Original research · Vertical · July 2026

The State of Higher-Ed CMS Readiness 2026

We measured every reachable US university homepage in a set of 2,368 .edu domains — 1,796 were live and measurable — against the same eleven signals that decide whether a site keeps its search and AI visibility when it changes CMS. Higher ed turns out to be its own country: it made a collective platform bet the rest of the web never made, and it is quietly falling behind on the one signal that is starting to matter most.

Higher ed bet on Drupal — and the web didn’t

On the open web, WordPress outnumbers Drupal roughly five to one. Inside .edu that gap narrows to under two to one: Drupal is the second-most-common platform and runs at 5.0× its web-wide rate. Practically, that means a higher-ed replatform is usually a Drupal replatform — and the strengths and blind spots of Drupal are the strengths and blind spots of the sector.

The large Unknown slice is characteristic of the sector: many universities run bespoke or heavily themed stacks that expose no platform fingerprint. It is excluded from the per-platform readiness table below rather than guessed at.

The real gap isn’t security — it’s AI visibility

University sites are nearly universally on HTTPS (99.9%) and carry titles and descriptions at healthy rates. Where they fall down is structured data: just 43.4% emit schema markup, below the 50.1% general-web rate, and only 31.4% clear the combination (schema + canonical + title + description) that answer engines lean on to quote a page. That is the machine-readable layer ChatGPT, Perplexity and Google’s AI overviews use to decide which institution to name — and higher ed is under-built on it at the worst possible moment.

Most Drupal is current — a stubborn tail is not

The good news first: of the 307 university Drupal sites that expose a version, the overwhelming majority are on the modern, supported line — Drupal 10 and 11. But 6.8% (21 institutions) are still running end-of-life Drupal 7, 8 or 9: no security patches, a migration that only gets harder the longer it waits, and in several cases a flagship or internationally-ranked university. This is the sharp end of the replatform question, and it is a named, finite list.

Version is only observable on the share of sites that publish a generator tag, so the true end-of-life count is a floor, not a ceiling.

Grades: four in ten university sites are D or F

Scored across all eleven signals, 42.6% of measured university homepages land at grade D or F — concentrated in exactly the signals (structured data, security headers) that a migration is most likely to drop on the floor if nobody is measuring.

Readiness by platform

Every CMS with at least fifteen measurable university sites, by overall readiness and the two signals most often lost in a migration — structured data (SEO / AI visibility) and security headers.

Method & limitations

• Population: the US Department of Education’s .edu registrant set. Each domain was fetched once with a single identified GET request; no crawling. 1,796 of 2,368 were reachable and measurable — the rest were dead, parked, or bot-walled and are excluded rather than counted as failures.
• CMS and version are inferred from response fingerprints and the generator meta. A large Unknown share is expected in higher ed (bespoke stacks) and is excluded from per-platform cuts, so counts under-report rather than over-report.
• Signals are presence checks, not quality audits — “has structured data” means schema was detected, not that it was complete or valid.
• End-of-life percentages are of the Drupal sites that expose a version; the true count is a floor.

Cite this

Replatform Radar, The State of Higher-Ed CMS Readiness 2026, July 2026. replatformradar.com/research/higher-ed-cms-readiness-2026. Licensed CC BY 4.0. See also our web-wide readiness study.