Umbraco

Document Types, Element Types and Compositions with a broad property editor set (pickers, block editors, tags, date, color, dropdowns, image cropper, custom editors) and Umbraco 18 Elements as reusable typed content. Not higher because schema is authored in the backoffice UI, with code serialization only via uSync or Umbraco Deploy, and there are no union or polymorphic field types.

Content Picker, Multi-Node Tree Picker and Element Picker give one-to-many references, and tracked references show 'used by' reverse lookups in the backoffice and through the Relations service. Not higher because reverse traversal is not queryable through the Delivery API and there is no native many-to-many or polymorphic reference model.

Block List, Block Grid (with nested areas) and blocks inside the TipTap rich text editor give deep component composition built on Element Types. Not higher because rich text is stored as HTML with embedded block markers rather than a portable structured format, and Block Editor and Elements integration is still roadmap for v19.

Mandatory flags with custom messages, regex validation, min/max on blocks and pickers, allowed types and allowed children rules, with server-side enforcement on Management API writes and custom C# validation through notification handlers. Not higher because there is no built-in cross-field rule engine; complex rules require code.

Every save creates a version with user attribution in the history and audit trail; the rollback dialog shows a diff against a chosen version per culture, the recycle bin restores deleted content, and version cleanup retention is configurable. Not higher because core has no branching or release bundles; Alternate Versions require the paid Umbraco Workflow add-on.

The Tags property editor gives flat, group-scoped tags reusable across document and media types, and hierarchical taxonomies are commonly modelled as content-tree nodes picked with the Multi-Node Tree Picker; media types carry custom metadata schemas. Not higher because there is no governed hierarchical taxonomy feature, synonyms or bulk reclassification, and filtering by tag in the Delivery API needs a custom filter handler.

Backoffice preview renders drafts on the coupled Razor site with device and culture switching, and the Delivery API serves drafts with an API key for headless frontends, with configurable external preview URLs. Not higher because there is no click-to-edit overlay on the frontend, no shareable unauthenticated preview links and no official framework SDKs for headless preview.

TipTap became the default rich text editor in Umbraco 16, with extensions, embedded blocks, media and links, and the Delivery API can return rich text as a JSON element tree instead of HTML. Not higher because the stored format is HTML and custom marks and annotations require extension development.

Folder-based media library with custom media types and metadata, Image Cropper with focal point, ImageSharp URL-based resize, crop and WebP conversion, SVG support, and tracked references showing where an asset is used. Not higher because AVIF and smart responsive delivery need configuration or a CDN, and video gets basic upload only.

Core is last-save-wins with no presence indicators, locking or inline comments; Umbraco Workflow adds comments on approval tasks only. Below the 40 to 55 band because there is no conflict detection at all; real-time collaboration remains on the roadmap and unshipped through 18.2.

Core offers granular publish permissions and 'send for approval' notifications; the Umbraco Workflow add-on adds multi-stage approvals with approval groups, thresholds, per-node and per-type configuration, Teams and Slack notifications and an audit trail. Not higher because configurable workflow exists only in the paid add-on and core is limited to draft and published.

Core schedules publish and unpublish per culture with timezone handling (UTC dates since 17) and a configurable, clock-aligned scheduling period since 18.1. Not higher because release bundles and a release calendar exist only in the Umbraco Workflow add-on (Release Sets).

Property-level culture variation per document type, a fallback language per language that can chain, mandatory languages that block publishing, per-culture publishing and scheduling, culture-domain binding and Accept-Language support in the Delivery API. Not higher because locale-aware preview is limited to backoffice culture switching and content segments need custom providers.

User groups with section access, start nodes, granular per-node permissions, language permissions and document property value permissions that hide or lock individual properties per group, plus OIDC and SAML external login providers for backoffice users. Not higher because there is no native SCIM provisioning and no environment-specific role model outside Umbraco Cloud.

Separate Content and Media Delivery API and Management API, with query handlers for fetch, filter, sort and paging, expand and fields selection, locale via Accept-Language and typed OpenAPI 3.1 schemas in Umbraco 18. Not higher because there is no GraphQL in core, and filters beyond the defaults require custom C# handlers.

Umbraco Cloud fronts sites with a managed CDN and cache purging, and Umbraco 18 adds configurable output caching and cache-busting media URLs. Not higher because self-hosted installations, the majority of the base, leave CDN and purge integration to the developer, with no edge personalization.

Backoffice-managed webhooks cover content and media publish, unpublish, delete and more, filtered by content type, with custom headers, delivery logs and custom events via WebhookEventBase, plus the in-process Notification API. Not higher because payloads are not HMAC-signed in core and there is no event-streaming alternative.

The Delivery APIs make content channel-agnostic and typed OpenAPI schemas allow generated clients in any language, with optional JSON rich text output. Not higher because Umbraco is a traditional CMS with an API layer added, ships no official multi-language SDKs and models are often shaped around web pages.

Umbraco Engage, a separately licensed product, adds rule-based and behavioral segments, personas and customer journey stages built on first-party visitor profiles, with a headless Marketing API. Not higher because it is an add-on with no deep named-CDP integration or identity resolution; the open-source core has no segmentation.

Umbraco Engage delivers per-page, cross-page and document-type personalization by segment, previewable in the backoffice through the segment switcher, and exposed headlessly. Core content segments exist but need a custom provider. Not higher because the capability is a separate paid product.

Umbraco Engage runs A/B and split tests on headlines, layouts, CTAs and page variants with goals, real-time monitoring and significance reporting. Not higher because it is an add-on and multivariate testing and traffic allocation controls are limited compared with dedicated experimentation tools.

No recommendation engine exists in core, Engage or Commerce; related content is curated by hand with pickers or built from Examine queries. Scored in the none band because no algorithmic recommendations were found.

Examine on Lucene.NET ships in core, and Umbraco Search, the first-party open-source search abstraction released for Umbraco 17 and 18 as a free package and moving into core in Umbraco 19, adds filtering and faceting on page properties, language and segment support, permission-aware results, shadow-index rebuilds and an index management UI, with swappable Elasticsearch and Typesense providers; HQ also maintains an Algolia integration. Not higher because autocomplete, search analytics and result merchandising are not provided and developers still build the search UI.

Umbraco Commerce, a separately licensed product, provides catalog-in-content-tree products, cart, checkout, multi-store, multi-currency, discounts, tax, order management and payment providers (Stripe, PayPal, Mollie, Klarna and more). Not higher because it is an add-on and lacks PIM depth and B2B features of dedicated commerce platforms.

The first-party Shopify integration adds a backoffice product picker and value converter pulling live product data from the Shopify Admin API. Not higher because Shopify is the only maintained connector, with no commercetools, BigCommerce or SFCC integrations and no bidirectional sync.

Umbraco Engage adds page and content analytics, heatmaps, visitor profiling, goal tracking and bot filtering inside the backoffice, and Engage 18.2 redesigned reporting with period comparison and server-side paging for large reports; Commerce adds order and revenue dashboards. Not higher because core has no content performance analytics and Engage is a separate paid product.

GA4, Tag Manager and Matomo are added through community packages or template script injection, and Umbraco maintains a Google Search Console integration. Not higher because there is no first-party GA4 or Adobe Analytics integration and no event helpers.

One installation hosts many sites as separate content roots with hostname and culture binding, independent templates and settings, and content can be picked across roots; Umbraco 18 Elements add a shared reusable-content library. Not higher because there is no site-level management console or per-site configuration UI beyond the tree.

Core offers side-by-side split-view editing of language variants; TMS and machine translation connectors (DeepL, Microsoft, Google, XTM and others) come from the commercial Translation Manager package by a partner. Not higher because Umbraco maintains no first-party TMS connectors or translation memory.

Brands run as separate roots with user group start nodes for per-brand editorial access, shared document types and compositions, and a shared Elements library with reference tracking. Not higher because there is no cross-brand policy enforcement, brand overrides of shared components or brand-level analytics.

Core media is a basic library with custom metadata and usage tracking but no rights, approvals or asset versioning. Umbraco HQ removed its Aprimo integration because it does not support Umbraco 17 and later, so enterprise DAM now arrives only through marketplace connectors such as the uxbee Bynder connector, QBank and Mediaflow. Not higher because no vendor-maintained DAM connector or first-party DAM exists for current versions.

Video and audio files can be uploaded to the media library as dedicated media types, but there is no transcoding, adaptive streaming, captions or player; most sites embed YouTube or Vimeo. Not higher because nothing beyond file storage is provided.

Block Grid gives editors drag-and-drop layout composition with columns, nested areas, allowed-block palettes and custom block previews inside the backoffice. Not higher because composition happens in a form view rather than live on the page, there is no visual builder for headless frontends, and full WYSIWYG builders such as ByteEditor and uSkinned are third-party.

Umbraco renders full sites natively with ASP.NET Core Razor templates and routing, and Umbraco Cloud, a separate paid product, hosts them with managed CDN, TLS, custom domains, multiple environments and a deployment pipeline. Not higher because hosting is a separately purchased product, the open-source CMS is self-hosted, and headless frontends are not hosted.

