alt Hacker NewsDrupal is now light-years ahead of its reputation
Comments
A lot of developers got burned by Drupal in the 2010s. "The drop is always moving" may be gone, but having to do a massive rewrite of a site's template every couple of years and rebuild its plugin ecosystem—even if all one wanted was a secure site—was a lot to manage. Add to it a community that was oriented toward only listening to folks who contributed to the project or made plugins and the bad reputation was earned. I'm not a professional web developer, but I know a few who gave up on Drupal during this time, just as I did. My nonprofit now runs on Wordpress, which isn't perfect, but can handle 1,600 paid members (via a paid plugin) and just works from day to day. My personal site is vastly more sophisticated than it ever was under Drupal since the maintenance is so much less. It's going to take a lot to rebuild this reputation. A lot of love was lost.
Broadly, I always felt that "Drupal and the others" vs. Wordpress was a perfect example of "evolution over intelligent design."
This probably changed somewhere down the line, but I genuinely believe the most significant factor in Wordpress becoming the dominant CMS is that, in the beginning, for a long time, it wasn't trying to be a CMS, just a blog engine.
The only time I ever allowed myself to have the PHP is a security nightmare conversation at work, I came in the very next morning to find the lone PHP supporter was having to patch the drupal instance he supported because it had been hacked and defaced. I tried not to be smug about it because the timing made it look like maybe I was the culprit, and I was still new there.
But he never mentioned PHP again which was just fine with me.
In trust situations we have a sort of unspoken concept of Original Sin. Essentially once someone has made a security blunder of epic proportions, we can not trust that this is an isolated incident instead of a pervasive one. If The Rot Starts at the Head is true, then how can any amount of rework ever make you trust the thing again?
I looked at the security patch that Drupal applied, and I’m no PHP reader but I was sure I found the same antipattern in two other places in the code that were not patched. I only looked for an hour. There have been years and years of low effort CERT advisories since. From a user standpoint, if you’re not deep into Sunk Cost, this looks like throwing good money after bad. Only rationalization ever makes it seem like a good deal.
It isn't quite as bad as when the codebase was switched to Symfony, but the Drupal project has just kind of abandoned it's core presentation system in favor of the new Canvas tool, and compatibility with the rest of the core seems like an afterthought. So now you have at least 3 competing display configuration solutions, which don't necessarily work together, or entirely work alone.
It's a situation entirely inline with Drupal's reputation: they couldn't just get it right, and now serious Drupal teams don't know which way to go in the ecosystem.
I came into Drupal right as 8 was becoming the standard, and facilitated a number of Drupal 7 migrations, so I don't have the experience of getting burned by churn, but I will say that coming from WordPress, Drupal was a huge breath of fresh air. Better code, better community, better architecture etc.
The Drupal core team is moving really fast to improve its reputation, and I think a lot of the changes are good. The AI integration is pretty solid, and the Symfony framework is solid and easy to build on. I think the move to Canvas is misguided and from inside the community I can tell you that not everyone is on board, but it is nice that both paths are possible.
As many here have said: If you have large teams that manage large amounts of content, Drupal is really the only option. If you're making one-off sites or "brochure sites," then vibe-coding them is just as good as anything, but I don't think that's ever been Drupal's core concern.
Drupal is now a very different animal than it was in the Drupal 7 heyday. It's confusing for folks used to WordPress and similar as you're not gonna be uploading it to a regular old shared hosting provider. There's no way you're using modern Drupal without SSH access and using command line to install and update. And thoroughly learning how the Drupal bits all work together.
Drupal CMS is what a lot of people suggest for new folks, but it isn't explained what it is on the Drupal website. It's apparently a set of pre-configured extensions, templates, AI, and settings. Drupal has a version on their site to download but it says it's a "trial" and requires registration to get it, further increasing friction: https://new.drupal.org/drupal-cms/trial#:~:text=start%20your...
Once you do get it, it may or may not work. When I last tried the Windows version, it didn't work and just gave the old Drupal white screen of death in the browser.
When I've seen discussions in the Drupal sub-reddit, most of the recommendations on how to do something seem to be some version of 'have Claude do it for you'. And the Drupal homepage is very AI forward and mentions AI 9 times.
Drupal's largest install base was back in the Drupal 7 days, which was the last major version that supported upgrading in place from the previous versions. Major compatibility changes started with 8 and continued. About 1/2 the sites that used to run Drupal 7 migrated to WordPress rather than upgrade. Today, there are about the same number of sites running Drupal 7 as the current Drupal 11, which speaks volumes.
