Drupal is now light-years ahead of its reputation
dri.es
dri.es
If you want to know everything you need to know about Drupal, have a peek at the community discussion around sitemaps. There are genuine reasons behind the complexity, but a CMS that cannot generate a list of its own URLs, leaving thousands of people baffled, is quite an achievement.
I'd rather point the agent at and authentication gem and tell it to use that, vs telling it "build authentication, make no mistakes".
i.e. why read a book written by a human when an agent can write one? Why buy a painting that could have been printed.
One of the benefits of open-source and frameworks is they're made up of battle-tested decisions by a lot of people with real skin in the game for a long time. Yes an agent will often solve your problem, and will solve it correctly - as asked, but often a better answer is found by stepping back, evaluating the fundamentals, checking other perspectives, challenging assumptions, and having an opinion.
Easier in terms of effort and time, but it still costs, and it still adds drag.
The fact that I can do housekeeping much more easily with agents doesn’t make me want to do more of it. The whole point is to free up my time, energy, and thinking for things that are more worthwhile, interesting, and value-adding. That’s my mentality both at home and at work.
If you’re building a framework or a library, whether open source or commercial, and you think agentic and AI native development gives you more license for breaking changes and churn because your users can just fix it up with their agents, then I’m afraid I’ve got some bad news for you because that blade cuts on both sides.
If you can keep churning and breaking stuff, then I can get fed up, drop your shit like a hot rock, and build it myself. And I will.
I’ve just rebuilt my personal site from scratch after getting cheesed off with the framework I used and it didn’t take very long. What’s actually taken longer is making all the improvements I would have liked to make but were too much hassle before, so one needs to relearn shipping discipline, but that’s OK.
Same goes at work. Even major stack changes, like migrating database engine, are so much easier. Yes, you still need to be methodical and disciplined - in fact I’d argue agents make that more important than ever in many enterprise contexts - but it is still so much easier. I’m seeing projects left and right that in the old world would have taken weeks or months executed in days or weeks. It’s wild times.
Drupal has been absolute mess for maintenance, backwards compatibility, responsive ness (code/dev wise).
People started flocking more to WP and Drupal docs weren't just up to date as people were moving away.
Nothing will change my mine over Drupal at this point still especiallyin this day and age. Better create one yourself or mod WP.
---
Whatever the post says about it's "light-years ahead" sounds like a tiktok influencer talk.
I completely understand how people got burnt. The move forward was less about bringing users, site builders, and developers along for the journey and more about providing what enterprise needs.
And one of the enterprises that was front and center was Acquia, Dries' organisation that he set up to offer consultancy services based on Drupal.
Having said all that, it is genuinely a very good product now, and one that LLMs are incredibly good at building with.
The high level of documentation, convention over configuration, and the API-driven nature of Drupal lend themselves very well to LLM assistance.
Considering just how awful WordPress is in terms of security, community, cohesion, code quality and maintainability. I think it's a crying shame that Drupal has lost so much goodwill.
I'm not sure what the solution is, but I'd recommend anyone reading gives it a try with Codex or Claude code, and you'll hopefully see what I mean.
Saying that Drupal is better than it has ever been is not much of a statement. It still isnt as easily extensible due to having a smaller community of contributors as an after effect of mismanagement.
I hope they have improved, but their reputation has been earned repeatedly.
Drupal needs to market how well it can people make $ or at least save. ROI is a good KPI to bring up, if the team has data to back it up, etc.
But he never mentioned PHP again which was just fine with me.
In trust situations we have a sort of unspoken concept of Original Sin. Essentially once someone has made a security blunder of epic proportions, we can not trust that this is an isolated incident instead of a pervasive one. If The Rot Starts at the Head is true, then how can any amount of rework ever make you trust the thing again?
I looked at the security patch that Drupal applied, and I’m no PHP reader but I was sure I found the same antipattern in two other places in the code that were not patched. I only looked for an hour. There have been years and years of low effort CERT advisories since. From a user standpoint, if you’re not deep into Sunk Cost, this looks like throwing good money after bad. Only rationalization ever makes it seem like a good deal.