Umbraco Forms, a paid add-on, provides a drag-and-drop builder with conditional logic, multi-page forms, hidden fields, submission storage, GDPR retention, spam protection, workflows and webhooks on submit, a headless Forms API, and now pre-fills fields from member properties for logged-in members with per-member submission tracking. Not higher because it lacks full progressive profiling and form analytics and is licensed separately.

Umbraco maintains Forms integrations for HubSpot and ActiveCampaign, Mailchimp and others come from the marketplace, and Umbraco Automate can send messages from CMS events. Not higher because there is no native email send, subscriber sync or email preview in the CMS.

Umbraco Automate, generally available since July 2026 as open source, runs flows triggered by CMS events, webhooks and C# triggers, and its Q3 2026 control flows add branching, rejoining and human approval steps with their own paths; Engage adds behavioral triggers. Not higher because neither offers lead scoring, drip orchestration or lifecycle stages, so it is workflow automation more than marketing automation.

Core provides URL segments, culture hostnames and automatic 301 redirect tracking when content moves or is renamed, and meta fields are modelled per document type and exposed through the Delivery API. Not higher because XML sitemaps, manual redirect management, structured data and SEO recommendations come from community packages such as SEO Toolkit or are built by the team.

Community marketplace packages now cover answer-engine readiness: AI Visibility for Umbraco generates llms.txt and llms-full.txt, serves Markdown per page through content negotiation, audits robots.txt and logs AI crawler requests in a dashboard, and Flowcourier AEO does much the same. Not higher because none of this is first-party, there is no native crawler control or AI citation reporting, and structured data stays a template task.

marketplace.umbraco.com lists hundreds of NuGet-delivered packages across categories, alongside first-party products (Forms, Workflow, Commerce, Engage, Deploy, Automate) and HQ-maintained integrations for Shopify, Algolia, HubSpot and others, backed by a 20-year community. Not higher because many packages are small community projects with uneven maintenance.

Members are native: member types and groups, registration and login, public access rules for gated pages, external login providers for members (OIDC, Entra ID, Google) and protected content in the Delivery API. Not higher because there are no ready-made portals, self-service account pages or consent management.

The Delivery API follows REST conventions cleanly with predictable endpoints, consistent JSON, content expansion, filtering/sorting/pagination, and batch read endpoints (17.3+). Umbraco 18 added opt-in typed OpenAPI schemas for each Document/Element/Media Type as discriminated unions keyed on contentType, moving to the built-in Microsoft.AspNetCore.OpenApi (endpoint /umbraco/openapi/), and this continues across the 18.1.x/17.6.x servicing line and the 18.2/17.7 RCs. No GraphQL keeps it below schema-driven headless CMSs, but it is now a very well-designed, self-documenting REST API.

No published SLAs or documented rate limits for self-hosted deployments; performance depends on hosting, output caching, and CDN setup. 17.4 added server-side output caching for template-rendered pages with intelligent invalidation (content key, ancestors, content type, related items) and concurrent-request collapsing, and 18 adds configurable Delivery API output caching atop 17.x hybrid/key-based caching; batch reads (17.3+) mitigate N+1 patterns. It stays in the 50s because there is no CDN-native delivery edge tier comparable to headless SaaS competitors and rate limiting is self-managed.

No official multi-language SDKs for external consumption. The .NET backend has a rich internal API via IPublishedContent and services, but there are no official JavaScript, Python, or Go client SDKs. Umbraco 18's typed OpenAPI schemas improve client codegen (Umbraco itself uses @hey-api/openapi-ts internally) but do not constitute shipped SDKs. Community-maintained TypeScript clients (e.g. @grace-studio/umbraco-client) and Next.js starters exist but are not official. This remains a meaningful gap versus headless CMSs with polished official SDKs in 6+ languages.

marketplace.umbraco.com hosts curated packages covering common integration needs: SEO, Forms, analytics, media providers, search, CRM integrations, and content delivery helpers. The marketplace is significantly smaller than Drupal's module ecosystem but has solid coverage for mid-market use cases. NuGet packages extend this further. Quality varies across packages and some are single-maintainer projects. The curated marketplace has improved discoverability over the legacy our.umbraco.com packages site.

Umbraco's extensibility is strong and dual-layered. Server-side: IComposer, IComponent, INotificationHandler patterns, custom health checks, background jobs via ASP.NET Core DI. Client-side: the Bellissima backoffice (v14+, matured through v18) uses Lit/Web Components/TypeScript with a declarative manifest system (umbraco-package.json) for custom property editors, dashboards, sections, and entity actions. Umbraco 18's new Library section (starting with Elements as first-class content types — reference tracking, validation, scheduled publishing, rollback, permissions, audit logs) extends the composable content model further. This is a genuine App Framework, not just API extensibility.

Umbraco supports OAuth2/OIDC for backoffice SSO via ASP.NET Core Identity (compatible with Entra ID, Okta, Auth0, Google Workspace), and MFA for backoffice users. Member authentication uses ASP.NET Core Identity; API auth uses keys for the Delivery API. Umbraco 18 adds a lightweight external-only members option (minimal identity record when authenticating members via Entra ID, Auth0, Google, or any external IdP), improving federated member scenarios. Configuration still leans on .NET code rather than UI-based setup, a barrier for non-technical administrators.

The backoffice permission system covers user group access to content sections, document types, and media. Document-level permissions for user groups on specific content nodes are supported. Member groups provide frontend access control. 17.2 added user group descriptions and tree navigation visual indicators for restricted access, improving permission visibility. The system is functional but lacks field-level permissions and programmatic per-document access hooks equivalent to Drupal's node access grants.

Umbraco achieved ISO 27001:2022 certification (Jan 27, 2026) covering the product organization and Umbraco Cloud, following an independent third-party audit of people, processes, and technology. GDPR posture is strong as a Danish (EU) company, with active NIS2 Directive and EU Cyber Resilience Act compliance work. However, Umbraco explicitly does not pursue its own SOC 2, relying on Azure's SOC certification instead, and no HIPAA BAA is documented. ISO 27001 + GDPR without SOC 2 places it above GDPR-only platforms but below full SOC 2 + ISO 27001 leaders.

2026 has brought a steady run of advisories: March (CVE-2026-31832/31833/31834, privilege escalation, domain-access authz bypass, XSS), a High-severity Delivery API public-access bypass (CVE-2026-69197, CVSS 8.7, protected content leaked through picker properties), and on Aug 18 a High-severity Management API authorization flaw that chains to remote code execution, alongside Forms and Umbraco AI fixes. Disclosure and response are good: researcher-credited GHSAs, same-day patches on supported lines, automatic patching on Umbraco Cloud, and clear mitigation guidance. Below 70 because the cadence and severity of 2026 findings are rising, EOL majors 14 to 16 got no patch for the RCE chain, and there is still no public bug bounty.

Maximum flexibility: self-host on any server running .NET 10+ (Linux, Windows, Docker, Azure App Service, AWS, GCP, on-premise), or use Umbraco Cloud (managed SaaS on Azure with Cloudflare). Modular running of backoffice, website, and delivery API independently (17.3+) supports microservice-style deployments, and Umbraco 18 continues the modular-deployment direction. Umbraco Cloud provides dev/staging/production environments with CI/CD integration and official Docker images.

Umbraco Cloud offers a 99.9% uptime SLA on paid plans with a public status page at status.umbraco.io, and self-hosted deployments have no inherent vendor SLA. Incidents remain fairly frequent — the most recent acknowledged outage was July 21, 2026 (resolved Jul 24), and third-party trackers record 483+ incidents over the platform's history (monitored since Oct 2022). The Cloud SLA is reasonable for mid-market but below the 99.95% of enterprise-grade platforms.

Umbraco scales horizontally via standard ASP.NET Core load balancing. NuCache handles read-heavy content delivery efficiently, and Redis is supported for distributed caching in multi-server setups. 17.x/18 performance improvements include hybrid cache optimizations, key-based caching, N+1 elimination in the Management API, and redirect tracking optimization for large sites. Standard .NET web scaling — proven for medium-scale workloads but not tested at the extreme scale of CDN-native CMSs.

Content stored in SQL Server or SQLite with portable schema. Media in configurable file systems (local, Azure Blob, S3). Umbraco Cloud provides automatic data backups with point-in-time restore on Azure. Umbraco Deploy (commercial) handles content/schema migration between environments. The data format is open with no proprietary binary formats. RTO/RPO depend on hosting and backup strategy for self-hosted; Cloud users benefit from Azure's DR capabilities.

The dotnet new umbraco template creates a ready-to-run local project, and SQLite as a local database option removes the SQL Server requirement. Visual Studio 2022, VS Code with IISExpress, and the .NET CLI are all supported. Umbraco 18 requires .NET 10 and Node.js for the full development stack. The local experience is clean for .NET developers but requires the .NET toolchain — no cloud-based sandbox or playground available.

