NET Core Identity. API authentication uses API keys for the Delivery API. MFA can be enabled for backoffice users. Umbraco 17.2 added separate concurrent login settings for users vs. members. Configuration requires .NET code rather than UI-based setup, creating a barrier for non-technical administrators.

The backoffice permission system covers user group access to content sections, document types, and media. Document-level permissions for user groups on specific content nodes are supported. Member groups provide frontend access control. Umbraco 17.2 added user group descriptions and tree navigation visual indicators for restricted access, improving permission visibility. The system is functional but lacks field-level permissions and programmatic per-document access hooks equivalent to Drupal's node access grants.

Umbraco HQ is an ISO 27001 certified product organization (confirmed on Umbraco Cloud product page). Umbraco Cloud runs on Azure with Cloudflare, inheriting Azure's broader compliance portfolio. GDPR awareness is strong as a Danish (EU-based) company. However, no SOC 2 Type 2 certification is published, and no HIPAA BAA availability is documented. Self-hosted deployments inherit the compliance posture of the hosting provider. The ISO 27001 certification is a meaningful step beyond just inheriting Azure certs.

Umbraco maintains a responsible disclosure program with CVE-tracked patches delivered via NuGet. The March 2026 security releases (17.2.2, 16.5.1) addressed privilege escalation in user groups, XSS in property descriptions, and authorization bypass on domain access — notable vulnerabilities but patched promptly across supported LTS branches. No incidents of Drupalgeddon severity. The privilege escalation and XSS findings indicate the security posture, while rapid cross-version patching demonstrates mature response processes.

Maximum flexibility: self-host on any server running .NET 10+ (Linux, Windows, Docker, Azure App Service, AWS, GCP, on-premise), or use Umbraco Cloud (managed SaaS on Azure with Cloudflare). Umbraco 17.3.0-RC adds the ability to run different combinations of backoffice, website, and delivery API independently — enabling microservice-style deployments. Umbraco Cloud provides dev/staging/production environments with CI/CD integration. Docker support via official images.

Umbraco Cloud offers 99.9% uptime SLA on paid plans with a public status page at status.umbraco.io. Recent incidents include partial outages on Cloud deployments (January 2026) and Heartcore APIs (March 2026), with scheduled maintenance windows. Self-hosted deployments have no inherent SLA. The Cloud SLA is reasonable for mid-market but below the 99.95% of enterprise-grade platforms.

Umbraco scales horizontally via standard ASP.NET Core load balancing. NuCache handles read-heavy content delivery efficiently. Redis supported for distributed caching in multi-server setups. Umbraco 17.x performance improvements include hybrid cache optimizations, key-based caching, N+1 pattern elimination in Management API, and redirect tracking optimization for large sites. This is standard .NET web scaling — proven for medium-scale workloads but not tested at extreme scale of CDN-native CMSs.

Content stored in SQL Server or SQLite with portable schema. Media in configurable file systems (local, Azure Blob, S3). Umbraco Cloud provides automatic data backups with point-in-time restore capabilities on Azure. Umbraco Deploy (commercial) handles content/schema migration between environments. The data format is open with no proprietary binary formats. RTO/RPO depend on hosting and backup strategy for self-hosted; Cloud users benefit from Azure's DR capabilities.

The dotnet new umbraco template creates a ready-to-run local project. SQLite as a local database option removes the SQL Server requirement. Visual Studio 2022 (v17.14+), VS Code with IISExpress, and .NET Core CLI are all supported. The .NET 10 requirement and Node.js 24.11+ are needed for the full development stack. The local development experience is clean for .NET developers but requires the .NET toolchain — no cloud-based sandbox or playground available.

Umbraco Deploy (commercial, included in Umbraco Cloud) provides environment-to-environment deployment of schema and optionally content. Git-based deployment via Umbraco Cloud with dev/staging/production environments. Self-hosted CI/CD uses standard .NET build pipelines (GitHub Actions, Azure DevOps, GitLab CI). Umbraco 17.3 adds unattended background upgrades with health probes, improving automated deployment scenarios. No branch-based content environments like Platform.sh.

docs.umbraco.com is well-organized, consistently maintained by Umbraco HQ, and covers all major areas including getting started, content management, development, extending, cloud, and troubleshooting. Versioned docs cover Umbraco versions through v17. The property editor tutorial demonstrates the Lit/TypeScript extension API clearly. Some areas (advanced deployment, headless patterns) are less comprehensive. Documentation quality exceeds many open-source CMS platforms but lacks interactive playground or framework-specific guides.

No auto-generated TypeScript types from content models. The Delivery API publishes an OpenAPI spec usable with openapi-generator or swagger-codegen for TypeScript interface generation, but this requires additional tooling setup. The backoffice extension system uses TypeScript/Lit natively (since v14+), but this doesn't help frontend developers consuming the Delivery API. Community typed clients exist but are unofficial. The gap versus Sanity (codegen) or Contentful (cf-typings) remains significant.

Umbraco ships two major versions per year (v15 Apr 2025, v16 Jul 2025, v17 LTS Mar 2026) plus frequent minor/patch releases — the vendor changelog shows 17.3.0-rc, 17.2.2, 16.5.1, and 13.13.1 all within March 2026. This is a strong, predictable cadence with active maintenance across multiple supported branches. Not as rapid as SaaS platforms but excellent for an open-source .NET CMS.

GitHub release notes are detailed per version. The docs site (docs.umbraco.com) provides comprehensive version-specific upgrade guides with breaking changes clearly called out — e.g., TinyMCE removal in v16, UTC date changes in v17. The official releases.umbraco.com site provides structured release history. Quality is above average for open-source CMS projects.

Umbraco publishes a public roadmap at umbraco.com/products/knowledge-center/roadmap/ with quarterly product updates (Q1 2025, Q2 2025, Q1 2026). The Winter Keynote 2026 shared AI strategy, collaboration features (Q2 2026), search abstraction, and Elements. GitHub Discussions provide community input. CodeGarden remains the annual strategy venue. More structured than previously assessed.

Post the disruptive v14 Bellissima backoffice rewrite, upgrades from v15→16→17 are described as 'relatively smooth' and 'incremental.' Semver is followed with breaking changes limited to major versions (two per year). Version-specific upgrade guides are thorough. V16 dropped TinyMCE (license change), v17 switched to UTC dates — both well-documented with migration paths. The v14 pain is now behind the community.

