Say you've fitted the sturdiest front door on the street: three deadbolts, a reinforced frame, an alarm loud enough to wake the whole block. Then a courier shows up with a parcel meant for you, scans the wall where your house number should be, finds nothing, shrugs, and hands it to the neighbour instead. That, more or less, is the shape of what we found this month. We measured 27,385 live websites, and Drupal ships the strongest security defaults of any platform in the sample. It isn't close: 97.6% of Drupal sites send the X-Content-Type-Options: nosniff header, against 40.1% of WordPress sites and 46.8% across the sample as a whole. Every Drupal site we could measure served HTTPS. Feeling a little smug on Drupal's behalf? Fair. But the very same dataset turns up one glaring gap: only 32.2% of Drupal sites emit structured data, versus 83.9% of WordPress. And structured data is exactly the signal AI answer engines lean on hardest when they decide what to cite. Wonderful locks, no house number for the machines that might actually send visitors your way.
Where the numbers come from
The State of CMS Migration Readiness 2026 dataset is a sample drawn from the most-visited 50,000 domains in a Tranco snapshot: one polite homepage request per domain, 11 signals recorded per site, CMS detected from response fingerprints. That yielded 989 measurable Drupal sites and 4,998 WordPress sites. Big enough that the gaps below are structural, not noise. The full method and the per-site data are published (CC BY), so every number here can be recomputed.
The security story: defaults win
| Signal | Drupal | WordPress | Web overall |
|---|---|---|---|
| HTTPS | 100% | 99.8% | 99.8% |
| X-Content-Type-Options | 97.6% | 40.1% | 46.8% |
| HSTS | 72.7% | 49.5% | 55.6% |
| Content-Security-Policy | 35.0% | 25.8% | 31.4% |
| Canonical tag | 97.1% | 92.4% | 71.9% |
| Structured data (JSON-LD) | 32.2% | 83.9% | 50.1% |
The pattern behind the wins is consistent: they're defaults.
Drupal core has shipped nosniff out of the box since Drupal 8, so a
site gets it without anyone thinking about headers. On WordPress those same headers
are left to hosts and plugins, and the measured result is what you'd expect, fewer than half of WordPress sites send them. Security postures that depend on
someone opting in lose to postures that arrive enabled.
The gap is the same story in reverse
Structured data flips the mechanism. The dominant WordPress SEO plugins emit schema.org JSON-LD automatically, so 83.9% of WordPress sites carry it whether or not anyone configured it. In Drupal, structured data is a deliberate act, install and configure Schema.org Metatag (or wire JSON-LD into your theme), and only 32.2% of sites have done it. Same defaults dynamic, opposite outcome.
Five years ago this was a search-console nicety. Now it's how machines read the web: in our separate 13,838-site AI readiness study, WordPress's median AI-readability score (80.9) beats Drupal's (69.1), and emitted schema is the largest driver of the difference. The platform with the best security discipline on the web is underrepresented in AI answers largely because of one missing default.
Why this matters more for Drupal than anyone
Drupal's footprint is concentrated exactly where being findable and citable is a public obligation. In our vertical datasets, Drupal runs at 18.0% of measurable US university homepages, five times its 3.6% share of the general web (higher-ed dataset), and at roughly twice its web-wide share across US government sites (government dataset). Prospective students and citizens increasingly ask AI assistants instead of search boxes; a university or agency whose pages carry no structured data is easier to skip when an answer engine chooses what to cite.
One more number worth sitting with: of the Drupal sites that expose a version, 14.2% still run end-of-life Drupal 7, 8, or 9. The community's security reputation is earned by its defaults and its security team. It is not transferable to installs that stopped receiving patches.
What a Drupal team should take from this
- Keep the wins. The header discipline is real and measured; don't let a replatform or a "modernization" regress it.
- Close the one gap. Schema.org Metatag (or equivalent JSON-LD output) moves a site from the 32.2% cohort into the one machines can actually quote. It is hours of work, not a project.
- Check your version exposure. If you're on 7/8/9, the security defaults you're famous for are no longer being maintained under you.
So what do I actually think? Two things, and they don't cancel out. Drupal's security lead is real, measured, and quietly earned by shipping the right thing on by default, and nobody should let a rebuild or a shiny "modernization" quietly undo it. But the schema gap is the single most fixable number in this whole dataset, and I'd treat it as urgent rather than tidy. If I ran a Drupal site, I'd spend an afternoon this week wiring up JSON-LD, move myself out of the 32.2% cohort, and only then go looking for harder problems. It's hours of work, not a quarter.
Every figure here comes from open datasets sitting on the study pages above (CC BY), so recompute them if you think we fumbled the arithmetic, and tell us if we did. But do the schema first. It's the difference between having the best-locked door on the web and having a door the courier can actually find, so the package meant for you doesn't quietly go next door.