Umbraco Deploy (commercial, included in Umbraco Cloud) provides environment-to-environment deployment of schema and optionally content. Git-based deployment via Umbraco Cloud with dev/staging/production environments. Self-hosted CI/CD uses standard .NET build pipelines (GitHub Actions, Azure DevOps, GitLab CI). Unattended background upgrades with health probes (17.3+) improve automated deployment scenarios, continued through 18. No branch-per-PR content environments like Platform.sh.

docs.umbraco.com is well-organized, consistently maintained by Umbraco HQ, and covers getting started, content management, development, extending, cloud, and troubleshooting. Versioned docs now cover through Umbraco 18, including the custom-generated-client guide for the Delivery API. The property editor tutorial demonstrates the Lit/TypeScript extension API clearly. Some areas (advanced deployment, headless patterns) are less comprehensive, and there is no interactive playground.

Umbraco 18 closed the biggest gap: opt-in typed OpenAPI schemas for each Document/Element/Media Type, so generated TypeScript types can be shaped to the actual content model (discriminated union on contentType) rather than a loosely-typed property bag. This is first-party, content-model-aware type generation, plus the backoffice extension system is TypeScript/Lit-native and Umbraco itself uses @hey-api/openapi-ts. It stops short of 80+ because it is opt-in config requiring an external client generator (e.g. @hey-api/openapi-ts, openapi-typescript-codegen), and the OpenAPI 3.1 oneOf/discriminator patterns aren't uniformly supported by generators — not the seamless dedicated codegen of Sanity or Contentful.

The scheduled multi-branch cadence held through Q3/Q4 2026: 18.2.0 and 17.7.0 GA shipped on the announced Sep 17 date, followed by 13.16.2 (Sep 14), security patches 18.2.1/17.7.1 (Oct 6), and 18.3.0-rc/17.8.0-rc (Oct 15) ahead of an Oct 29 GA, with v19.0.0, 18.4.0 and 17.9.0 already dated for Dec 10. Umbraco keeps v18, v17 LTS and v13 LTS patched in parallel on a published calendar. Not higher only because headline features remain gated to the twice-yearly majors.

GitHub release notes are detailed per version, releases.umbraco.com gives a structured per-branch history with forward release dates, and docs.umbraco.com carries version-specific upgrade guides with breaking changes called out. Security fixes are pre-announced (heads-up posts) and then published as dated advisories. Above average for open-source CMS projects but without the polished side-by-side migration diffs of best-in-class platforms.

Umbraco publishes a Now/Next/Later roadmap with target quarters and version numbers (Elements in the Block Editor Q4 2026 for v19+, EF Core replacing NPoco Q2 2027 for v20+, core Search Abstraction) plus a roadmap-history page, and the quarterly product updates stayed on schedule with the Q3 2026 update (Sep 24). Follow-through is visible: the CMS Editor MCP slated for Q3 shipped as a hosted public beta in Q3, and Artifact Deployments moved from Next to Now. Not higher because there is no community voting on roadmap items.

Since the v14 Bellissima rewrite, majors have followed a predictable incremental playbook with public RC windows (18.2/17.7 and now 18.3/17.8 ship as RCs about two weeks before GA), semver with breaking changes confined to the two majors a year, and thorough version-specific upgrade guides. Umbraco now also offers Extended Long-Term Support for v13 after its 14 December 2026 EOL (6, 12 or 24 months of security patches via a private NuGet feed), giving customers who cannot upgrade in time a supported path. Not best-in-class on automated codemods or migration tooling.

The main CMS repo has ~5.3K GitHub stars, ~2.9K forks and 470+ contributors, inside the rubric's 5K to 20K band. Community runs on Discord (social) and Discourse forums (community.umbraco.com), with a dense calendar of regional festivals and meetups (UK Conference, Kalaset Stockholm, DK Festival Aarhus in Oct/Nov 2026) on top of Codegarden. Smaller than WordPress/Drupal but substantial for the .NET CMS space.

Engagement stays high and visible: a monthly uProfile series spotlights MVPs, package maintainers and core contributors, community members ship packages and tooling around new releases (PropertyNavigator, RazorSearch on the new Umbraco Search, community MCP servers and an 11-model MCP benchmark), and the core team participates directly on GitHub and Discourse. Tempering signal: core-code contribution is thin, with only 4 of 176 v18 fixes from the community.

Formal Silver/Gold/Platinum partner program plus a Contributing Partner track, with 93 new partners in 2025 and a 2026 push outside Europe: a Melbourne office and APAC head (Jan 2026), Marathon Consulting as the first US Platinum Partner, regional Partner Summits with awards (Scandia won at the US Partner Summit, Oct 2026; Zeroseven's Umbraco Cloud award, Jun 2026). Strong UK/EU agency base and certification program. Lacks the global SIs (Accenture/Deloitte) that anchor tier-1 DXP ecosystems.

The independent community press is fresh and steady: Skrift publishes monthly (issue 132, October 2026, marking 10 years) with practitioner articles on MCP servers, load balancing and Vite dashboards plus a curated 'Around the Web' digest, and 24 Days In Umbraco ran 25 articles in December 2025 covering v17, Compose, headless and the new Search. Add UmbracoTV, umb.fyi and agency blogs on v18/Compose. Still far below Drupal/WordPress volume, and Pluralsight/Udemy course coverage is thin.

Umbraco developer jobs appear on LinkedIn across the UK, EU and US, and freelance platforms (Toptal, Upwork, Arc) list Umbraco talent; the certification program is well-defined and HQ is investing in next-generation developer outreach. The pool remains concentrated in Europe (UK, Netherlands, Nordics) with limited senior supply. The broad .NET base provides an on-ramp, but talent is niche next to WordPress/Drupal.

Product momentum keeps broadening: Q3 2026 brought Copilot Workspace (RC), the hosted CMS Editor MCP (public beta, free on all Cloud tiers), and Umbraco Cloud Load Balancing, Readiness Gating and Dedicated Resource tiers, on top of the Feb 2026 Compose launch. Customer signals include Thames Water's 90% CMS cost cut (diginomica), Icon Group on Umbraco Cloud, and a MemberWise survey ranking Umbraco first for membership organizations. Still mid-market-centric rather than landing marquee enterprise logos quarterly.

Umbraco HQ remains independent under majority owner Monterro (since 2021) with ~188 employees (Apr 2026), new geographic expansion (Melbourne office), and no acquisition or layoff signals. It became a Certified B Corporation in Aug 2026 and reports a Support NPS of 82, and revenue is diversified across Cloud, Forms, Deploy, Engage, Commerce and Compose with a routine annual price update for 2027. Not higher because there is no recent growth round and financials are private.

Umbraco positions itself clearly as the open-source .NET CMS that is 'the most agent-ready CMS', backed by shipped Copilot, Editor MCP and Developer MCPs and Skills, with Compose extending it into orchestration. G2 Leader placements across CMS, Headless, DXP and WebOps (Spring 2026: 79 badges, Best Usability in Headless and DXP) support the claim. Still absent from the Gartner DXP MQ and the Forrester Wave, which caps the ceiling.

G2 rating of 4.5/5 with roughly 950+ reviews puts Umbraco in the rubric's '4.5+ with 200+ reviews' band, supported by Gartner Peer Insights at 4.2 to 4.3/5 and a reported Support NPS of 82. Praise centres on editorial UX, developer flexibility, open-source freedom and the community; criticism on the learning curve, custom coding needs and limited built-in marketing features. Confidence lowered because G2 blocked a direct refresh this run.

Umbraco CMS is MIT licensed with zero licensing ambiguity, and Umbraco Cloud prices are public (Starter €45/mo, Standard €280/mo, Professional €730/mo, dedicated-resource tiers listed separately). The 2027 price post (30 Sept 2026) publishes the full catalogue three months ahead: Cloud plans, environments, every add-on (Forms, Deploy On-premises, Workflow, Commerce, Engage), support plans and even the €75,000 Umbraco for Enterprise bundle. Not higher because the Enterprise Cloud tier is still 'Talk to us' and some markets now show dedicated resources folded into the default project price at creation.

The MIT license means core Umbraco has zero licensing cost regardless of content volume, API calls, seats or traffic. Cloud plans are flat monthly fees with unlimited team members and no usage metering or overage billing; dedicated-resource tiers and extra environments are flat add-ons, and annual increases are index-sized (about 4–7% for 2027) and announced three months ahead. Not higher because add-ons stack as separate annual line items and the default-dedicated-resources test in some markets raises the effective entry price.

The open-source core covers content management, Delivery API, multi-site, multilingual, media, Examine search and the full backoffice, and Cloud plans include Forms and Deploy (Content Flow). Self-hosted teams still pay separately for Deploy On-premises (€2,800/yr), Workflow (€2,800/yr), Commerce (€2,800/yr) and Engage personalization/analytics (€800–€18,800/yr), and business-hours support only arrives on Cloud Professional. Not lower because none of the gated items are basic security features: SSO, roles and audit history are in the free core.

No vendor contract for the core open-source software. Self-hosted deployments have zero vendor contractual lock-in. Umbraco Cloud offers monthly billing on all tiers (Starter through Professional), avoiding annual-only lock-in. Commercial add-on licenses are per-domain with annual renewals. You can self-host to avoid all vendor contracts entirely — maximum flexibility at the core level.