GitHub: ~5,145 stars, 2,868 forks, 472 contributors on the main CMS repo. Community moved from Slack to Discord (structured for better searchability) and forums migrated to Discourse in Feb 2025. CodeGarden annual conference. The community is smaller than WordPress/Drupal but substantial for the .NET CMS space. Predominantly European with growing global presence.

The Umbraco community remains genuinely engaged with its welcoming 'friendly unicorn' culture. The move to Discourse for technical Q&A (Feb 2025) created a searchable knowledge base. Discord handles social/events. 64 Contributing Partners recognized in 2025 for active contributions. Core team participates directly in community channels. MVP program active with submissions open.

Umbraco's partner program expanded significantly: 93 new partners joined in 2025, with Silver/Gold/Platinum tiers plus a Contributing Partner track (64 recognized). More business is being done with partners than ever before per company communications. Strong UK/EU agency ecosystem with growing North American coverage. Partner Summit events and certification program are well-structured.

Growing content ecosystem with UmbracoTV YouTube, community blog posts, and tutorials on the new Discourse forum. Third-party agencies (Digital Wonderlab, Cold Banana, etc.) publish regular Umbraco content. Upgrade guides and version-specific content for v15/16/17 are appearing. Content volume still substantially smaller than Drupal/WordPress but improving with the new community platform structure.

LinkedIn shows Umbraco developer jobs across US and EU. Freelance platforms (Toptal, Upwork, Arc) list Umbraco talent. However, ZipRecruiter notes limited senior-level positions, and the talent pool remains concentrated in Europe (UK, Netherlands, Nordics). The .NET developer pathway provides an on-ramp for generalists. Certification program exists but talent is still niche compared to broader CMS ecosystems.

Cloud adoption grew 50% in 2025. 93 new partners joined. Umbraco increased average deal value by 30% using G2 solutions. G2 Momentum Leader recognition. Recent case studies include Renault (340% revenue growth with Umbraco Commerce), Thames Water (enterprise), Dansani (2025 Umbraco Award). Umbraco Engage expanding the DXP proposition. Steady upward trajectory in the mid-market.

Umbraco HQ remains independently owned (Monterro as investor since 2021, $8.85M round). The company acquired uMarketingSolutions (Aug 2024) to create Umbraco Engage, showing strategic investment. Revenue streams from Umbraco Cloud, Forms, Deploy, Engage, and Commerce provide diversified income. Platform founded 2004, company profitable and stable. No acquisition pressure or layoff signals.

Significant improvement: Umbraco is now a G2 Leader in CMS (#4 overall), Headless CMS (Leader, #1 enterprise usability), and DXP (#6, up from #7). 75+ G2 badges across categories and regions. Gartner Peer Insights: 4.2–4.3 stars. Still not in formal Gartner MQ for DXP, but G2 recognition provides strong independent validation. Clear positioning as open-source .NET CMS for mid-market with growing enterprise reach.

G2 rating of 4.5/5 with 973 reviews (approaching 1,000 milestone) — a major increase from 700+ reviews previously. Per scoring rubric, G2 4.5+ with 200+ reviews warrants 75–85. Gartner Peer Insights: 4.2–4.3/5. Positive themes: editorial UX, developer flexibility, open-source freedom, .NET Core support, welcoming community. Negative themes: learning curve, custom coding requirements, limited built-in marketing tools. Overall sentiment is strongly positive.

Umbraco CMS is MIT licensed — the core platform is completely free with zero licensing ambiguity. Umbraco Cloud pricing (Starter €45/mo, Standard €280/mo, Professional €730/mo) is publicly listed. Commercial add-on pricing is available though some show as variable on the main pricing page, requiring navigation to individual product pages. The 2026 price increases were announced transparently on the blog.

The MIT license means core Umbraco has zero licensing cost regardless of content volume, API calls, user seats, or site traffic. Cloud plans are flat monthly fees with no usage-based metering or overage charges. Costs scale with infrastructure choice and optional add-ons, not vendor pricing traps. The commercial add-ons (Forms, Deploy, Commerce, Engage, Workflow) add predictable line-item costs on per-domain or annual subscription bases.

The open-source core covers content management, Delivery API, multi-site, multilingual, media management, Examine search, and the full backoffice. Forms is now included in all Cloud plans, removing a previous gating pain point. However, several meaningful capabilities still require paid add-ons for self-hosted: Deploy On-Premises (€1,100/yr), Commerce (€2,800/yr), Engage (analytics/personalization, €4,400+/yr), and Workflow (€2,800). The gating is transparent but notable.

No vendor contract for the core open-source software. Self-hosted deployments have zero vendor contractual lock-in. Umbraco Cloud offers monthly billing on all tiers (Starter through Professional), avoiding annual-only lock-in. Commercial add-on licenses are per-domain with annual renewals. You can self-host to avoid all vendor contracts entirely. Maximum flexibility at the core level.

Umbraco CMS is MIT licensed with no usage limits, no user caps, and no expiry. Developers can self-host on any .NET hosting environment (Azure App Service, local IIS, Docker, Linux) for minimal cost. SQLite support eliminates the SQL Server requirement for development and simple deployments. The full feature set of the open-source core is available with no restrictions. Umbraco Cloud offers a free trial but not a permanent free tier.

Getting Umbraco to first published content requires .NET SDK installation, project creation via `dotnet new umbraco`, and database setup (SQLite for quick start). An experienced .NET developer can reach first content in under an hour via the web installer. Non-.NET developers face additional ramp for SDK setup. Compared to SaaS headless CMSs where first content is minutes away, the local toolchain requirement adds friction, but the SQLite quick-start path has reduced this significantly.

A typical Umbraco marketing/brochure site: 4-10 weeks (£10-15K). Corporate sites: 6-12 weeks (£15-50K). Complex enterprise with multiple sites, custom integrations, and e-commerce: 3-6 months (£50-250K+). These timelines are comparable to other mid-market CMS platforms. The .NET toolchain and Umbraco's relative simplicity mean implementation times are shorter than enterprise DXPs but longer than headless CMS-native implementations.

Umbraco developers command $57-71/hr (ZipRecruiter March 2026), a moderate premium over .NET generalists. The ramp time for a .NET developer new to Umbraco is days-to-weeks — significantly shorter than for proprietary CMS platforms. Freelancer availability is strong in Europe and growing in other regions via remote hiring platforms. The premium is substantially lower than for Sitecore or AEM specialists, and .NET skills are mainstream.

