Across 27,385 live websites we measured this month, Drupal ships the strongest
security defaults of any platform in the sample — and it isn't close. 97.6% of
Drupal sites send the X-Content-Type-Options: nosniff header, against
40.1% of WordPress sites and 46.8% of the web overall. Every Drupal site we could
measure served HTTPS. But the same dataset shows one glaring gap: only 32.2% of
Drupal sites emit structured data, versus 83.9% of WordPress — and structured data
is the signal AI answer engines lean on hardest when they decide what to cite.
Where the numbers come from
The State of CMS Migration Readiness 2026 dataset is a random Tranco top-80k sample: one polite homepage request per domain, 11 signals recorded per site, CMS detected from response fingerprints. That yielded 989 measurable Drupal sites and 4,998 WordPress sites — big enough that the gaps below are structural, not noise. The full method and the per-site data are published (CC BY), so every number here can be recomputed.
The security story: defaults win
| Signal | Drupal | WordPress | Web overall |
|---|---|---|---|
| HTTPS | 100% | 99.8% | 99.8% |
| X-Content-Type-Options | 97.6% | 40.1% | 46.8% |
| HSTS | 72.7% | 49.5% | 55.6% |
| Content-Security-Policy | 35.0% | 25.8% | 31.4% |
| Canonical tag | 97.1% | 92.4% | 71.9% |
| Structured data (JSON-LD) | 32.2% | 83.9% | 50.1% |
The pattern behind the wins is consistent: they're defaults.
Drupal core has shipped nosniff out of the box since Drupal 8, so a
site gets it without anyone thinking about headers. On WordPress those same headers
are left to hosts and plugins, and the measured result is what you'd expect —
fewer than half of WordPress sites send them. Security postures that depend on
someone opting in lose to postures that arrive enabled.
The gap is the same story in reverse
Structured data flips the mechanism. The dominant WordPress SEO plugins emit schema.org JSON-LD automatically, so 83.9% of WordPress sites carry it whether or not anyone configured it. In Drupal, structured data is a deliberate act — install and configure Schema.org Metatag (or wire JSON-LD into your theme) — and only 32.2% of sites have done it. Same defaults dynamic, opposite outcome.
Five years ago this was a search-console nicety. Now it's how machines read the web: in our separate 13,838-site AI readiness study, WordPress's median AI-readability score (80.9) beats Drupal's (69.1), and emitted schema is the largest driver of the difference. The platform with the best security discipline on the web is underrepresented in AI answers largely because of one missing default.
Why this matters more for Drupal than anyone
Drupal's footprint is concentrated exactly where being findable and citable is a public obligation. In our vertical datasets, Drupal runs at 18.0% of measurable US university homepages — five times its 3.6% share of the general web (higher-ed dataset) — and at roughly twice its web-wide share across US government sites (government dataset). Prospective students and citizens increasingly ask AI assistants instead of search boxes; a university or agency whose pages carry no structured data is easier to skip when an answer engine chooses what to cite.
One more number worth sitting with: of the Drupal sites that expose a version, 14.2% still run end-of-life Drupal 7, 8, or 9. The community's security reputation is earned by its defaults and its security team — it is not transferable to installs that stopped receiving patches.
What a Drupal team should take from this
- Keep the wins. The header discipline is real and measured; don't let a replatform or a "modernization" regress it.
- Close the one gap. Schema.org Metatag (or equivalent JSON-LD output) moves a site from the 32.2% cohort into the one machines can actually quote. It is hours of work, not a project.
- Check your version exposure. If you're on 7/8/9, the security defaults you're famous for are no longer being maintained under you.
The datasets behind every number here are open (CC BY) and downloadable from the study pages above — cite them, recompute them, or ask us for a custom cut.