Umbraco CMS is MIT licensed with no usage limits, no user caps, and no expiry. Developers can self-host on any .NET hosting environment (Azure App Service, local IIS, Docker, Linux) for minimal cost. SQLite support eliminates the SQL Server requirement for development and simple deployments. The full feature set of the open-source core is available with no restrictions. Umbraco Cloud offers a free trial but not a permanent free tier.

Getting Umbraco to first published content requires .NET SDK installation, project creation via `dotnet new umbraco`, and database setup (SQLite for quick start). An experienced .NET developer can reach first content in under an hour via the web installer. Non-.NET developers face additional ramp for SDK setup. Compared to SaaS headless CMSs where first content is minutes away, the local toolchain requirement adds friction, but the SQLite quick-start path has reduced this significantly.

A typical Umbraco marketing/brochure site: 4-10 weeks (£10-15K). Corporate sites: 6-12 weeks (£15-50K). Complex enterprise with multiple sites, custom integrations, and e-commerce: 3-6 months (£50-250K+). These timelines are comparable to other mid-market CMS platforms. The .NET toolchain and Umbraco's relative simplicity mean implementation times are shorter than enterprise DXPs but longer than headless CMS-native implementations.

Umbraco developers command ~$42/hr average onsite (ZipRecruiter 2026, $33-47 range) and ~$58/hr for remote roles ($49-69), a moderate premium over .NET generalists. The ramp time for a .NET developer new to Umbraco is days-to-weeks — significantly shorter than for proprietary CMS platforms. Freelancer availability is strong via Toptal, Upwork, and Arc.dev. The premium is substantially lower than for Sitecore or AEM specialists, and .NET skills are mainstream.

Umbraco Cloud starts at €45/month (Starter) and runs to €730/month (Professional) with Azure hosting, managed SQL, Cloudflare CDN, WAF and Forms included; dedicated-resource tiers, load balancing and managed Redis (Professional/Enterprise, July 2026) add cost for higher-traffic sites, and extra environments are €45–€70/month each. Self-hosted needs .NET hosting with SQL Server or SQLite, roughly $10–$500/month depending on scale. A moderate profile: cheaper than enterprise SaaS, dearer than static hosting or PHP shared hosting.

Self-hosted Umbraco needs standard .NET operations: Kestrel/IIS, database maintenance, security patching, backups and monitoring, which part-time DevOps usually covers for mid-market sites. Umbraco Cloud removes most of this with automatic patch upgrades (on by default for new projects since February 2026), managed SQL and WAF. Umbraco 13 LTS reaches end of life on 14 December 2026, under two months away, pushing self-hosted teams onto v17 LTS (.NET 10) or v18, with paid XLTS extensions as a fallback.

MIT license means zero software vendor lock-in. Content is stored in standard SQL Server/SQLite with a documented schema. Media files use configurable storage providers (local, Azure Blob, S3). The Delivery API enables CMS-agnostic frontend delivery, making frontend code portable. Migration away from Umbraco requires standard database export and content transformation — no proprietary binary formats or vendor exit fees. Exit costs are developer time for content migration only.

Umbraco's core concepts stay manageable for .NET developers: Document Types, Data Types, content tree, Templates, and ASP.NET Core MVC/Razor rendering, with the Delivery API using standard REST for headless. The Elements/Library model (18.0, refined through 18.1 and the 18.2-rc) layers reusable non-routable content onto the existing Block paradigm rather than inventing a new one, so it adds a concept without adding a mental model. Complexity sits below Drupal but above pure headless CMSs because surface controllers, value converters, and the published content cache remain Umbraco-specific patterns.

docs.umbraco.com provides structured getting-started guides, tutorials, and API references that the Community Docs Team has kept current through the v17.6 LTS cycle and the v18.x feature set. Umbraco Academy offers official training (free online and paid instructor-led), and UmbracoTV plus our.umbraco.com supplement with community tutorials. The getting-started experience requires .NET SDK setup but is well-guided; the main gap remains the absence of an interactive cloud sandbox — local install is still required to evaluate.

Built on ASP.NET Core (.NET 10 LTS in v17.6 and v18.x) — direct skill transfer for .NET developers using C#, MVC/Razor, DI, and standard middleware. For headless, the Delivery API is consumed by any HTTP client, and Umbraco 18 emits opt-in typed OpenAPI schemas per Document, Element, and Media Type — now generated via native Microsoft.AspNetCore.OpenApi (Swashbuckle removed in the 18.x line) — so standard codegen tools (e.g. Orval) produce typed TypeScript clients. Cross-platform familiarity is still capped by the mandatory .NET server-side runtime.

The dotnet new umbraco template provides a clean scaffold, and the Clean Starter Kit (Paul Seal, targeting Umbraco 17+) bundles Content Delivery API integration, Next.js revalidation, dictionary/search/contact endpoints, and OpenAPI/Swagger docs. With Umbraco 18's built-in typed OpenAPI schemas, the documented Orval workflow auto-generates typed clients and models for a Next.js frontend, closing much of the earlier codegen gap. The vendor still does not ship a first-party opinionated Next.js/Nuxt starter, which is what keeps this from scoring higher.

Configuration uses standard .NET appsettings.json patterns — familiar to any .NET developer — with environment-specific overrides through the standard configuration provider chain and far fewer config files than Drupal. Umbraco's automatic migration runner manages database schema changes, and v18 additions like typed OpenAPI output are simple opt-in config flags. The configuration surface area is manageable for a stock install, though load balancing, CDN, and custom search integrations still add layers.

Adding new Document Types and Data Types is straightforward, and Umbraco 18's Elements/Library gives a cleaner home for reusable content, but changing property types on published content can still cause data loss because property data is typed at storage level with no automatic migration, and removing properties orphans existing data. Umbraco Deploy helps synchronize schema across environments, yet content migration after schema changes remains a manual effort. The constraints are well-known and avoidable with planning, but they keep the score in the low 60s.

The Bellissima backoffice includes an inline preview panel that renders the published template alongside the editing form, and the Delivery API supports preview mode via an API key for draft content. The community DeliveryApiExtensions package adds the ability to preview Delivery API responses directly from backoffice content nodes, which closes most of the headless preview gap. Umbraco still does not ship true in-page click-to-edit for decoupled frontends, which is what caps this in the high 60s.

Server-side customization requires .NET/C# knowledge — generalist JavaScript developers cannot work on the backend without cross-training. However, a .NET developer ramps significantly faster than in Drupal or Sitecore, and the v17.6/v18.x backoffice extension model is standard TypeScript with framework choice, which makes UI customization accessible to mainstream web developers. For pure headless frontend delivery, no .NET knowledge is required.

Solo .NET developers can ship and maintain Umbraco sites across the full stack, and typical production projects need only 1–3 people: a .NET developer for backend and content modeling, optionally a frontend developer, and a content editor. Complex implementations layering commerce, personalization, and external integrations may extend to 3–5 people, but that is closer to the project ceiling than the floor. Solo-developer feasibility is realistic for standard builds and well-supported by the Clean Starter Kit ecosystem.

The Bellissima backoffice is consistently praised for its clean, intuitive editorial UI, a genuine strength against Drupal, Sitecore, or AEM, and the Library section lets editors manage reusable Elements independently of pages. 18.2 added shared progress dialogs for bulk publish, unpublish, move and copy, remembered collection views and card/table document-tree views, and 18.3-rc lets editors schedule all selected languages at once, further cutting the cases where editors need a developer. Editors typically need only a few hours of training; it stops short of higher because new page types and blocks still require developer-configured Document Types.

Minor upgrades stay smooth via NuGet with an automatic migration runner: 18.2.0/17.7.0 (2026-09-17) and the 18.2.1/17.7.1 patches (2026-10-06) shipped with no breaking changes, though the 18.3.0-rc/17.8.0-rc release notes warn that Release builds can fail after upgrading for projects with a direct ImageSharp reference (new Six Labors licence check). The v17→v18 major still carries real breaking changes (UmbracoApiController removed, ILocalizationService/IFileService split, OpenAPI endpoint moved) and the v13→v17 AngularJS→Web Components backoffice rebuild remains the real barrier. Modern-line upgrades are manageable, but G2 reviewers still call upgrades 'complicated and time-consuming', so moderate difficulty overall.

Umbraco HQ continues coordinated cross-version patching: on 2026-10-06 it fixed four advisories (two medium CVSS 4.3 start-node authorization bypasses, a low SignalR information disclosure and a low upload-extension bypass) in 17.7.1 and 18.2.1 on publication day, following the 2026-08-18 high-severity CVSS 8.8 template-modification RCE (pre-announced three days ahead, patched in 18.1.1/17.6.2/13.16.1) and the 2026-07-07 Delivery API fix. Advisories carry CVSS scores and affected ranges, patches ship via NuGet for self-hosted and apply automatically on Umbraco Cloud. The steady run of authorization-class advisories in 2026 (March, May, July, August, October) keeps this from scoring higher.

v18 shipped as Standard-Term Support and HQ frames staying on v17 LTS (support to Nov 2027, security to Nov 2028) as an equally valid choice, so LTS customers are not pushed onto each major. Still, v16 EOL (June 2026) has passed and v13 EOL on 14 December 2026 is now under two months away, forcing the hardest migration in the product's recent history (AngularJS backoffice to Web Components) on a fixed calendar, and v17+ requires subscription licensing. Predictable but unavoidable migration obligations.

v17/v18 target .NET 10 with dependencies managed via NuGet, and HQ actively keeps them current (regular NuGet minor/patch sweeps, Dependabot npm bumps, Tiptap 3.29.2, SQLitePCLRaw pinned to a non-vulnerable version in 18.2.0). But third-party licensing now leaks into the tree: the ImageSharp 3.2.0 security update in 18.3.0-rc/17.8.0-rc adds a Six Labors build-time licence check that breaks Release builds for projects referencing ImageSharp directly, a real transitive-dependency burden. The tree is otherwise standard ASP.NET Core plus Umbraco packages, smaller and more predictable than Composer-based PHP stacks.