Umbraco Cloud starts at €45/month (Starter) scaling to €730/month (Professional) — hosting, database, CDN, and Forms included. Self-hosted requires .NET hosting with SQL Server or SQLite, costing $10-$500/month depending on scale. Azure App Service can host Umbraco cost-effectively from ~$10-50/month for basic workloads. The hosting cost profile is moderate — lower than enterprise SaaS platforms but more than static hosting or PHP-based CMSs on shared hosting.

Self-hosted Umbraco requires standard .NET web application operations: Kestrel/IIS management, database maintenance, security patching, backup management, and performance monitoring. Umbraco Cloud significantly reduces ops burden with automatic security updates, managed infrastructure, and automated upgrades to latest patch releases. Part-time DevOps is typically sufficient for self-hosted mid-market deployments. The upcoming Umbraco 13 end-of-life (end of 2026) means version migration planning is needed.

MIT license means zero software vendor lock-in. Content is stored in standard SQL Server/SQLite with a documented schema. Media files use configurable storage providers (local, Azure Blob, S3). The Delivery API enables CMS-agnostic frontend delivery, making frontend code portable. Migration away from Umbraco requires standard database export and content transformation — no proprietary binary formats or vendor exit fees. Exit costs are developer time for content migration only.

Umbraco's core concepts remain manageable for .NET developers: Document Types, Data Types, content tree, Templates, and the ASP.NET Core MVC/Razor rendering pattern. The Delivery API follows standard REST conventions for headless use. With Umbraco 17, the Bellissima backoffice architecture is now mature and stabilized, reducing conceptual churn. Complexity is lower than Drupal but still requires understanding Umbraco-specific patterns like surface controllers, value converters, and the published content cache.

docs.umbraco.com provides structured getting-started guides, tutorials, and API references, with the Community Docs Team actively reviewing and updating all articles ahead of the v17 LTS release. Umbraco Academy offers official training (free online and paid instructor-led). UmbracoTV and community tutorials supplement. The getting-started experience requires .NET SDK setup but documentation guides this well. No interactive sandbox — local setup is required.

Built on ASP.NET Core (.NET 10 LTS in v17) — direct skill transfer for .NET developers. C#, MVC/Razor, DI, middleware patterns all apply. For headless, the Delivery API is consumed by standard HTTP clients. In v17, backoffice extensions now support framework choice (Vue, React, Svelte, Lit, etc.) via TypeScript — a meaningful improvement over the old AngularJS lock-in. Cross-platform familiarity remains limited by the .NET server-side requirement.

The dotnet new umbraco starter provides a clean project scaffold. The Clean Starter Kit for Umbraco 17 (community, by Paul Seal) now includes full Content Delivery API integration, Next.js revalidation support, API endpoints for dictionary/search/contact, and OpenAPI/Swagger documentation — a significant step up. A companion Clean Headless Next.js Frontend consumes the API directly. GraphQL support is also available via Arroact.Umbraco.GraphQL package. Quality has improved meaningfully since the last scoring cycle.

Umbraco configuration uses standard .NET appsettings.json patterns — familiar to any .NET developer. Environment-specific overrides follow standard .NET configuration provider patterns. Far fewer config files than Drupal. Database schema is managed by Umbraco's migration runner, with v17 adding automatic UTC date migration. The configuration surface area is manageable, though complex integrations (load balancing, CDN, custom search) add layers.

Adding new Document Types and Data Types is straightforward. Changing existing property types on published content can cause data loss — property data is typed at storage level and type changes are not automatically migrated. Removing properties from Document Types will orphan existing data. Umbraco Deploy helps synchronize schema across environments but content migration after schema changes requires manual effort. No fundamental changes in v17 to data modeling constraints.

The Bellissima backoffice (now mature in v17 LTS) includes an inline preview panel that renders the published template alongside the editing form. For headless builds, the Delivery API supports preview mode with an API key for draft content access. Community extensions (DeliveryApiExtensions) add the ability to preview Delivery API responses directly from backoffice content nodes. Umbraco still does not offer true in-page click-to-edit for decoupled frontends.

Umbraco requires .NET/C# knowledge for backend development — generalist JavaScript developers cannot work on the server side without cross-training. However, a .NET developer can become productive significantly faster than in Drupal. The v17 backoffice extension model now uses TypeScript with framework choice, making frontend customization more accessible to mainstream web developers. For pure headless delivery, frontend developers need no .NET knowledge.

Solo .NET developers can build and maintain Umbraco sites across the full stack. Typical production projects need 1-3 people: a .NET developer for backend and content modeling, optionally a frontend developer, and a content editor. Complex implementations with e-commerce, personalization, and integrations may need 3-5 people. Solo developer feasibility is realistic for simpler sites and well-supported by the Clean Starter Kit ecosystem.

The Bellissima backoffice, now mature and polished in v17 LTS, is consistently praised for its clean, intuitive editorial UI — a genuine competitive strength vs. Drupal, Sitecore, or AEM. Content editors typically require minimal training (1-4 hours). Marketers can manage content, settings, and templates without developer involvement once configured. The training burden across roles remains lower than most traditional CMSs.

Minor v17.x upgrades remain smooth via NuGet with automatic migration runner. However, the LTS-to-LTS jump (v13→v17) is significant: all AngularJS backoffice customizations must be rebuilt as Web Components, TinyMCE→TipTap RTE migration is automatic but may need manual intervention, and community reports culture mismatch and uSync issues. Umbraco Cloud handles minor upgrades automatically. Moderate difficulty overall — well-documented but non-trivial for major versions.

Umbraco HQ maintains a consistent quarterly security patch cadence — advisories published April 2025, July 2025, December 2025, and March 2026. March 2026 addressed a high-severity privilege escalation in the management API. Patches delivered via NuGet for self-hosted; Umbraco Cloud applies automatically. Advisories include clear severity ratings and affected version ranges. The process is transparent and predictable.

LTS versions get 3 years of support (v17 until Nov 2028 including security-only). Non-LTS: 18 months. New in v17: one-off licenses must be migrated to subscription licensing, adding a commercial forcing function on top of the technical EOL. The v13 EOL (Dec 2026) creates a concrete upgrade deadline. The licensing change and calendar-driven EOL together create predictable but unavoidable migration obligations.