It's a situation entirely inline with Drupal's reputation: they couldn't just get it right, and now serious Drupal teams don't know which way to go in the ecosystem.
Drupal CMS is what a lot of people suggest for new folks, but it isn't explained what it is on the Drupal website. It's apparently a set of pre-configured extensions, templates, AI, and settings. Drupal has a version on their site to download but it says it's a "trial" and requires registration to get it, further increasing friction: https://new.drupal.org/drupal-cms/trial#:~:text=start%20your...
Once you do get it, it may or may not work. When I last tried the Windows version, it didn't work and just gave the old Drupal white screen of death in the browser.
When I've seen discussions in the Drupal sub-reddit, most of the recommendations on how to do something seem to be some version of 'have Claude do it for you'. And the Drupal homepage is very AI forward and mentions AI 9 times.
Drupal's largest install base was back in the Drupal 7 days, which was the last major version that supported upgrading in place from the previous versions. Major compatibility changes started with 8 and continued. About 1/2 the sites that used to run Drupal 7 migrated to WordPress rather than upgrade. Today, there are about the same number of sites running Drupal 7 as the current Drupal 11, which speaks volumes.
As someone that still uses a paid, extended-support version of Drupal 7 and is likely switching my big legacy site to Backdrop CMS (actively maintained Drupal 7 fork) and my other two sites to another CMS, it doesn't seem like there's a place for folks like me in the current world of Drupal.
This isn't correct. Yes it was true from Drupal 7 to 8, but one of the primary goals of that change was so that every major version after could have seamless in-place upgrades - which they have. Yes there's deprecated code etc. that you might run into in contrib. or custom modules, but the site upgrades themselves are easier than ever.
From all my reading in the Drupal subreddit, modern Drupal isn't especially useful for real world scenarios without a bunch of contributed modules and stuff... hence Drupal CMS. Additionally, folks were recommending not using Drupal 11 until it had been out for well more than a year due to the sad state of contributed module upgrades. I'd wager this is due to the much smaller Drupal community than the version 7 highs.
I get needing to have command line skills for a web framework upgrade (doesn't seem like an unreasonable expectation to me), but why on earth would an upgrade require writing your own code?
Drupal 7 was useful enough on its own and with regularly supported modules that most folks who used it never wrote code. Most smaller folks who used it just dropped the files on a shared web host via FTP or similar and ran with it.
Modern Drupal is more geared towards coders rather than smaller folks. And the modules suffer from slower updates with the smaller community around Drupal than there used to be. So you'll likely have to use your own custom coded modules or have to code the updates for the existing ones when you upgrade Drupal over time.
The Drupal core team is moving really fast to improve its reputation, and I think a lot of the changes are good. The AI integration is pretty solid, and the Symfony framework is solid and easy to build on. I think the move to Canvas is misguided and from inside the community I can tell you that not everyone is on board, but it is nice that both paths are possible.
As many here have said: If you have large teams that manage large amounts of content, Drupal is really the only option. If you're making one-off sites or "brochure sites," then vibe-coding them is just as good as anything, but I don't think that's ever been Drupal's core concern.
"I need to market XYZ can you please take these assets and write a compelling one pager landing page"
"Now can you add signups? Then keep adding to a Google sheet whenever someone new signs up.."
"Can you make an admin page for me - so I can easily send out updates to the people in my list, I use
ABC service for my marketing emails"
That is one afternoon's worth of work vs. hiring a contractor, designer, multiple rounds of iterations over weeks, and having multiple points of delays and failurs. There is no match.
Also, what an amazing day to pick to talk about anything PHP.
This probably changed somewhere down the line, but I genuinely believe the most significant factor in Wordpress becoming the dominant CMS is that, in the beginning, for a long time, it wasn't trying to be a CMS, just a blog engine.