Umbraco Cloud's monitoring keeps maturing: the 2026 'More Visibility, More Control' update adds portfolio-wide hostname monitoring with uptime/ping history alongside the Availability & Performance page (Azure metrics: HTTPS status codes, response times, CPU time, memory), usage tracking, a Sustainability Dashboard, and audit logs — a meaningful reduction in setup burden for managed customers. Self-hosted still requires external APM (Application Insights, New Relic) for real observability, with the backoffice Health Check dashboard and Serilog covering only basics. Solid for Cloud, still hands-on for self-hosted.

v18's Library section manages reusable Elements with reference tracking, workspace validation, scheduled publishing, rollback, permissions, audit logs and recycle bin, and 18.2/17.7 added a shared progress dialog for bulk publish/unpublish/delete/move/copy plus restoring items from the recycle bin without their descendants. These build on v17 Release Sets for batch scheduling and reduce manual governance work. There is still no native broken-link checker (community packages like Skybrud Redirects fill the gap), which caps the score.

v17 added load-balanced backoffice support, removing the single-machine editing bottleneck and improving high-concurrency resilience, while ASP.NET Core Output Caching and NuCache remain the core published-content caching layer with automatic invalidation. Umbraco Cloud is progressing toward managed load balancing, but CDN configuration is still manual for self-hosted. Less effort than before thanks to load balancing, but not yet SaaS-level hands-off.

Umbraco Cloud offers tiered SLA-backed support (chat, email, phone from the $55/mo tier), and G2 rates Quality of Support at ~8.2 with reviewers describing support as responsive and professional (e.g. praised handling of a Forms license issue). Self-hosted relies on community or contracted certified-partner support, and there is no global 24/7 enterprise NOC comparable to Sitecore or AEM. Good mid-tier support, but enterprise-grade coverage is limited.

The Umbraco community remains one of the strongest in the CMS space: an active forum.umbraco.com, real-time Discord/Slack, and continued G2 Leader recognition across CMS, Headless, DXP, and WebOps in the Winter/Spring 2026 Grid reports. G2 reviewers consistently cite community and documentation breadth as differentiators, with healthy contributor engagement across the v13/v17/v18 lines. Some feedback still notes documentation gaps for newer versions.

Supported lines keep receiving fixes and feature minors in parallel: 18.2.0 + 17.7.0 GA (2026-09-17), 18.2.1 + 17.7.1 security patches (2026-10-06), 18.3.0-rc + 17.8.0-rc (2026-10-15), and legacy 13.16.2 (2026-09-14), with every 2026 advisory batch fixed on the LTS and current lines on publication day. Release notes are transparent and link closed issues, and upgrade risks such as the ImageSharp licence check are flagged up front. Non-critical bugs can still linger and community package maintenance varies by maintainer.

Block Grid editor enables component-based landing page composition with live editing mode, but marketers cannot create new layouts without developer involvement — they compose from pre-defined block types. Third-party ByteEditor adds visual page building but is not native. The Library section (shipped in the 18.x line, current 18.1.1) provides reusable Elements — URL-less content-reuse primitives, not a marketer-facing layout builder. The 18.2.0-rc / 17.7.0-rc release candidates (Sep 2026) add no new marketer layout-building tooling. MCP-assisted layout creation is AI-CLI tooling, not marketer self-service. Score remains in the 'can edit but not create layouts' band.

Umbraco Engage (commercial add-on) provides UTM campaign tracking, campaign analytics, marketing automation, email/SMS marketing, and a dedicated Campaigns section in the backoffice. This covers basic campaign lifecycle but lacks content calendaring and multi-channel coordination dashboards found in full DXPs. Engage MCP extensions for campaigns remain on the 2026 roadmap (not shipped as of the 18.1.1/17.6.2 release line) and have not materially expanded campaign management since the prior review.

SEO tooling relies on well-established community packages: SEO Checker for on-page analysis, meta tag management, and redirect management; Skybrud packages for sitemaps, Open Graph, and structured data. Custom Document Type properties handle meta fields. The redirect handling performance improvements introduced in 17.3 carry forward into the current 17.6 line and 18.1. The ecosystem is solid but nothing is built-in — packages must be installed and maintained.

Umbraco Forms (commercial) provides form building with conditional logic for lead capture. Umbraco Engage adds A/B testing, conversion goal tracking, personalization, 360° profiling, and in-CMS analytics — covering most performance marketing needs. Engage's explicit scoring (based on intentions/actions, alongside implicit content-consumption scoring) sharpens conversion-oriented visitor classification. Together, Forms + Engage deliver a functional performance marketing stack. Both are paid add-ons but first-party and well-integrated.

Umbraco Engage provides genuine behavioral personalization: audience segments built from referral source, visit history, geolocation, campaign tags, and persona scores. The 360° profiling engine creates rich profiles for identified and anonymous visitors. Explicit scoring (intentions/actions) supplements implicit content-consumption scoring, moving visitors into journey stages/personas faster and more precisely. Content can be personalized per segment at the node level. Recent headless optimizations improve personalization/tracking across modern frontend frameworks. Block-level and property-level segment variations remain under investigation (not shipped). Requires a paid Engage license and is an add-on, but deep and first-party.

Umbraco Engage includes first-party A/B testing (headline, layout, CTA, single-page, multi-page and split-URL tests) with real-time monitoring, Lift vs Control reporting and multiple simultaneous tests. Engage 18.1 moved variant preview onto the native CMS segment switcher so every test type, including the control, can be previewed, and Engage 18.2 (October 2026) lets editors copy the winning variant straight to the published content from the select-winner dialog and create goals and segments inline. Winner selection is still a manual decision rather than automatic, and the capability requires a paid Engage license, so it stays below the native auto-winner band.

Block Grid with inline editing reduces editing cycle time for existing page types, and the Library/Elements feature (18.x) lets editors reuse URL-less content pieces via the Element Picker. CMS 18.2.0 (September 2026) added a shared progress dialog for bulk publish, unpublish, delete, move and copy, card and table views in the document tree, and collections that remember view, filter and paging, which trims routine bulk work. Mixing shared Elements and local blocks inside the Block Editor is still a roadmap item targeted at Umbraco 19 (Q4 2026), and new layouts still need developer-defined block types. Adequate speed for teams with established templates; slower for net-new layouts.

Umbraco's Content Delivery API enables headless delivery to web, mobile apps, and third-party channels. The 18.x line added opt-in typed OpenAPI schemas per Document/Element/Media Type, improving generated clients and headless integration robustness. The platform is web-first, but structured content models can be consumed via API for other frontends. No native multi-channel orchestration, email template management, or push notification delivery. API delivery to other channels requires frontend development. The headless/hybrid capability exists but multi-channel is not a first-class authoring concern.

Umbraco Engage provides in-CMS analytics for page views, visitor behavior, campaigns, goals, segments and click heatmaps, all inside the backoffice. Engage 18.2 (October 2026) rebuilt the reporting UI: server-side paging and search over full reports, accurate totals, and a comparison mode with deltas against a previous period. GA4/GTM work via standard script injection. This is a real in-CMS content performance view, but it depends on the paid Engage add-on and lacks content decay reporting, so it sits below the 65+ band.

Block Grid's predefined block palette creates some consistency guardrail — editors can only use approved block types. The Library/Elements feature (18.x line) adds centrally managed reusable content pieces with permissions, providing a further consistency lever for shared content. However, there is still no design token system, no enforced style constraints at the platform level, and no brand consistency dashboard. Brand customization is enforced via template design and developer-defined block configurations, not platform-level tooling.

Open Graph and Twitter/X card meta tags are handled via SEO Checker and Skybrud packages, not built into core. No native social scheduling, push-to-social workflows, or social proof widgets. SEO Checker previews social card appearance. Package-based OG management is the ceiling — no first-party social publishing or scheduling capability.

Native media library supports image uploads with built-in focal point and crop definitions via Image Cropper property editor. Basic asset search and folder organization. No rights management, usage tracking, or brand portal capabilities. Third-party DAM integrations (Cloudinary, Azure Blob, Bynder) are available via marketplace packages but require installation and configuration. Below the threshold of a true DAM.

Umbraco has solid built-in multi-language support — content variants per language, Dictionary items for UI strings, language-specific domains. Editor MCP / Umbraco.AI can assist with translation, but there are no transcreation workflows, locale-specific campaign scheduling, or market-level compliance guardrails. Regional cookie consent requires third-party packages. Generic localization infrastructure applied to marketing content, not purpose-built marketing localization tooling.