Now targeting .NET 10 in v17. NuGet manages all dependencies with lockfile support. The dependency tree is standard ASP.NET Core plus Umbraco's own packages. Smidge has been removed from the default install, slightly reducing the dependency surface. Standard .NET tooling (dotnet list package --vulnerable, Dependabot) handles vulnerability scanning. Smaller and more predictable than Drupal's Composer ecosystem.

Umbraco Cloud now includes an Availability & Performance dashboard leveraging Azure metrics, hostname monitoring with automated pinging, usage tracking for bandwidth and storage, and project audit logs. This is a meaningful improvement over the previous state. Self-hosted still requires external APM (Application Insights, New Relic). The backoffice Health Check dashboard and Serilog integration remain available for basic operational checks.

Umbraco 17 introduces Release Sets as a default feature, allowing editors to group content items and schedule batch publishing — a significant content operations improvement. The backoffice retains bulk publish/unpublish, recycling bin, and media library management. No native broken link checker, but redirect management and content workflows are available via community packages. The new batch scheduling reduces day-to-day editorial coordination burden.

Umbraco 17 adds load-balanced backoffice support, removing single-machine bottlenecks and improving resilience for high-concurrency editing scenarios. Umbraco Cloud is working toward managed load balancing. ASP.NET Core Output Caching and NuCache remain the core caching layer with automatic invalidation. CDN configuration is still manual for self-hosted. Performance management requires less effort than before thanks to load balancing, but is not yet SaaS-level hands-off.

Umbraco Cloud offers tiered support with SLA-backed response times on Standard and Professional plans. G2 reviews (4.5 stars, 937+ reviews) praise the support team as responsive and helpful. Self-hosted relies on community or contracted agency support from the certified partner network. No global 24/7 enterprise NOC support comparable to Sitecore or AEM. Good mid-tier support quality but enterprise coverage is limited.

The Umbraco community remains one of the strongest in the CMS space. The new forum.umbraco.com platform is active with upgrade discussions and troubleshooting. Community Discord/Slack provides real-time help. G2 reviewers consistently highlight community support as a differentiator. Some complaints about documentation gaps and tutorial scarcity for newer versions. 21 unique community contributors to v17.0.0 reflects healthy engagement.

The Umbraco core team shipped 170 bug fixes in v17.0.0, followed by regular point releases (17.1.0, 17.2.0, 17.2.1, 17.2.2, and 17.3.0-rc in quick succession). Security patches are released within weeks of discovery. The paid core team can prioritize commercially impactful issues. Non-critical bugs can still linger. Community package maintenance varies by maintainer. Resolution velocity is good for a commercial open-source project.

Block Grid editor enables component-based landing page composition with live editing mode, but marketers cannot create new layouts without developer involvement — they compose from pre-defined block types. Third-party ByteEditor adds visual page building but is not native. Umbraco 17.3 (April 2026) brings no new visual editing features; MCP-assisted layout creation is AI-CLI tooling, not marketer self-service. Score remains in the 'can edit but not create layouts' band.

Umbraco Engage (commercial add-on) provides UTM campaign tracking, campaign analytics, marketing automation, email/SMS marketing, and a dedicated Campaigns section in the backoffice. This covers basic campaign lifecycle but lacks content calendaring and multi-channel coordination dashboards found in full DXPs. Engage MCP extensions for campaigns are planned for 2026 but not yet shipped.

SEO tooling relies on well-established community packages: SEO Checker for on-page analysis, meta tag management, and redirect management; Skybrud packages for sitemaps, Open Graph, and structured data. Custom Document Type properties handle meta fields. Umbraco 17.3 improves redirect handling performance at publish time for large sites. The ecosystem is solid but nothing is built-in — packages must be installed and maintained.

Umbraco Forms (commercial) provides form building with conditional logic for lead capture. Umbraco Engage adds A/B testing, conversion goal tracking, personalization, 360° profiling, and in-CMS analytics — covering most performance marketing needs. Together, Forms + Engage deliver a functional performance marketing stack. Both are paid add-ons but first-party and well-integrated. Engage MCP extensions (2026) will add AI-assisted A/B test management but are not yet available.

Umbraco Engage provides genuine behavioral personalization: audience segments built from referral source, visit history, geolocation, campaign tags, and persona scores. The 360° profiling engine creates rich profiles for identified and anonymous visitors. Content can be personalized per segment at the node level. Targeting rules are manageable by marketers in the backoffice. The system requires a paid Engage license and is an add-on, not built into core, but it is deep and first-party.

Umbraco Engage includes built-in A/B testing — headline variants, layout tests, CTA optimization, full page variants — with real-time result monitoring and multiple simultaneous tests. Statistical reporting is present. The capability is first-party and tightly integrated into the backoffice, reducing the need for an external experimentation tool. However, Engage is a paid add-on and A/B testing is not available without it. Auto-winner selection is not explicitly documented.

Block Grid with inline editing reduces editing cycle time for existing page types. Template cloning and reusable block types help editors create new pages quickly from defined patterns. Scheduled publish/unpublish and Umbraco Workflow (commercial) support approval-based publishing. New page layouts still require developer time to define block types. Adequate speed for teams with established page templates; slower for net-new layout creation.

Umbraco's Content Delivery API enables headless delivery to web, mobile apps, and third-party channels. The platform is web-first, but structured content models can be consumed via API for other frontends. No native multi-channel orchestration, email template management, or push notification delivery. API delivery to other channels requires frontend development work. The headless/hybrid capability exists but multi-channel is not a first-class authoring concern.

Umbraco Engage provides in-CMS analytics dashboards — page views, visitor behavior, campaign performance, goal completions — visible in the backoffice. Standard GA4 and Google Tag Manager integration works via script injection. Content performance metrics are available within Engage for Engage-instrumented pages. External analytics tools needed for full depth. Better than basic tag integration but short of full in-CMS analytics suites.

Block Grid's predefined block palette creates some consistency guardrail — editors can only use approved block types. However, no design token system, no enforced style constraints at the platform level, and no brand consistency dashboard. Brand customization is enforced via template design and developer-defined block configurations, not platform-level tooling. Adequate for teams with disciplined Block Grid definitions, but not enforced brand guardrails.