Ok. As someone who hasn't shipped a Drupal site since halfway through the D8 cycle: is this better or worse than the tumor that is Gutenberg?
I think CMSes and websites are where that is most applicable. You no longer need these generalized abstractions and can now make your interfaces and data types just perfectly match your use case with little effort.
We went through great pains to build these mammoth, one-size fits all applications like Drupal and Wordpress for running dynamic sites across industries and companies with very little in common.
These days, I love to stay close to the model and stay close to the metal.
That seems more like an implementation opinion vs. a core property.
Agree that it was a pain to keep up with sometimes, but if software doesn't evolve over a 25 year timespan - it's likely going to be stuck in the past.
The reason Drupal can do what it does today is because of this willingness to rebuild - otherwise it'd just be a CMS that solves problems from the early 2000s.
The churn stopped after D8 - upgrades from D8 -> D9 -> D10 have all been painless with no major overhauls to the API. The template system, the granular caching infrastructure, namespacing, package management, Symfony core, are good.
It's a solid framework to build on without having to reinvent the CMS wheel.
Remember a while back when the world first heard about Mythos because there was a mismatch between what the "CMS" said was publish, what was shown on the site, and what was "really" available? Those types of problems haven't gone away and if anything are more critical when an army of agents will seek out and find any but of information they can get their hands on.
Why Drupal rather than another of the many CMS's and frameworks that exist?
I'd recommend Drupal specifically when you have the need for strong governed management of users + content + workflow and you want something that is battle tested without having to make all the decisions that get you there.
There's an old issue in the Drupal queues that I really like that exemplifies this: https://www.drupal.org/project/drupal/issues/174940
This one goes back 19+ years and has to do with 404s when a visitor looks for favicon but doesn't fully follow the standard of where that file could be. It happened with ie6 back then, and happens with some agents and services today. The easy fix is to put a favicon in the root, but that's a bandaid that runs into a bunch of edge case issues when creating a platform or doing something non-standard. Suppressing the error message is another option, but there's a performance and delivery cost into how that's done. If you ask a frontier model today how to fix this on your site, you'll likely get the easy "simple" answer.
Long way of saying, Drupal is an accumulation of battle tested decisions from a bunch of smart people over a long period of time - and if your need matches the usual intent of Drupal - users + content + delivery + rules around that - then that's a strong reason to explore it for your use case.
Until you define the project, you can't talk about what stack to use.
Other than that, familiarity is really the best selling point.
It feels dated. Even the "new" designs they're rolling out still feel old. They're working with a dated design system, and honestly, it feels like they had developers build it without bringing actual designers into the process. The result is always functional, but somehow a little awkward. Not unified. There's still like 3-4 different ways to do the same sorts of actions depending on where you are. It's clumsy. It's Drupal!
And true to its roots, Drupal still requires way too many third-party modules to get a build working the way I want. Half of those don't even have the "new" design system applied. So even for a CMS that cares about WCAG, they're still falling short. I'm not sure they'll ever get all the open-source developers on the same page. (I know they have a stated goal of 2027... I don't see it happening.)
More broadly, I don't have much confidence that Drupal modules will be maintained beyond a version or two. That makes anything you build on top of them inherently disposable. Which is fine; a lot of the web is disposable. But it also means I don't want to take ownership of long-term maintenance for projects built on Drupal.
Every time I have to install a third-party module in Drupal, I cringe a little. I know that two or three years down the road, when a new major version comes out, I'll be hunting down the guy who wrote the module, hoping he'll update it. Otherwise, we're forking his repo and taking responsibility for maintaining it and applying security patches ourselves. Cringe.
Meanwhile, I've really enjoyed working with Contentful, Directus, and even Statamic. There are a lot of great CMS options out there these days.
One platform I'd actively warn people away from, though, is Strapi. I've had two false starts with projects where people wanted to use it, only to run into some fundamental flaws.