As someone that still uses a paid, extended-support version of Drupal 7 and is likely switching my big legacy site to Backdrop CMS (actively maintained Drupal 7 fork) and my other two sites to another CMS, it doesn't seem like there's a place for folks like me in the current world of Drupal.
I heard it expressed that AI is bringing a new era of small and personal software.
I think CMSes and websites are where that is most applicable. You no longer need these generalized abstractions and can now make your interfaces and data types just perfectly match your use case with little effort.
We went through great pains to build these mammoth, one-size fits all applications like Drupal and Wordpress for running dynamic sites across industries and companies with very little in common.
These days, I love to stay close to the model and stay close to the metal.
Drupal is a name I haven't heard in a long time, so the reputation that they're light-years ahead of is probably a low bar for me. I just recall every time I tried to adopt it or learn my way around it, the curve was high, not even compared to anything, it was just a lot. I'd love to give it another chance, but there are so many good options and such different ways of doing web dev these days, I'm not sure what benefit this would have.
Also, what an amazing day to pick to talk about anything PHP.
Drupal has been pretty good ever since Drupal 8. A lot better than WordPress IME, which isn't exactly a high bar, but it's THE bar now.
The churn stopped after D8 - upgrades from D8 -> D9 -> D10 have all been painless with no major overhauls to the API. The template system, the granular caching infrastructure, namespacing, package management, Symfony core, are good.
It's a solid framework to build on without having to reinvent the CMS wheel.
Drupal earned that reputation for so many architectural upheavals and pointless version churning. I grok innovation, but one of the core properties of web infrastructure is that it's relatively (in a software sense) architecturally stable. Drupal was not that.
We can do better than PHP, EAV-style db schemas, year 2000ish CMSes and, thus, Drupal.
It' reputation is earned.
A fresh web stack with a traditional (non-EAV) db schema and proper programming layers is a much better DX, I'd say. All very doable with LLM-assisted coding.
What are the best reasons for a new project to choose Drupal in 2026, apart from familiarity ?
I switched to ProcessWire [1] a couple of years ago, and haven't been happier.
It succeeded to do what Drupal tried but never managed to do:
It is both extremely stable and extremely flexible at the same time.
By having an extremely generic and small core, combined with an extremely powerful programmatic API (basically jquery for data from the CMS, but better), you don't need fiftyeleven modules to achieve some basic tasks.
[1] https://processwire.com (don't get put off by the .com. It is open source).
The very most you can say for Drupal is that it is better than Wordpress at its worst. All the goodwill for Drupal was burnt years ago.
This might be one of the funniest articles ever. "Drupal is now light-years ahed of its reputation", yet it's vulnerable to one of the most serious and easily-exploitable RCEs in the history of computing.
It's time to abandon PHP and C-based software (i.e. PHP). The clock's ticking.
What do writers like to use these days? I remember everyone hated Drupal or anything other than Wordpress, to a point that we had Wordpress as the tool all the writers used, and we just used WP-database to serve on a completely different system.
Seven or eight years ago, I led a project for a large media company to consolidate publishing workflows across multiple products, moving everything from several content management systems to Drupal.
After evaluating the landscape, my take was that the project was a waste of time and wouldn’t benefit the company. But a large consultancy was involved, so we had to pick a CMS. We picked Drupal. The result was exactly what management wanted: a single CMS, well-defined taxonomies, and all the content in one place.
Unsurprisingly, the writers hated it. They’d been forced to give up specialized tools for something half-baked that mostly did the same things.
The development experience was atrocious. Scaling was difficult, rolling upgrades and deployments without downtime were nearly impossible, and we constantly ran into bugs and limitations in the existing plugins. We had to bring in Drupal consultants at $300 an hour to get the project over the finish line, but we eventually did. All we ended up using was the admin interface and a GraphQL API, which the company’s products then had to be rebuilt around.
Management wanted everything hosted by Acquia, so we ended up paying $100,000 a year for a few servers that would have cost, at worst, a few hundred bucks a year on Hetzner.
By the original requirements, the project was a success. We managed to move all the traffic over without any downtime. Shortly afterward, I left the company because of how miserable the project had made me.
A few days ago, out of curiosity, I checked whether they were still using Drupal. It turns out management hadn’t learned from its past mistakes: they’d migrated to yet another CMS, even though it was obvious non-management the problem was the business model not the CMS. What of waste of time and money.