Open Graph and Twitter/X card meta tags are handled via SEO Checker and Skybrud packages, not built into core. No native social scheduling, push-to-social workflows, or social proof widgets. SEO Checker previews social card appearance. Package-based OG management is the ceiling — no first-party social publishing or scheduling capability.

Native media library supports image uploads with built-in focal point and crop definitions via Image Cropper property editor. Basic asset search and folder organization. No rights management, usage tracking, or brand portal capabilities. Third-party DAM integrations (Cloudinary, Azure Blob, Bynder) are available via marketplace packages but require installation and configuration. Below the threshold of a true DAM.

Umbraco has solid built-in multi-language support — content variants per language, Dictionary items for UI strings, language-specific domains. However, there are no transcreation workflows, locale-specific campaign scheduling, or market-level compliance guardrails. Regional cookie consent requires third-party packages. Generic localization infrastructure applied to marketing content, not purpose-built marketing localization tooling.

CRM integrations documented on umbraco.com with webhook/API-based connectors to Salesforce and HubSpot. Umbraco Compose (launched 2025) acts as a composable integration hub connecting CMS, CRM, PIM, DAM, and ERP into unified API outputs. Marketplace has various CRM and MAP package integrations at varying maturity levels. No pre-built native connectors to ad platforms or CDP. Better than minimal but not deep pre-built MarTech stack.

Umbraco Commerce supports product content modeling via Document Types and property editors — product variants, attributes, per-variant pricing, and custom metadata. Complex data structures including tiered pricing and cross-sell relationships are possible via editor-friendly schemas. Q1 2026 added Customer Management with order history and analytics widgets. Product modeling is flexible but not purpose-built — less structured than dedicated PIMs and requires developer setup to model correctly.

Umbraco Commerce provides category navigation, promotions engine, discount codes, and basic cross-sell via content relationships. Q1 2026 added analytics widgets for Top Selling Products, Applied Discounts, Most Popular Discounts, and Stock Forecast — giving merchandisers better visibility into performance. Still no algorithmic merchandising, search merchandising, or content-driven discovery. Analytics improvements add insight but not merchandising action.

Umbraco Compose (launched 2025) is a SaaS composable integration layer designed to connect CMS, PIM, ERP, and external commerce platforms into unified API outputs. Pre-built connectors to Shopify/commercetools remain community-maintained. Extended MCP for Commerce data is on the 2026 roadmap but not shipped. The Storefront API enables headless commerce integration. Custom API integration is feasible via .NET but most external commerce platforms require developer effort.

Umbraco CMS + Commerce together can support buying guides and product-adjacent editorial content — editors can create editorial pages that reference Commerce product nodes. However, shoppable content with inline product references and purchase CTAs is not a first-class authoring pattern. Blending rich editorial with commerce data requires developer implementation rather than being an out-of-the-box editorial workflow.

Umbraco Commerce Checkout is a drop-in add-on package providing a themeable checkout flow. CMS-managed content in the checkout (trust badges, upsell banners, shipping callouts) is technically possible — the checkout flow renders via Umbraco templates — but is not a zero-dev capability. Template modification required to inject CMS-controlled content into the transactional flow. Score reflects the gap between capability and marketer self-service.

Post-purchase experience (order confirmation, delivery tracking pages, onboarding sequences) lives largely within Commerce templates. A Drop-in Member Portal (my account) add-on is under development to enable Commerce project member registration and order history, but is not yet released. Abandoned cart overview in CMS is also roadmap items. Currently, post-purchase content lives in developer-controlled templates rather than being CMS-managed.

Umbraco Commerce supports B2B scenarios with customizable customer-specific pricing (price lists by customer group), member-gated catalogs, approval workflows, and ERP integrations. Personalized logins via Members enable per-customer product/pricing visibility, quick order, reorder, and saved shopping lists. Features require implementation but Commerce provides the primitives. Less out-of-the-box than dedicated B2B platforms but genuinely capable with development.

Examine search (Lucene-based) provides full-text search across CMS content including Commerce products. No native faceted search for commerce discovery, no synonym management, no search merchandising, and no blended content-product search results without custom development. Search landing pages and faceted filtering require developer implementation. The search foundation is solid but commerce-specific search enrichment is not addressed out-of-the-box.

Umbraco Commerce's promotions engine handles discounts with time-based activation (start/end dates). Scheduled publish/unpublish in the CMS enables time-based promotional content (banners, sale pages). Multiple discount types (fixed, percentage, free shipping, buy-X-get-Y) are supported. No native countdown timer widgets, promo code messaging components, or channel-specific targeting of promotional content. Basic scheduled banners with Commerce discount rules.

Umbraco Commerce's Storefront API (introduced 12.1) enables a true headless multi-storefront architecture with separate frontends per region/brand consuming a shared Umbraco CMS backend. Multi-currency, multi-tax, and multi-language are built-in. However, storefront-specific editorial content (legal pages, regional landing pages) requires some content duplication within the CMS tree rather than a governed shared/override model. Capable with some duplication.

Umbraco's media library handles standard product images with focal point cropping. Video embeds are possible via property editors (YouTube/Vimeo embed or video file uploads). No native 360-degree product views, AR/3D model support, or image hotspot tooling. Advanced visual commerce capabilities (zoom, hotspot, 3D) require custom frontend implementation or third-party integration — not addressed by Commerce or core CMS out-of-the-box.

Umbraco Commerce and CMS have no marketplace-specific features — no seller profiles, seller-contributed product descriptions, content moderation at scale, or review aggregation. Multi-author backoffice access could technically support some seller content submission workflows, but this is generic CMS multi-author capability, not marketplace tooling. Building a marketplace on Umbraco would require extensive custom development.

Umbraco CMS has built-in multi-language support (content variants per language, Dictionary items) and Commerce supports multi-currency and multi-tax out-of-the-box. Locale-specific product descriptions via language variants are possible. Currency-aware content blocks require custom implementation. No native regulatory content management (EU labels, Prop 65) or market-specific promo calendar tooling. Generic multi-language + Commerce multi-currency applied to product content.

Umbraco Engage tracks content engagement (page views, goals, conversions) and Commerce added analytics widgets (Top Selling Products, Applied Discounts, Stock Forecast) in Q1 2026. However, direct content-to-revenue attribution — connecting a specific editorial page to downstream purchase — requires custom implementation connecting Engage events to Commerce orders. Analytics split between Engage (content) and Commerce (transactions), with no native revenue attribution bridge.