Like, "Oh, you want to associate one of your 10,000 files with this page? Sure, we'll put them all in a dropdown for you to sift through... and that'll make pages take 2 minutes to load." Cringe. Run. (Ha, wait... and the whole, "We are in France, so we don't answer support emails in August." Literally what their support email told me. Yikes.)
In the last five years, Strapi is the only CMS I've built with that I just couldn't get behind on any level. I would have rather used Drupal for those projects. Ha!
We've been hearing this for years. On the Drupal site, it says it's a trial and makes you register to download it. Last time I downloaded the Windows package, it gave a Drupal white screen of death. I'm not planning on registering again to try it again. Nor do I want to use AI to install and manage my CMS.
AI-AI-AI-AI...The big question was avoided: What is the relevance of Drupal in the AI era?
Most people who want to publish content in a nice looking way can now do that using just a prompt and using natural language. Content management, or managing the things online in a decent way is still an unsolved problem, since this is not a technical thing, but mostly sht work for content managers that nobody want to do. It is a matter of time till OpenAI or some other AI company can do what a CMS application can do, but than without the pain and complexity for users. I see no answer from this keynote in anyway!
This current strategy of Drupal has high risks in terms of maintainability, stability, security and privacy when leaning so heavy on AI-things that are still changing every 3 months.
It's time to abandon PHP and C-based software (i.e. PHP). The clock's ticking.
Meanwhile, there are different threat models to any type of web application, it's just that PHP has repeatedly failed us in any threat model, same as C in most threat models that don't involve compiling it to WASM or running it air-gapped.
Leaving memory unsafe runtimes and interpreters directly available to public web traffic is a liability I don't want for me and users don't deserve to face the consequences of it whenever they are trusting you with their data. Rust and Golang even with all of their design issues should be the baseline for internet facing software nowadays.
As for the Linux kernel, everything I run on it is inside a VM (or a microVM) instead of relying on containers exclusively, because I can't trust a C kernel to not have vulnerabilities.
Funnily enough, regarding SoftTalker's point, just a few hours after my original comment, CVE-2026-110264 (a CVSS 10.0... worse than PHP's RCE) rolled in for GitLab, which would be prevented by using a memory safe language to write the interpreter instead of C.
It succeeded to do what Drupal tried but never managed to do:
It is both extremely stable and extremely flexible at the same time.
By having an extremely generic and small core, combined with an extremely powerful programmatic API (basically jquery for data from the CMS, but better), you don't need fiftyeleven modules to achieve some basic tasks.
[1] https://processwire.com (don't get put off by the .com. It is open source).
It' reputation is earned.
A fresh web stack with a traditional (non-EAV) db schema and proper programming layers is a much better DX, I'd say. All very doable with LLM-assisted coding.
Maybe soon I can set my agents on it
Is it just the last remaining pockets of "that kind" of web dev?
We're finding that this is becoming even more critical when users are using agents and the scale of changes / publishing increases. Pair that with things like AI regulations that require records of human providence etc, and a CMS becomes even more important.
The benefits are massive ranging from better versioning, free choice of any tools under the sun, strict access control far away from people who don't even understand text encoding, clean CDN deployments, complete elimination of clunky SSR and its footguns, more precise control of the web server configuration, etc.
It's very rare nowadays to see any web devs who don't know the "full stack" from bare Apache/Nginx up to React (or even writing the exact necessary modern plain HTML/CSS/JS). That's why I distinguished the devs who prefer a CMS as "that kind of web dev".
This shift happened in the mid-2010s and I don't know anyone who ever looked back unless they're stuck slow-maintaining something older from before that point in time.
Licensing a CMS now seems like a pointless middleman cost for a subpar product from a time before we had good web standards that were well understood and supported. Every CMS sales pitch seems to be aimed squarely at middle management fearmongering for the most trivial and basic stuff any web dev already knows how to do a lot more efficiently and reliably without a CMS. All devs I see now have experience with these standards using more modern tools at large scale and with the full SDLC and business requirements in mind for over a decade.
citation needed. Pretty much every single React/JS front end dev I've dealt with, doesn't know, understand, or care about the web server aspect itself "Not my problem".