> React has one of the world's largest developer communities. Drupal Canvas code components are written in React, and we designed the developer experience around the tools, patterns, and workflows front-end JavaScript developers already know. They can use their preferred development tools, including modern AI-assisted workflows, without having to learn Drupal-specific concepts or conventions. We've continued to make that experience better, lowering the barrier for a much larger community of developers to build with Drupal.
Ok. As someone who hasn't shipped a Drupal site since halfway through the D8 cycle: is this better or worse than the tumor that is Gutenberg?
I will say, I liked Drupal more than I expected to the last time I used it. But... it's still Drupal.
It feels dated. Even the "new" designs they're rolling out still feel old. They're working with a dated design system, and honestly, it feels like they had developers build it without bringing actual designers into the process. The result is always functional, but somehow a little awkward. Not unified. There's still like 3-4 different ways to do the same sorts of actions depending on where you are. It's clumsy. It's Drupal!
And true to its roots, Drupal still requires way too many third-party modules to get a build working the way I want. Half of those don't even have the "new" design system applied. So even for a CMS that cares about WCAG, they're still falling short. I'm not sure they'll ever get all the open-source developers on the same page. (I know they have a stated goal of 2027... I don't see it happening.)
More broadly, I don't have much confidence that Drupal modules will be maintained beyond a version or two. That makes anything you build on top of them inherently disposable. Which is fine; a lot of the web is disposable. But it also means I don't want to take ownership of long-term maintenance for projects built on Drupal.
Every time I have to install a third-party module in Drupal, I cringe a little. I know that two or three years down the road, when a new major version comes out, I'll be hunting down the guy who wrote the module, hoping he'll update it. Otherwise, we're forking his repo and taking responsibility for maintaining it and applying security patches ourselves. Cringe.
Meanwhile, I've really enjoyed working with Contentful, Directus, and even Statamic. There are a lot of great CMS options out there these days.
One platform I'd actively warn people away from, though, is Strapi. I've had two false starts with projects where people wanted to use it, only to run into some fundamental flaws.
Like, "Oh, you want to associate one of your 10,000 files with this page? Sure, we'll put them all in a dropdown for you to sift through... and that'll make pages take 2 minutes to load." Cringe. Run. (Ha, wait... and the whole, "We are in France, so we don't answer support emails in August." Literally what their support email told me. Yikes.)
In the last five years, Strapi is the only CMS I've built with that I just couldn't get behind on any level. I would have rather used Drupal for those projects. Ha!
I honestly think version 7 should have been the last version to carry the Drupal name.
What came after was such a different beast it should have just been its own thing.
How is Drupal even still relevant?
I don't have a strong opinion on Drupal (last used it 15? years ago, it was fine) but the people who make don't get to say "Drupal is now light-years ahead of its reputation.". That's what everyone says of their own stuff, just no.
Drupal made me care about abstraction with every feature in any language I worked with. Drupal made me faster by being a little slower. While working with teams where people were doing one off solutions as fast as they could, I never painted myself into a spaghetti code corner.
There isn't a day I don't ask Claude "What would Drupal do?"
I would not be surprised if approaching vibe engineering from the Drupal perspective is the way out of AI slop.
Nonetheless, although I had a blast one evening building custom modules using Claude wishing I had this tool during those hours of stress I suffered 15 years ago, I don't think there is a place for Drupal outside of higher educations marketing.
Not really the best timing for this
It's too late. Drupal 6 turned me off ever using a CMS again. Now I purely use html files in folders with other files in folders. It's great. No maintainence burden, no attack surface, no resource eating always running programs or database that can get corrupted or otherwise in a bad state. And especially no migrating to the new version and everything breaking (especially with non-core stuff).
Is there a compelling reason to even use a CMS at all anymore? I feel like the majority moved on well over a decade ago.
Is it just the last remaining pockets of "that kind" of web dev?
you can be lightyears ahead of your reputation and still be shit.
Opus 5.5 rewrote an awful, legacy Drupal app from scratch in my preferred stack in four hours. This included handling abandoned plugins, migration to a not-insane database schema, and content fixups from a Drupal 4 backup that fixed truncated cells somewhere in a botched Drupal 6-7-8 upgrade I wasn't part of.
If you want to know everything you need to know about Drupal, have a peek at the community discussion around sitemaps. There are genuine reasons behind the complexity, but a CMS that cannot generate a list of its own URLs, leaving thousands of people baffled, is quite an achievement.