Content-node-level permissions for backoffice users (deny/allow on specific nodes and subtrees by user group). Member groups control frontend content gating for intranet/portal scenarios. User group permissions cover document type, media, and section access. Functional for most intranet and B2B portal implementations. Less granular than Drupal's node access grant system but sufficient for department-level content isolation with SSO-backed member authentication.

Hierarchical content tree maps well to knowledge base structures. Tags and categories via property editors enable classification. Examine search provides full-text search for knowledge bases. Umbraco Workflow (commercial) adds approval workflows for content updates. No native content lifecycle management (review dates, expiry, archival). Adequate for organizational knowledge bases but requires architectural design work to assemble from primitives.

Umbraco can serve as an intranet CMS with member groups for authenticated access, content tree for navigation, and Forms for employee interactions. Uintra (open-source framework) provides a news/events feed, groups, and activity streams on top of Umbraco — reducing custom dev burden significantly. No native news feed, employee directory, notifications, or social features in core. Substantial custom development still needed beyond Uintra to match SharePoint or dedicated intranet platforms.

Umbraco supports publishing news and announcements to authenticated member groups — providing basic audience-segmented internal comms. Scheduled publish/unpublish for timed announcements. No read receipts, acknowledgment tracking, mandatory-read workflows, or targeted comms dashboards. Uintra extends this with a collective activity feed, but still lacks acknowledgment and mandatory-read capabilities critical for compliance-driven internal comms.

No native people directory or org chart tooling in Umbraco core or official add-ons. An employee directory can be built using Member types (custom Document Types for people profiles) with Examine search, but this is a ground-up custom build rather than a platform feature. Org chart visualization requires additional frontend development. HR system integration (Workday, BambooHR) requires custom API connectors. Score reflects the absence of platform-provided tooling.

Umbraco has built-in content versioning and rollback. Umbraco Workflow (commercial) adds multi-stage approval workflows suitable for policy update reviews. Scheduled publish/unpublish handles planned policy activations. No native mandatory acknowledgment tracking, automated review date reminders, or SOP expiry workflows. Basic document publishing with version control and optional commercial approval tooling — functional but short of a compliance-grade policy management system.

No native onboarding journey tooling in Umbraco. Structured onboarding pages can be built as content types with member-gated access and role-based content trees. Progressive disclosure (30/60/90 day content release) would require custom scheduled content logic. Umbraco Engage segments could be used for role-specific content personalization in an onboarding context. This is an assembly-from-primitives scenario, not a platform feature.

Examine search (Lucene-based) provides full-text internal search across CMS content with custom index definitions for faceting. Uintra adds Elastic Search for intranet scenarios. No federated search across SharePoint, Confluence, or Google Drive. No AI-powered relevance ranking. Search quality for internal content volumes is adequate for CMS-scoped content but cannot index connected external systems without custom integration work.

No native Umbraco mobile app. Intranet frontends built on Umbraco can be made responsive and PWA-enabled, providing web-based mobile access. The Umbraco backoffice itself has responsive improvements in recent versions. No native push notifications, offline support, or kiosk/shared-device modes. Deskless/frontline worker access relies on a developer-built responsive web frontend — adequate for basic access but not a native mobile experience.

No native LMS integration or learning management features in Umbraco. Training content (courses, modules, quizzes) can be hosted as CMS content, but completion tracking, certification, and course assignment require a dedicated LMS. No documented Cornerstone, Workday Learning, or SCORM integration in the marketplace. Learning content hosting is the only realistic use case — external LMS required for everything else.

No native social or collaboration layer in Umbraco core. Uintra provides an activity feed, news feed, events, and group spaces on top of Umbraco — giving a modest social layer for intranet deployments. Comments, reactions, polls, and peer recognition all require Uintra or custom development. Uintra covers the basics but is an open-source third-party framework requiring separate adoption and maintenance.

No native Microsoft 365/Teams, Google Workspace, or Slack integration in Umbraco core or official add-ons. Webhook-based integrations are technically feasible and some community packages exist for notification pushing. Embedded content cards, bot-driven notifications, and single-pane experiences would require custom development. The platform is not positioned for workplace tool integration and the marketplace reflects this.

Scheduled publish/unpublish in core handles basic content expiry. No automated review date reminders, stale content flagging, ownership assignment, or archival workflows. Umbraco Workflow (commercial) adds approval steps but not lifecycle management for existing content. Content freshness for intranet trust requires manual editor discipline or custom automation scripts. This is a notable gap for intranet use cases.

No native internal content analytics or engagement dashboards in core. Umbraco Engage provides visitor analytics but is primarily a marketing personalization tool rather than an intranet adoption measurement tool. Department-level analytics, failed search terms, and adoption dashboards are not addressed by any first-party tooling. External analytics (GA4) can provide basic page views. Score reflects the absence of purpose-built intranet analytics.

Multi-site via domain and hostname configuration provides logical tenant isolation within a single installation — separate content trees, templates, and user group permissions per site. True database-level isolation requires separate Umbraco installations. No native multi-tenant admin dashboard. Community confirms multi-tenancy works in Umbraco 15/17 but many plugins don't support it. Logical isolation is solid; physical isolation requires separate instances.

Shared partial views, Element Types (reusable content components), and the shared media library enable component sharing across brand sites within a single installation. Common block types defined once and reused across sites. No governed design system override mechanism — brand customization via separate CSS/templates rather than theme inheritance. Cross-site content sharing via API possible but requires custom implementation.

User group permissions provide central admin with per-site editorial access control. Umbraco Workflow (commercial) enables multi-stage approval workflows per Document Type. MCP Server (Umbraco 17) keeps permissions and governance at center for AI-assisted workflows, preventing unauthorized changes. No out-of-box governance dashboard for multi-brand management. Cross-site approval hierarchies require custom development.

Core CMS remains MIT-licensed — zero per-brand software cost increment for a single installation hosting multiple brand sites. Commercial add-ons (Commerce, Engage, Forms, Workflow) are priced per installation, not per site, maintaining economics as brand count grows within a single instance. The model becomes less favorable if separate installations are needed for true tenant isolation, as add-on costs multiply. Still competitive vs. per-brand licensed CMS platforms.

