Drupal vs WordPress: What are the differences and which is better?

In terms of popularity, WordPress is second to none. It can be safely assumed that every third website works under the control of this system. It's so popular that recently it's been used for almost everything. From blogs through forums to online stores. Drupal is much less popular, but also keenly used for all kinds of websites. So what do these two CMS platforms have in common and what makes them different? When should you choose Drupal, and when to select WordPress?

Drupal vs WordPress security 

Probably everyone has heard about some spectacular hacking attack on a government website or other popular webpage. However, such personalized attacks – in spite of appearances – are rare. Hackers more often prefer to conduct large-scale operations, thanks to which they increase their chances and potential profits. The scripts they create roam the Internet in search of websites whose content management systems aren’t updated on a regular basis and thus contain known security holes. The popularity of WordPress naturally makes it vulnerable to attacks – there are simply more websites on the Internet with out-of-date WordPress than Drupal.

Holes

As I’ve already mentioned, hackers usually take advantage of known security holes that have already been patched in newer versions. On the Exploit Database website, I've checked out how many such holes can be found for both systems. For Drupal, there were 40 of them, while for WordPress the number was... 1249. As you can see, for purely economic reasons it's more profitable to attack WordPress. Therefore, remember to always update your CMS platforms. If you have a problem with this, or don't know how to do it, our PHP development team will do it for you.

It's partly because of the high level of security that so many government sites and other important services (London.gov.uk, New York State, Australian Government) are based on Drupal. They care so much about security that they’re willing to donate large sums for the further development of this system.

Template engine

But that's not all. The very design of WordPress may cause security holes. The lack of a template engine means that the developer is obliged to ensure that all the dynamic elements of a webpage (e.g. comments added by other users under an article) are cleaned of all unwanted elements (such as  tags used for XSS attacks). Drupal, like Symfony and many other frameworks, by default uses Twig – the most popular template engine for PHP. It provides a very high level of security and allows you to keep the code in order. This system automatically removes any unwanted and potentially dangerous tags. Using a template engine has been a standard for many years and the fact that there's none in WordPress is a huge problem.

Sensitive data

Very often, in the case of larger websites, it’s necessary to store data on a server which will be available only to a specific group of people. Such files often contain sensitive data and should be specially protected. Drupal provides this functionality by default, and only grants access to these types of files to the users who have the appropriate permissions. Unfortunately, in the case of WordPress, the situation is completely different. All uploaded files are stored in the /wp-content/uploads/[YEAR]/[MONTH] directory. This means that anyone with basic knowledge of WordPress and a bit of luck can gain unauthorized access to files. Recently, the lekarzonline.eu website has found out about it the hard way. The patients' medical data was stored in the default directory without any access control.

Cost

The cost of implementing a website is a decisive criterion for many customers. In the case of WordPress, sometimes you don't even need to hire a developer for this. Thanks to the plugins such as Elementor or Visual Composer, you can easily "click-through" the elements of the appearance of individual pages yourself – even while having absolutely no programming knowledge. In addition, many web hosting services offer free WordPress installation on a server. Therefore, with the right amount of time, you can do everything by yourself at a minimal cost.

Some web hosting services, e.g. cyber_Folks, offer free Drupal installation. Nevertheless, further implementation will require programming knowledge. For non-technical people, this may be an insurmountable obstacle. It's true that even in this CMS website builders are starting to appear – such as Droopler, thanks to which many things can be just clicked-through, at the same time reducing the cost of implementation, but it's still hard for Drupal to compete in this field with WordPress.

Further development of a finished website

Unfortunately, in the case of WordPress, further development is very problematic. It simply lacks many tools that would facilitate it, and the WordPress architecture itself complicates it a lot. This system doesn't separate the configuration data, layout, and content in any way. The problem is especially visible if you’re adding new content (e.g. blog entries) to a webpage on an ongoing basis. Let's take a look at a specific example. A developer who wants to introduce new functionalities works on the website locally. Meanwhile, someone else adds new content to the website that is available on the Internet. In effect, the local version may have new features, but lacks content that was added by someone else at that time. As a result, you have two different versions of the webpage that are very difficult to merge.