CRM integrations documented on umbraco.com with webhook/API-based connectors to Salesforce and HubSpot. Umbraco Compose acts as a composable integration hub connecting CMS, CRM, PIM, DAM, and ERP into unified API outputs. Marketplace has various CRM and MAP package integrations at varying maturity levels. No pre-built native connectors to ad platforms or CDP. Better than minimal but not deep pre-built MarTech stack.

Umbraco Commerce supports product content modeling via Document Types and property editors — product variants, attributes, per-variant pricing, and custom metadata. Complex data structures including tiered pricing and cross-sell relationships are possible via editor-friendly schemas. Customer Management with order history and analytics widgets (added in early 2026) augments commercial content insight. Product modeling is flexible but not purpose-built — less structured than dedicated PIMs and requires developer setup to model correctly.

Umbraco Commerce provides category navigation, promotions engine, discount codes, and basic cross-sell via content relationships. Analytics widgets for Top Selling Products, Applied Discounts, Most Popular Discounts, and Stock Forecast (shipped early 2026) give merchandisers better visibility into performance. Still no algorithmic merchandising, search merchandising, or content-driven discovery. Analytics improvements add insight but not merchandising action.

Umbraco Compose is a SaaS composable integration layer designed to connect CMS, PIM, ERP, and external commerce platforms into unified API outputs. Pre-built connectors to Shopify/commercetools remain community-maintained. Extended MCP for Commerce data is on the 2026 roadmap but not yet shipped. The Storefront API enables headless commerce integration. Custom API integration is feasible via .NET but most external commerce platforms require developer effort.

Umbraco CMS + Commerce together can support buying guides and product-adjacent editorial content — editors can create editorial pages that reference Commerce product nodes. However, shoppable content with inline product references and purchase CTAs is not a first-class authoring pattern. Blending rich editorial with commerce data requires developer implementation rather than being an out-of-the-box editorial workflow.

Umbraco Commerce Checkout is a drop-in add-on package providing a themeable checkout flow. CMS-managed content in the checkout (trust badges, upsell banners, shipping callouts) is technically possible — the checkout flow renders via Umbraco templates — but is not a zero-dev capability. Template modification required to inject CMS-controlled content into the transactional flow. Score reflects the gap between capability and marketer self-service.

Post-purchase experience (order confirmation, delivery tracking pages, onboarding sequences) lives largely within Commerce templates. Commerce 18.1 (August 2026) added customer records with addresses and communication history plus editing of finalized orders, and the docs include a Members Portal build guide for order history. The abandoned cart pipeline now raises a CartAbandonedNotification that developers can hook. These are developer primitives rather than CMS-managed post-purchase content tied to order events.

Umbraco Commerce supports B2B scenarios with customizable customer-specific pricing (price lists by customer group), member-gated catalogs, approval workflows, and ERP integrations. Personalized logins via Members enable per-customer product/pricing visibility, quick order, reorder, and saved shopping lists. Features require implementation but Commerce provides the primitives. Less out-of-the-box than dedicated B2B platforms but genuinely capable with development.

Examine search (Lucene-based) provides full-text search across CMS content including Commerce products. No native faceted search for commerce discovery, no synonym management, no search merchandising, and no blended content-product search results without custom development. Search landing pages and faceted filtering require developer implementation. The search foundation is solid but commerce-specific search enrichment is not addressed out-of-the-box.

Umbraco Commerce's promotions engine handles discounts with time-based activation (start/end dates). Scheduled publish/unpublish in the CMS enables time-based promotional content (banners, sale pages). Multiple discount types (fixed, percentage, free shipping, buy-X-get-Y) are supported. No native countdown timer widgets, promo code messaging components, or channel-specific targeting of promotional content. Basic scheduled banners with Commerce discount rules.

Umbraco Commerce's Storefront API (introduced 12.1) enables a true headless multi-storefront architecture with separate frontends per region/brand consuming a shared Umbraco CMS backend. Multi-currency, multi-tax, and multi-language are built-in. However, storefront-specific editorial content (legal pages, regional landing pages) requires some content duplication within the CMS tree rather than a governed shared/override model. Capable with some duplication.

Umbraco's media library handles standard product images with focal point cropping. Video embeds are possible via property editors (YouTube/Vimeo embed or video file uploads). No native 360-degree product views, AR/3D model support, or image hotspot tooling. Advanced visual commerce capabilities (zoom, hotspot, 3D) require custom frontend implementation or third-party integration — not addressed by Commerce or core CMS out-of-the-box.

Umbraco Commerce and CMS have no marketplace-specific features — no seller profiles, seller-contributed product descriptions, content moderation at scale, or review aggregation. Multi-author backoffice access could technically support some seller content submission workflows, but this is generic CMS multi-author capability, not marketplace tooling. Building a marketplace on Umbraco would require extensive custom development.

Umbraco CMS has built-in multi-language support (content variants per language, Dictionary items) and Commerce supports multi-currency and multi-tax out-of-the-box. Locale-specific product descriptions via language variants are possible. Currency-aware content blocks require custom implementation. No native regulatory content management (EU labels, Prop 65) or market-specific promo calendar tooling. Generic multi-language + Commerce multi-currency applied to product content.

Umbraco Engage tracks content engagement and goal conversions, while Umbraco Commerce ships analytics widgets (Top Selling Products, Applied Discounts, Stock Forecast) and a cart conversion report with Reached Checkout and Purchased totals. Commerce 18.1 added customer records with order statistics. Direct content-to-revenue attribution, tying an editorial page to a downstream purchase, still needs custom work bridging Engage events and Commerce orders. Analytics remain split between the two add-ons.

Content-node-level permissions for backoffice users (deny/allow on specific nodes and subtrees by user group). Member groups control frontend content gating for intranet/portal scenarios. User group permissions cover document type, media, and section access. The Library feature (18.x line) adds permission and start-node scoping for reusable Elements, extending granular access control to shared content. Functional for most intranet and B2B portal implementations. Less granular than Drupal's node access grant system but sufficient for department-level content isolation with SSO-backed member authentication.

Hierarchical content tree maps well to knowledge base structures. Tags and categories via property editors enable classification. Examine search provides full-text search for knowledge bases. The Library feature (18.x line) gives reusable knowledge snippets a managed home with rollback, scheduled publishing, audit logs, and recycle bin. Umbraco Workflow (commercial) adds approval workflows for content updates. No native content lifecycle management (review dates, expiry, archival). Adequate for organizational knowledge bases but requires architectural design work to assemble from primitives.

Umbraco can serve as an intranet CMS with member groups for authenticated access, content tree for navigation, and Forms for employee interactions. Uintra (open-source framework) provides a news/events feed, groups, and activity streams on top of Umbraco — reducing custom dev burden significantly. No native news feed, employee directory, notifications, or social features in core. Substantial custom development still needed beyond Uintra to match SharePoint or dedicated intranet platforms.

Umbraco supports publishing news and announcements to authenticated member groups — providing basic audience-segmented internal comms. Scheduled publish/unpublish for timed announcements. No read receipts, acknowledgment tracking, mandatory-read workflows, or targeted comms dashboards. Uintra extends this with a collective activity feed, but still lacks acknowledgment and mandatory-read capabilities critical for compliance-driven internal comms.

No native people directory or org chart tooling in Umbraco core or official add-ons. An employee directory can be built using Member types (custom Document Types for people profiles) with Examine search, but this is a ground-up custom build rather than a platform feature. Org chart visualization requires additional frontend development. HR system integration (Workday, BambooHR) requires custom API connectors. Score reflects the absence of platform-provided tooling.

Umbraco has built-in content versioning and rollback. Umbraco Workflow (commercial) adds multi-stage approval workflows suitable for policy update reviews. Scheduled publish/unpublish handles planned policy activations. No native mandatory acknowledgment tracking, automated review date reminders, or SOP expiry workflows. Basic document publishing with version control and optional commercial approval tooling — functional but short of a compliance-grade policy management system.

No native onboarding journey tooling in Umbraco. Structured onboarding pages can be built as content types with member-gated access and role-based content trees. Progressive disclosure (30/60/90 day content release) would require custom scheduled content logic. Umbraco Engage segments could be used for role-specific content personalization in an onboarding context. This is an assembly-from-primitives scenario, not a platform feature.

Examine search (Lucene-based) provides full-text internal search across CMS content with custom index definitions for faceting. Library content (18.x line) is integrated into global search. Uintra adds Elastic Search for intranet scenarios. No federated search across SharePoint, Confluence, or Google Drive. No AI-powered relevance ranking. Search quality for internal content volumes is adequate for CMS-scoped content but cannot index connected external systems without custom integration work.

No native Umbraco mobile app. Intranet frontends built on Umbraco can be made responsive and PWA-enabled, providing web-based mobile access. The Umbraco backoffice itself has responsive improvements in recent versions. No native push notifications, offline support, or kiosk/shared-device modes. Deskless/frontline worker access relies on a developer-built responsive web frontend — adequate for basic access but not a native mobile experience.