In a multi-site Umbraco installation, each brand site has its own templates, stylesheets, and asset folders. This provides CSS-level brand isolation but not platform-level design token management or theme inheritance. Brand customization requires developer-maintained CSS and template sets per brand. No token override system, no design system versioning, and no central-to-brand theme propagation mechanism.

Umbraco multi-language support provides per-brand locale configuration. Translation workflows are not natively governed per brand — a shared translation workflow applies across the installation. There are no brand-specific translation approval chains, no regional legal content governance guardrails, and no system for managing market-specific compliance content per brand. Generic localization infrastructure without brand-locale governance distinction.

No portfolio analytics dashboard across brand sites in Umbraco or any first-party add-on. Umbraco Engage provides per-site analytics within the backoffice for each site, but there is no aggregate view across multiple brand sites. Cross-brand performance comparison requires manual aggregation from per-site analytics or external tools (GA4 with multi-property reporting). Executive-level portfolio reporting is not addressed.

Umbraco Workflow (commercial) supports per-Document-Type approval chains that can be configured independently per content area and thus per brand site. Approval stages, reviewers, and notification recipients can be set per content type/group. However, workflows are configured per Document Type rather than natively per brand, and there is no central audit view across all brand workflows. With careful configuration, brand-specific workflows are achievable but not natively first-class.

No native corporate-to-brand content syndication with controlled override points. Content can be copied/referenced across sites within a single Umbraco installation using shared media library and shared Element Types. The 17.x Content Delivery API enables API-level content consumption across brands. However, press release push with local adaptation, override control, and syndication governance requires custom development rather than platform-native tooling.

No per-brand/region compliance guardrails in Umbraco. Cookie consent is handled via third-party packages (Cookiebot marketplace integration). Accessibility compliance is the developer's responsibility. GDPR data handling is addressed at infrastructure/hosting level, not CMS publishing guardrails. Data residency is an Umbraco Cloud hosting consideration, not per-brand CMS enforcement. There are no CMS-level guardrails preventing non-compliant publishing per brand.

Shared partial views and Element Types enable a degree of centrally maintained component sharing across brand sites. The 17.3 backoffice block-single package export improves developer tooling for shared component consumption. However, no centralized design system with versioning, token management, brand-level extension governance, or update propagation. Design system management is a developer-practice discipline, not a platform feature.

A single Umbraco installation provides a central backoffice where a super-admin can manage all brand sites. User groups can be scoped to specific sites/content sections, enabling autonomous brand editorial teams with their own permissions. SSO integration for single sign-on across brand teams is supported. No dedicated cross-brand user management dashboard or cross-brand contributor role with controlled access across multiple brands. Functional centralization without dedicated tooling.

Shared Document Types across multi-site provide a common base model that all brand sites use. Brand-specific extensions (adding fields per brand) can be achieved via composition and Element Types, but this typically results in separate Document Type variants per brand rather than a truly shared base with clean per-brand extension. Forking the base model per brand is the common pattern, which limits maintainability at scale.

No executive portfolio reporting across the brand portfolio in Umbraco or any first-party add-on. No content freshness tracking by brand, publishing SLA reporting, cost allocation per tenant, or capacity planning dashboards. Umbraco Engage provides per-site analytics but no portfolio aggregation. Portfolio reporting requires external business intelligence tooling (GA4, Power BI, Looker) connected to per-brand data exports. This is a notable gap for multi-brand platform management.

Umbraco is headquartered in Odense, Denmark (EU jurisdiction). DPA with SCCs publicly available as a PDF. Sub-processor list published (Azure). EU data residency default on Umbraco Cloud. Umbraco Forms includes consent tracking. Strong GDPR posture. Not higher because sub-processor list is minimal (just Azure) and right-to-erasure tooling is not self-service.

No HIPAA BAA offered by Umbraco. No healthcare-specific compliance documentation published. European-market focus means HIPAA is not a priority. Self-hosted Umbraco on HIPAA-compliant infrastructure is technically feasible but platform provides no BAA or guidance.

Strong GDPR via Danish EU HQ. No FedRAMP authorization. CCPA coverage implied via DPA but not explicitly documented. No IRAP, C5, or PCI-DSS attestation. NIS2 Directive compliance work underway (required by July 2025 for Danish implementation). Compliance investment is EU-centric.

Umbraco does NOT hold SOC 2 certification. Their compliance FAQ explicitly states they have no active focus on obtaining SOC certification and instead rely on Microsoft Azure's SOC reports. Per anti-pattern rules, cloud provider certifications cannot be inherited by the platform. No SOC 2 Type 1 or Type 2 attestation exists for Umbraco itself.

Umbraco achieved ISO/IEC 27001:2022 certification in January 2026 for its product organization — platform scope, not just infrastructure. Third-party audit by independent security specialist. This is a significant recent milestone. No ISO 27018 (cloud PII processing) certification documented. Score reflects platform-scope 27001 without 27018.

No additional certifications beyond ISO 27001. No CSA STAR Level 2 audit, no PCI-DSS, no Cyber Essentials Plus, no FedRAMP, no IRAP. NIS2 compliance work is in progress but not a certification. Base score for no additional certifications per rubric.

Umbraco Cloud offers two data center regions: EU (NW Europe / Netherlands) and US East (Virginia). Customers choose at provisioning. EU residency is contractually backed via DPA. No APAC region option for Umbraco Cloud. Self-hosted deployments provide complete residency control. Score reflects EU/US binary choice with contractual guarantee.

Content version cleanup with configurable retention (default 90 days for daily snapshots, 4 days for all versions). Forms data retention configurable per-form with automated deletion. Content Delivery API provides JSON export. No documented post-termination retention period. Right-to-erasure is not a self-service portal — requires manual handling.

Umbraco has a native Audit Trail tracking content changes and user actions. Infrastructure logs have a default 24-hour retention. No native SIEM integration — achieving SIEM requires self-hosted Azure deployment with custom log forwarding. Audit trail history is persistent for content operations. Log export requires custom implementation.

Umbraco now claims WCAG 2.2 Level AA and ATAG 2.0 conformance for the backoffice. External accessibility consultant reviewed editor-facing workflows throughout 2025. Most audited issues resolved and shipped in v17/17.1. UI components built with accessibility tests. Some system-level improvements (keyboard movement, text spacing) still in progress for 2026.