For many implementations though, requiring a dev to make the changes is the failure state.
I love static builds and use them all the time when they're the right fit for the project, but in many cases they are not. I'm also finding that I'm starting to lean towards a CMS more even when it's "just me", but I have a team of agents. i.e. I want the ability to have a voice conversation with a dot / grok bot / etc. and have it update content without it having the ability to do dev type things.
And fortunately those of us in tech, the amount of software in the world is exploding so all those lanes are getting bigger, even within their niche.
You mean the kind of development that powers nearly the entire web?
I know it's becoming more and more outdated nowadays, but if a magazine or a news website is still written by humans rather than AI they need a way to provide formatted text and media, and preview the output.
On the other hand I should add that i've also seen an upward growth in CMSes like WordPress being used exclusively as Online Editors, with content ultimately being exported trough REST to completely different backends and frontends, like a Firebase/NextJS infra.
Separating delivery from content management also reinforces this. Set up a governed content / user workflow and then let an agent focus on just the presentation after pulling in the content. I'd say this extends well beyond rest as well. A user interacting with something like a voice assistant in an agent might actually be using many interfaces at once (mcp from the assistant, HTML in a card, WebMCP alongside the HTML, browser open on another device for the human.) When that happens you want one canoninical system for the content.
After evaluating the landscape, my take was that the project was a waste of time and wouldn’t benefit the company. But a large consultancy was involved, so we had to pick a CMS. We picked Drupal. The result was exactly what management wanted: a single CMS, well-defined taxonomies, and all the content in one place.
Unsurprisingly, the writers hated it. They’d been forced to give up specialized tools for something half-baked that mostly did the same things.
The development experience was atrocious. Scaling was difficult, rolling upgrades and deployments without downtime were nearly impossible, and we constantly ran into bugs and limitations in the existing plugins. We had to bring in Drupal consultants at $300 an hour to get the project over the finish line, but we eventually did. All we ended up using was the admin interface and a GraphQL API, which the company’s products then had to be rebuilt around.
Management wanted everything hosted by Acquia, so we ended up paying $100,000 a year for a few servers that would have cost, at worst, a few hundred bucks a year on Hetzner.
By the original requirements, the project was a success. We managed to move all the traffic over without any downtime. Shortly afterward, I left the company because of how miserable the project had made me.
A few days ago, out of curiosity, I checked whether they were still using Drupal. It turns out management hadn’t learned from its past mistakes: they’d migrated to yet another CMS, even though it was obvious non-management the problem was the business model not the CMS. What of waste of time and money.
If you disagree with the sentiment, it'd be interesting to here why - that's the sort of information that's extremely useful for makers.
There isn't a day I don't ask Claude "What would Drupal do?"
I would not be surprised if approaching vibe engineering from the Drupal perspective is the way out of AI slop.
Nonetheless, although I had a blast one evening building custom modules using Claude wishing I had this tool during those hours of stress I suffered 15 years ago, I don't think there is a place for Drupal outside of higher educations marketing.
Let's revisit the statement in a year :)
My gut is we're seeing the exact opposite. The scale of publishing + users + need for governance is exploding.
Full Disclosure: I was a core and module contributor, DUG organizer, and left the project out of disgust during the aftermath of the smallcore community implosion.
What came after was such a different beast it should have just been its own thing.
From a site building perspective:
The problems agents bring to the table are the same problems that UGC brought to the table - new scale, untrusted users, an increased need for governance.
From a user experience perspective:
You can't ever really know if it's a human, an agent, a human driving an agent, or an agent driving a human - so stick to information architecture and accessibility best practices.
beyond that though, we're in new territory when it comes to change / scale / security / etc, so if there is a strategy it'll be out of date tomorrow.