No native LMS integration or learning management features in Umbraco. Training content (courses, modules, quizzes) can be hosted as CMS content, but completion tracking, certification, and course assignment require a dedicated LMS. No documented Cornerstone, Workday Learning, or SCORM integration in the marketplace. Learning content hosting is the only realistic use case — external LMS required for everything else.

No native social or collaboration layer in Umbraco core. Uintra provides an activity feed, news feed, events, and group spaces on top of Umbraco — giving a modest social layer for intranet deployments. Comments, reactions, polls, and peer recognition all require Uintra or custom development. Uintra covers the basics but is an open-source third-party framework requiring separate adoption and maintenance.

No native Microsoft 365/Teams, Google Workspace, or Slack integration in Umbraco core or official add-ons. Webhook-based integrations are technically feasible and some community packages exist for notification pushing. Embedded content cards, bot-driven notifications, and single-pane experiences would require custom development. The platform is not positioned for workplace tool integration and the marketplace reflects this.

Scheduled publish/unpublish in core handles basic content expiry. The Library feature (18.x line) adds a recycle bin and rollback for reusable Elements, but not automated review dates or stale-content flagging. No automated review date reminders, stale content flagging, ownership assignment, or archival workflows for pages. Umbraco Workflow (commercial) adds approval steps but not lifecycle management for existing content. Content freshness for intranet trust requires manual editor discipline or custom automation. A notable gap for intranet use cases.

No native internal content analytics or engagement dashboards in core. Umbraco Engage provides visitor analytics but is primarily a marketing personalization tool rather than an intranet adoption measurement tool. Department-level analytics, failed search terms, and adoption dashboards are not addressed by any first-party tooling. External analytics (GA4) can provide basic page views. Score reflects the absence of purpose-built intranet analytics.

Multi-site via domain and hostname configuration provides logical tenant isolation within a single installation — separate content trees, templates, and user group permissions per site. True database-level isolation requires separate Umbraco installations. No native multi-tenant admin dashboard. Community confirms multi-tenancy works in Umbraco 15/17/18 but many plugins don't support it. Logical isolation is solid; physical isolation requires separate instances.

Shared partial views, Element Types, and the shared media library enable component sharing across brand sites within a single installation. The Library section (18.x line) provides a dedicated, centrally governed home for reusable Elements — with reference tracking, permissions, rollback, and scheduled publishing — consumed across content via the Element Picker. This strengthens central maintenance of shared content within one installation, though it remains intra-installation (not cross-tenant) and lacks a governed design-token override mechanism. The 'update once, change everywhere' block reuse (convert-block-to-element, mix-and-match) is targeted for Umbraco 19 and confirmed not present in the 18.2-rc.

User group permissions provide central admin with per-site editorial access control. Umbraco Workflow (commercial) enables multi-stage approval workflows per Document Type. The Library feature (18.x line) adds permission- and start-node-scoped governance over reusable Elements. MCP Server (Umbraco 17+) keeps permissions and governance at center for AI-assisted workflows. No out-of-box governance dashboard for multi-brand management. Cross-site approval hierarchies require custom development.

Core CMS remains MIT-licensed — zero per-brand software cost increment for a single installation hosting multiple brand sites. Commercial add-ons (Commerce, Engage, Forms, Workflow) are priced per installation, not per site, maintaining economics as brand count grows within a single instance. The model becomes less favorable if separate installations are needed for true tenant isolation, as add-on costs multiply. Still competitive vs. per-brand licensed CMS platforms.

In a multi-site Umbraco installation, each brand site has its own templates, stylesheets, and asset folders. This provides CSS-level brand isolation but not platform-level design token management or theme inheritance. Brand customization requires developer-maintained CSS and template sets per brand. No token override system, no design system versioning, and no central-to-brand theme propagation mechanism.

Umbraco multi-language support provides per-brand locale configuration. Translation workflows are not natively governed per brand — a shared translation workflow applies across the installation. There are no brand-specific translation approval chains, no regional legal content governance guardrails, and no system for managing market-specific compliance content per brand. Generic localization infrastructure without brand-locale governance distinction.

No portfolio analytics dashboard across brand sites in Umbraco or any first-party add-on. Umbraco Engage provides per-site analytics within the backoffice for each site, but there is no aggregate view across multiple brand sites. Cross-brand performance comparison requires manual aggregation from per-site analytics or external tools (GA4 with multi-property reporting). Executive-level portfolio reporting is not addressed.

Umbraco Workflow (commercial) supports per-Document-Type approval chains that can be configured independently per content area and thus per brand site. Approval stages, reviewers, and notification recipients can be set per content type/group. However, workflows are configured per Document Type rather than natively per brand, and there is no central audit view across all brand workflows. With careful configuration, brand-specific workflows are achievable but not natively first-class.

No native corporate-to-brand content syndication with controlled override points. The Library feature (18.x line) enables reusable Elements with reference tracking within a single installation — a step toward shared content — but cross-brand syndication with local adaptation and override control is not delivered (mix-and-match/customize-per-page is targeted for Umbraco 19). The 17.x+ Content Delivery API enables API-level content consumption across brands. Press-release push with local adaptation still requires custom development.

No per-brand/region compliance guardrails in Umbraco. Cookie consent is handled via third-party packages (Cookiebot marketplace integration). Accessibility compliance is the developer's responsibility. GDPR data handling is addressed at infrastructure/hosting level, not CMS publishing guardrails. Data residency is an Umbraco Cloud hosting consideration, not per-brand CMS enforcement. There are no CMS-level guardrails preventing non-compliant publishing per brand.

Shared partial views and Element Types enable centrally maintained component sharing across brand sites. The Library feature (18.x line) adds a dedicated management home for reusable Elements with permissions, rollback, reference tracking, and audit logs — a genuine step toward centralized component management, though it manages reusable content instances rather than a versioned design system with tokens. No design-token management, version propagation, or brand-level extension governance. Design system management remains largely a developer-practice discipline.

A single Umbraco installation provides a central backoffice where a super-admin can manage all brand sites. User groups can be scoped to specific sites/content sections, enabling autonomous brand editorial teams with their own permissions. SSO integration for single sign-on across brand teams is supported. No dedicated cross-brand user management dashboard or cross-brand contributor role with controlled access across multiple brands. Functional centralization without dedicated tooling.

Shared Document Types across multi-site provide a common base model that all brand sites use. Brand-specific extensions (adding fields per brand) can be achieved via composition and Element Types, but this typically results in separate Document Type variants per brand rather than a truly shared base with clean per-brand extension. Forking the base model per brand is the common pattern, which limits maintainability at scale.

No executive portfolio reporting across the brand portfolio in Umbraco or any first-party add-on. No content freshness tracking by brand, publishing SLA reporting, cost allocation per tenant, or capacity planning dashboards. Umbraco Engage provides per-site analytics but no portfolio aggregation. Portfolio reporting requires external business intelligence tooling (GA4, Power BI, Looker) connected to per-brand data exports. This is a notable gap for multi-brand platform management.

Umbraco is headquartered in Odense, Denmark, offers a downloadable DPA with SCCs to all customers (refreshed September 2026), defaults Umbraco Cloud to EU hosting with a second EU region in Sweden, and publishes a full sub-processor table (Azure, Cloudflare, Twilio SendGrid, GitHub, Intercom and others) with data-center locations, legal grounds and a change-notification subscription. Transfers rest on SCCs plus the EU-US Data Privacy Framework, with TIAs on non-EEA processors. Not higher because right-to-erasure is handled by emailing support rather than through self-service tooling.

No HIPAA BAA is offered and no healthcare-specific guidance is published; the compliance FAQ states Umbraco acts as a data processor and that HIPAA compliance remains the customer's responsibility as data controller. Self-hosted Umbraco on HIPAA-eligible infrastructure is feasible, but the vendor provides no BAA, so the score stays in the no-coverage band.

EU GDPR via the Danish HQ is backed by ISO 27001, and Umbraco Cloud regions in the UK, Canada and Australia support UK GDPR, PIPEDA and Australian Privacy Act residency needs. The compliance FAQ now only says Danish NIS2 compliance 'is required' and that CRA requirements 'are being addressed', and treats DORA case by case, which is weaker than the earlier claim of having already complied. No FedRAMP, IRAP, C5, PCI-DSS or explicit CCPA documentation.

Umbraco does NOT hold SOC 2 certification. The compliance FAQ explicitly states Umbraco A/S has no active focus on obtaining SOC certification and instead relies on Microsoft Azure's SOC reports. Per anti-pattern rules, cloud provider certifications cannot be inherited by the platform, so no SOC 2 Type 1 or Type 2 attestation exists for Umbraco itself.

Umbraco holds ISO/IEC 27001:2022 (announced January 2026) scoped to its product organisation that develops, maintains and operates its products, so the ISMS covers Cloud operations rather than just infrastructure; the certificate is downloadable from the trust center and listed on IAF CertSearch. Not higher because there is no ISO 27018 certification for cloud PII processing.