Umbraco maintains a continuously updated Accessibility Conformance Report (ACR) tracking backoffice accessibility status. This functions similarly to a VPAT for procurement purposes. No formal VPAT document specifically found, but the ACR serves a comparable role. Not higher because no Section 508 formal conformance statement and some system-level accessibility work remains in progress.

Umbraco.AI.Prompt (GA) delivers field-level, click-to-execute text generation, rewriting, summarization, and expansion using Mustache-templated prompts scoped to document types and fields — this is native, not a plugin. Central governance in Umbraco.AI foundation enables brand voice controls applied across all prompts. The conversational Copilot chat sidebar (Umbraco.AI.Agent.Copilot) is pre-release targeting Q2 2026, meaning no bulk generation or interactive AI editing is in GA yet.

Alt text generation is GA via Umbraco.AI.Prompt and also available via the third-party AltTextAI marketplace package (blendinteractive.umbraco.alttextai). Native image generation is not yet shipped — it is in exploration within the pre-release Copilot roadmap. No AI video or DAM processing capabilities are documented.

No native AI translation is built into Umbraco core. The ecosystem provides solid third-party coverage: Translation Manager by Jumoo with an official OpenAI API connector (jumoo.translationmanager.openai on Marketplace), and Diplo Translator using Microsoft Neural MT for dictionary items. Umbraco.AI.Prompt can be used for per-field draft translation via custom prompts, offering a lightweight option. No brand voice preservation or bulk quality scoring across locales.

Umbraco.AI.Prompt (GA) natively generates SEO titles, meta descriptions, alt text, content summaries, and taxonomy tags as one-click field actions referencing full page context. These are first-party features in the official Umbraco.AI monorepo. Missing is an on-page SEO scoring dashboard or content optimization scoring built into the editorial workflow — those require third-party packages like SeoToolkit.Umbraco.

Umbraco.AI.Prompt enables auto-tagging, alt text, and metadata enrichment across content items with configurable prompt actions — covering basic AI-assisted enrichment in editorial workflows. Smart scheduling, duplicate detection, and bulk content lifecycle automation via AI are not yet shipped. Automated content workflow chaining is on the roadmap but still in planning.

Umbraco.AI.Agent is built on Microsoft Agent Framework (MAF) with AG-UI protocol support for streaming, and 66 Agent Skills have shipped for Backoffice Extension use cases — indicating real agentic investment. However, the Copilot UI and full multi-step workflow automation are pre-release targeting Q2 2026. Named agent products for content pipelines (equivalent to Contentstack Agent OS or Sanity Content Agent) are not yet GA. Early/beta classification is appropriate.

No AI-driven content intelligence dashboard, gap analysis, or topic clustering is built into Umbraco core or the Umbraco.AI framework. Umbraco Engage provides visitor analytics and A/B testing results, but these are not AI-generated content performance insights. No stale content detection, SEO gap identification, or editorial priority recommendations powered by AI have been announced.

AI Tests and Evaluations is in development (Q1 2026 target) as an official Umbraco.AI feature for evaluating prompt quality across providers before going live — this addresses model/prompt governance more than content quality auditing. No brand voice compliance scanning, accessibility AI auditing, or at-scale duplicate content detection is available in GA. Umbraco.AI.Prompt can be configured for custom review prompts but requires manual setup.

Umbraco's default search (Examine/Lucene) has no native vector or semantic search. AI-powered semantic search requires third-party solutions: ExamineX (commercial) adds Azure AI Search or Elastic backend with vector search and semantic ranking, and community patterns exist for Azure Cognitive Search integration. A new search abstraction ('A new era for Search') is on the roadmap but has no firm date. Fully external requiring custom integration.

Umbraco Engage (commercial add-on) provides rules-based personalization, persona scoring, A/B testing, and 360° visitor profiling — but explicit scoring uses manually defined rules, not ML predictions. No ML-driven predictive segment assignment or next-best-content recommendations exist. The planned Engage MCP (Q2 2026) will let AI agents manage personalization configuration, but runtime AI-based personalization delivery is not on the near-term roadmap.

The official Umbraco Developer MCP Server was released in beta in September 2025 (targeting Umbraco 16), is open-source in the Umbraco GitHub org, and exposes 315+ Management API endpoints as composable MCP tools covering content, media, document types, data types, templates, stylesheets, Umbraco Commerce, and log inspection. Permission-aware, read/write/publish capable, compatible with Claude, Cursor, VS Code Copilot. The Hosted Editor MCP (for editorial teams) and Engage MCP are announced for Q2 2026. Beta status and developer-only current scope prevent a higher score.

Umbraco.AI is architecturally built on Microsoft.Extensions.AI (M.E.AI) as a provider abstraction layer, with five official first-party NuGet provider packages: OpenAI, Anthropic (Claude), Google Gemini, Amazon Bedrock, and Microsoft AI Foundry. Users configure their own API keys and pay providers directly — Umbraco has no billing role. Multiple connections per provider are supported, and governance (tone, behavior, permissions) is defined once centrally. Switching providers requires only a config change. Community-built provider packages can be added via M.E.AI. This is effective BYOK with best-in-class provider flexibility.

The Management API (315+ REST endpoints) is now fully exposed as MCP tools, making Umbraco highly accessible for AI agents. The Umbraco Base MCP library provides a template for building custom MCP servers. M.E.AI extensibility allows custom provider packages. Agent Skills (SKILL.md with YAML frontmatter) are a published integration pattern. No dedicated LangChain/LlamaIndex/CrewAI integration guides exist, and a Content Delivery MCP for RAG-ready published content access is announced but not yet shipped.

Umbraco.AI ships full request/response audit logging with error categorization and version history for all AI entities (prompts, profiles, contexts). Central governance in the AI foundation applies tone and behavior controls across all packages. The MCP server respects Umbraco's existing user permission model exactly. The Copilot requires human approval before applying changes. Missing: hallucination detection or confidence scoring, IP indemnification clauses, and dedicated brand safety enforcement scanning.

Umbraco.AI provides token tracking per request with hourly aggregation and daily rollup, plus full audit logging of all AI interactions. These give basic cost attribution and usage visibility at the platform level. Missing are per-user/team breakdowns, prompt effectiveness analytics, LLM latency dashboards, or quality trend monitoring. No dedicated observability dashboard is documented — integration with external platforms like Langfuse would require custom middleware.