Drupal vs WordPress

Both are free, open-source systems that render the site themselves, so the choice is not about architecture. Drupal is built around granular permissions, workflow states and multilingual handling, and needs scarce specialists. WordPress is built around a vast plugin ecosystem and a huge talent pool, and needs constant maintenance. Public bodies lean to Drupal; most content sites to WordPress.

Vendors can pay for visibility on this site; it never changes what we say about a product. How that works.

Both are reviewed in full in our content management ranking: Drupal and WordPress.

1. 01

   Finding people to build and look after it

   WordPress has the deepest talent pool of any system in this category: whoever you hire has probably used it. Drupal depends on specialists, who become scarcer and more expensive each year. For a site that must outlive its first agency, that difference in replaceability is a practical risk, not a detail.

   Edge: WordPress

2. 02

   Permissions, workflow and languages

   This is Drupal's reason for existing. Core ships a Content Moderation module with draft, published and archived states, transitions granted per role, and translation modules covering content, menus, blocks and configuration, with more than 100 languages available. WordPress core has six predefined roles, from Super Admin to Subscriber, and is itself available in more than 70 languages. Drupal takes this round.

   Edge: Drupal

3. 03

   Effort for a straightforward site

   For a simple site, Drupal's setup effort is out of proportion to the result, and a small business brochure site is explicitly the case it does not suit. WordPress gets there faster because so much is already built and available as a plugin. If the requirement is pages, a blog and a contact form, WordPress is the lighter route.

   Edge: WordPress

4. 04

   Where the running cost lands

   Neither is free to run. With WordPress the bill is upkeep: plugins are the attack surface, and an install nobody updates turns into a liability, so you need an owner or managed hosting. With Drupal the bill is development and specialist time. Which is worse depends on whether you lack maintenance discipline or specialist budget.

   Depends on the buyer

5. 05

   Who handles security fixes

   Both projects run a security team. WordPress describes its team as more than 50 experts, and says plugin flaws are reported to the plugin's developer and the plugins team. Drupal's Security Team issues advisories for core and for contributed modules that have active maintainers, publishing only once a fix exists. In both cases the site owner still has to apply the updates.

   Depends on the buyer

Is Drupal or WordPress more secure?

Neither project claims to be safer than the other, and both have a security team that issues fixes. Drupal's team covers core and maintained contributed modules through formal advisories.

WordPress officially supports only its latest version, and plugin issues go to the plugin's developer and the plugins team. Either way, someone has to own updates.

Is Drupal or WordPress better for a multilingual site?

Drupal translates content, menus, blocks, taxonomy and configuration with core modules, and offers more than 100 languages.

WordPress can be installed in more than 70 languages, but publishing the same content in several languages is normally done with plugins. For complex multilingual publishing with approval rules, Drupal is the stronger fit.

Which costs less, Drupal or WordPress?

Both are free to download under the GPL. With Drupal you pay for hosting and development, and specialists are expensive.

With WordPress you pay for hosting, plugins and ongoing maintenance. For a simple site WordPress is normally the cheaper build, because Drupal's setup effort is high for what you get.

Does WordPress have editorial workflow states like Drupal?

Drupal ships a Content Moderation module in core: an editorial workflow with draft, published and archived states, where each transition is a permission granted per role.

WordPress core works with six predefined roles, such as Author, Contributor and Editor. Approval chains beyond those roles are usually added with plugins.

• Drupal multilingual feature page: more than 100 languages and translation of content, menus, blocks and configuration in core.
• Drupal documentation: Content Moderation module: core workflow states draft, published, archived with per-role transitions.
• Drupal Security Team general information: advisories for core and maintained contributed modules once a fix exists.
• Drupal licensing page: Drupal is free under GPL version 2 or later.
• WordPress features page: GPL licence, more than 70 languages, predefined user roles.
• WordPress documentation: Roles and Capabilities: six predefined roles from Super Admin to Subscriber.
• WordPress security page: security team of more than 50 experts, plugin issue reporting, latest version supported.