No additional third-party certifications beyond ISO 27001 (scored under 9.2.2). No CSA STAR Level 2, PCI-DSS, Cyber Essentials Plus, FedRAMP, or IRAP. NIS2 and EU Cyber Resilience Act compliance are self-asserted regulatory alignments (credited under 9.1.3), not independent certifications. Base score for no additional certifications per rubric.

Umbraco Cloud now offers six Azure hosting locations: West Europe (Netherlands), Sweden, US East (Virginia), UK South (London), Australia and Canada, chosen per project and backed by the DPA. The added Sweden region gives EU buyers a second in-bloc option. Self-hosted deployments give full residency control; not higher because Cloudflare caches public traffic globally, so cached content can leave the chosen region.

Content version cleanup with configurable retention (default 90 days for daily snapshots, 4 days for all versions) and per-form Forms data retention with automated deletion. Content Delivery API provides JSON export. Not higher because there is no documented post-termination retention period and right-to-erasure requires manual handling rather than a self-service portal.

Umbraco has a native Audit Trail tracking content changes and user actions, persistent for content operations. Infrastructure logs default to 24-hour retention. Not higher because there is no native SIEM integration — SIEM forwarding requires a self-hosted Azure deployment with custom log export.

Umbraco states the backoffice meets WCAG 2.2 Level AA and ATAG 2.0 criteria, with an external accessibility consultant and community Accessibility Team auditing editor-facing workflows and shipping fixes in v17/17.1. Not higher because some system-level improvements (keyboard movement, text spacing) remain in progress for 2026.

Umbraco maintains a continuously updated Accessibility Conformance Report (ACR) tracking backoffice accessibility status, serving a role comparable to a VPAT for procurement, with the community accessibility team resolving issues publicly. Not higher because there is no formal Section 508 conformance statement and some system-level accessibility work remains in progress.

Umbraco.AI.Prompt (GA) delivers content-type-scoped generation, rewriting and summarization with central brand-voice governance, and since Prompt 18.1 (July 2026) the AI wand works on every property editor through value schemas; the GA Copilot handles blocks and complex structures, and the new Copilot Workspace (18.0 GA, October 2026) adds a full-section chat with persisted conversations and project instructions. Prompt 18.3 adds a configurable AI-generated disclosure notice on responses. Not higher because bulk multi-item generation and long-form authoring workflows remain lighter than the generation leaders.

Alt-text generation is GA via Umbraco.AI.Prompt, and Umbraco.AI 18.1 (July 2026) added an Image Generation capability (text-to-image and maskless editing via OpenAI gpt-image-1/DALL-E, usage recorded in the audit log), but it is explicitly experimental: off by default behind the Umbraco:AI:Experimental:ImageGeneration flag, developer-API and Management API only, with OpenAI as the sole provider. Copilot and Automate's Run AI Agent action can now describe images passed as media attachments. Small rise for shipped-but-experimental generation; no editor-facing generation in the media library or AI video processing yet.

Umbraco.AI.Prompt generates per-field draft translations natively, and Umbraco Automate's AI add-on (GA July 2026) lets an event-triggered workflow run an agent to generate translations as draft content without a human present, with the docs naming translation as a use case; the CMS Editor MCP adds language-variant creation and translation-coverage tracking for AI assistants. Marketplace options remain (Jumoo Translation Manager OpenAI connector, AI Essentials Toolkit). Still no native MT engine, glossary-aware bulk translation or translation quality scoring in the product.

Umbraco.AI.Prompt (GA) natively generates SEO titles, meta descriptions, alt text, content summaries and taxonomy tags as one-click, full-context field actions, and Copilot can apply these conversationally. Still missing is a built-in on-page SEO scoring/optimization dashboard woven into the editorial workflow — that requires third-party packages like SeoToolkit.Umbraco. Solid partial automation, capped below the on-page-scoring threshold.

Umbraco Automate (visual event-driven workflow canvas, v18 GA July 2026) with the Umbraco.AI.Automate add-on lets content, media and member events trigger a Run AI Agent step (summarising, translating, scoring, describing attached media) whose structured output binds into later steps, and since 18.0.1 (October 2026) agents may create or edit drafts unattended while publish and delete stay denied. Copilot handles per-item clean-up and Prompt handles tagging and metadata enrichment. Moves into the woven-in automation band; smart scheduling, duplicate detection and lifecycle automation are still not shipped as built-ins.

Agentic capability is now GA end to end: Umbraco.AI.Agent (Microsoft Agent Framework, AG-UI streaming) powers the Copilot and the new Copilot Workspace with persisted projects, Automate can run agents unattended inside event-driven multi-step pipelines with read-only or draft-only tool permissions, and agents can start automations as tools through the AI Agent Request trigger. Human-in-the-loop approvals now interrupt editors only for actions they cannot undo. Into the solid-GA band; not higher because there are no named prebuilt content agents or an agent marketplace comparable to the leaders.

The CMS Editor MCP exposes content health and reporting tools (SEO issues, stale or thin content, missing translations, orphan pages, site-structure reports) to any AI assistant, and Agent Copilot for Engage lets marketers query Engage analytics conversationally. Both put insight behind an AI chat rather than a built-in content intelligence dashboard, and there is no topic clustering, gap analysis or editorial-priority recommendation in the backoffice. Small rise for the MCP reporting tools.

AI Tests and Evaluations (graders, model regression and comparison) target prompt and agent quality, not content, while content auditing now reaches AI through the CMS Editor MCP's audit tools for SEO issues and stale or thin content and through Copilot's per-item analysis; Automate can also run an agent against content on each publish event. There is still no built-in brand-voice compliance or accessibility scanning across hundreds of pages. Slight rise, still below single-dimension AI auditing.

Umbraco.AI.Search is now a stable first-party semantic vector search add-on (1.0.0 June 2026, 18.0.0 July 2026 on the released Umbraco.Cms.Search 18.x, which is also out of beta): it indexes published content and media as culture-aware embeddings, filters results by the user's start-node permissions, and exposes similarity search through the CMS Search API and a semantic_search agent tool, and Umbraco.AI 18.2 added embeddable knowledge sets for RAG. It is a free opt-in package rather than the default search, with no hybrid keyword plus vector ranking documented, so it sits just under the production-native band.

Umbraco Engage provides rules-based personalization with explicit scoring, personas, journeys and A/B testing, and the Engage MCP / Agent Copilot for Engage lets AI explore and configure this via conversation — but runtime personalization uses manually defined rules and explicit signals, not ML predictions. No predictive segment assignment, next-best-content recommendations or cold-start handling exists. Rule-based with an AI configuration/insights layer, so low band.

Umbraco now ships four official MCP servers on one Base MCP SDK: the CMS Developer MCP (GA, npm @umbraco-cms/mcp-dev 18.1.9 updated October 2026, Management API tools with read, write and publish), the CMS Editor MCP for editors (content, media, translations, bulk operations behind confirmation), and new Automate and Forms Developer MCPs that chain to the CMS server. Hosted MCP runs on shared infrastructure at mcp.umbraco.ai with per-user OAuth so tools follow backoffice permissions, and setup guides cover Claude, ChatGPT, Cursor and GitHub Copilot. Held below the top band because the Umbraco.Mcp.HostedAuth package that enables hosted MCP is still prerelease-only.

Umbraco.AI is built on Microsoft.Extensions.AI with official provider packages that grew again in September 2026 to include Alibaba, OpenRouter, Moonshot and Z.AI alongside OpenAI, Anthropic, Amazon Bedrock, Google Gemini, Microsoft Foundry, Mistral, DeepSeek, Hugging Face, Fireworks AI and Together AI. Customers bring their own keys and pay providers directly with no Umbraco markup, can hold multiple connections and profiles per capability, and switch models by configuration; OpenRouter alone opens hundreds of models. Best-in-class provider flexibility.

Developers get the Management API as MCP tools on a shared Base MCP SDK with MCP chaining and tool filtering, JSON Schema and document patch endpoints for deterministic AI edits, Agent Skills, a semantic_search agent tool, embeddable knowledge sets (18.2) and new tool executing and executed notifications (18.5) for hooking into agent runs; Automate lets agents be invoked from and invoke workflows. Still no official LangChain, LlamaIndex or CrewAI guides and no dedicated RAG content-delivery endpoint, so it stays in the strong-but-not-top band.

Governance is Umbraco.AI's core theme: guardrails inspect prompts and responses with block or redact actions (streaming redaction fixed in 18.3.5/18.4), blocked calls get their own audit status, profiles, contexts and guardrails are versioned and deployable, MCP and agent tools follow backoffice permissions, editors are interrupted for approval only on irreversible actions, and Automate agents default to read-only. Prompt 18.3 (October 2026) adds a configurable AI-generated disclosure notice. Missing hallucination or confidence scoring and IP indemnification, so it sits in the good-governance band.

The AI section's Usage dashboard reports total requests, input, output and total tokens, success rate and average duration over 24 hours, 7 or 30 days, with breakdowns by provider, model, profile and user, plus an Analytics API for custom dashboards; every call, including failed, token-less and image-generation operations, lands in a full audit log, and Tests and Evaluations track prompt quality. There is no cost in currency, budget or quota enforcement, or quality-trend monitoring, so it stays in the basic-tracking band, at its upper end.