Thanks to having configuration synchronization tools in place, Drupal completely solves this problem. While working in a local environment, a programer can export any configuration changes to files, and then upload to the target webpage – without fear of disturbing its content. Moreover, the process can be automated, which saves a lot of time.

Performance and speed

The times when you could easily make a coffee, take the dog for a walk and cook dinner for the whole family while waiting for a website to load are long gone. Currently, every additional second of waiting for a website to open dramatically increases the risk that visitors will leave it. That's why it's so important to ensure proper performance. Although it lacks built-in caching mechanisms, WordPress works quite well if we're talking about a small website with little content. A problem arises, however, when the website has a lot of content or is visited by many people at the same time. More complex queries can sometimes take a few seconds, mainly due to the database structure of this content management system. This may not seem like much, but in the case of websites, it's a very bad result.

Drupal's results are much better in this competition. From the very beginning, it was created with high efficiency and work under heavy load in mind. Increased traffic won’t slow down the performance of Drupal websites. Additionally, the built-in caching and file aggregation mechanisms allow you to speed up the page loading time and save the data transfer.

Availability of plugins or modules

This paragraph could be summed up in one sentence: Drupal has nearly 50 thousand modules, while WordPress has 10 thousand more plugins. However, besides presenting the raw figures, it’s good to discuss two more issues - ease of installation and method of operation.

Installation

Both CMSs have their own repository from which you can download plugins and extensions. In the case of WordPress, it only takes three clicks to install them, and it requires absolutely no programming knowledge. WordPress will download the required files by itself, and put them in the appropriate directory on the server. In Drupal, the process is a little more difficult. A previously downloaded ZIP file with the module must be uploaded by yourself using the administration panel.

Operation

Many WordPress plugins provide solutions that are ready to use right out of the box. With just a few clicks, you can create a contact form or a complete mailing system with a newsletter. Drupal modules usually work differently. They mostly don't provide ready-made solutions that you can implement by yourself within a few minutes. Instead, they provide the tools with which the developer carries out the final implementation. Such a solution gives more freedom in the use of modules but increases the implementation costs.

User-friendliness

As I've mentioned before, many things in WordPress can be configured with just a few clicks, which is a huge advantage. The administration panel itself is intuitive and user-friendly, not only compared to Drupal, but also to other CMSs such as Joomla or PrestaShop. In addition, in the event of any problems, you can find a whole lot of guides on the Internet thanks to the huge popularity of this platform. Admittedly, along with WordPress 5.0, the default content editor has been replaced by Guttenberg – which in my opinion does more harm than good – but other CMS platforms are still far behind in this regard.

Administration panel in WordPress. Source: Kinsta

At first glance, the Drupal interface looks less user-friendly, a bit like something from the previous era. Fortunately, the developers are aware of this and are working intensively on the Claro and Gin skins, thanks to which the administration panel looks much better, even offering a darker theme that has recently become very popular. You should still keep in mind that Drupal is a very extensive CMS. It'll take much longer to learn how to use it, and the multitude of options and settings can be overwhelming at first.

Administration panel in Drupal. Source: InMotion Hosting

Configuration panel in Drupal with a Claro skin. Source: Drupal.org

Drupal vs WordPress - which system is better?

There is no clear answer to this question. It all depends on what the website will be used for. It's just like choosing the right shoes - some will be better for jogging and others for walking in the rain.

WordPress is a very good content management system and it works great for small websites or online stores that operate under a light load. Unfortunately, recently it has started to be used without a second thought for all types of websites. Many people consider it to be the solution to all problems and believe that their website will only work well because it's based on this CMS. This is a false assumption that could cost them dearly in the future.

On the other hand, Drupal is very extensive and offers much more possibilities. It'll be perfect if you care about safety and high efficiency. At the same time, the multitude of options may be a problem at first, especially if you’ve never used this platform before. In this case, the already mentioned Droopler – a free Drupal distribution, offering many ready-made components that allow you to build a website without coding – will be very helpful.