— 10.22.24 Sam Zimmerman, Senior Vice President, Platform Partnerships

In the past month we’ve seen some of the biggest – and most surprising – developments ever in the worlds of WordPress and Drupal, two of the most-used content management systems which are particularly popular among nonprofit organizations. In this post, I’ve summarized the recent events, the near-term implications for users of these two platforms, and the outlook going forward.

Wtf is going on with WordPress???

Nearly half of all websites on the internet are built with WordPress, an open-source CMS founded in 2003 that is built in PHP. WordPress is one of the great success stories of the open source software movement, a licensing approach in which the code base is not owned by a commercial entity and the source code is fully available to learn, use and modify. Open source projects are typically governed by self-organizing communities of volunteers, and the larger projects like WordPress and Drupal have established nonprofit organizations to govern community resources and manage the development roadmap. 

There is an underlying tension between the commercial users of open source software and the communities that maintain and evolve the software, which Drupal founder Dries Buytaert calls the “Maker-Taker problem.” Commercial interests can use the software for free with no obligation to contribute development resources back to the project – and they regularly do so. Growth in the popularity of an open source framework therefore does not necessarily equate to more developers working on the health and growth of the code base.

This tension erupted at the annual WordCamp US conference in Portland on September 20, 2024. Matt Mullenweg, a co-founder of WordPress who retains control over the WordPress.org nonprofit, used his closing address to brand WP Engine, a leading managed hosting provider that hosts somewhere between .9% and 1.5% of the world’s websites (including several Blue State clients) as a taker who are “fracking” the WordPress community and should be exiled. Mullenweg’s main complaints are:

  • WP Engine is owned by Silver Lake, a private equity firm with $102B assets under management, but contributes negligible resources back to WordPress.
  • WP Engine adulterates WordPress on its platform in ways that save costs for the company but compromise the product for users.
  • WP Engine uses the WordPress trademark (commonly abbreviated as “WP”) without compensation.

A feud quickly escalated:

  • WP Engine sued Mullenweg’s competing hosting business (Automattic, who own WordPress.com and WordPress VIP).
  • WordPress.org blocked WP Engine from access to its servers for code updates.
  • WordPress.org forked Advanced Custom Fields, a common plugin that is maintained by WP Engine but distributed to many sites via WordPress.org.

Yikes! This is an unprecedented event that has challenged everyone in the WordPress community to reevaluate what open source means in practice and how the WordPress movement should be governed. Both WP Engine and Automattic have seen staff departures in the fallout.

What this means for you as a WordPress user

The legal fight between WP Engine and WordPress.org will likely take many months to play out, so answers to the high level questions about what this rupture portends for the vast commercial industry that has evolved on top of WordPress won’t come into focus for a while. However, there are three immediate implications to highlight for WordPress site owners, all of which have to do with the availability of code updates to WordPress core and several popular plugins caught up in the melee. It is critical for sites running any open-source CMS to receive regular security updates as well as new features that are released.

Code updates for sites on WP Engine:

When WordPress.org blocked WP Engine from access to its servers for code updates, it disrupted WP Engine’s automated process for receiving WordPress core, theme, and plugin updates for the sites it hosts, which had immediate impact on WP Engine customers who rely on these updates to keep sites secure and operational. WordPress.org granted a temporary reprieve to allow WP Engine to stand up a mirror of the asset libraries and distribution process. WP Engine has confirmed to Blue State that their mirrored solution has been running and stable since the week of September 30. Customers with sites on WP Engine should expect no interruptions to vital code updates going forward.

Code updates for sites using Advanced Custom Fields:

ACF is a ubiquitous plugin used by developers to create rich content types with arbitrary custom fields. It was a huge component of WordPress’s evolution from blogging platform to full-featured website builder. ACF was purchased by WP Engine in 2022.

There are two versions of the plugin: ACF, which is free, and ACF Pro, which requires a commercial license. For sites using ACF Pro (which includes many sites developed by Blue State), code updates automatically come from WP Engine’s server, no changes are needed.

Likewise, for sites using any version of ACF with WP Engine, no changes are needed. On the other hand, for sites using ACF (not ACF Pro) that are hosted on a provider other than WP Engine, there are two options:

  • To receive ongoing code updates from the ACF maintainers directly, a one-time download is required, documented here.
  • If this step is not taken, code updates will come from WordPress.org, for the forked version of the plugin they’ve dubbed Secure Custom Fields.

Code updates for sites using other WP Engine-owned assets:

There are a few other assets owned by WP Engine that were also previously distributed on WordPress.org, including NitroPack, WP Migrate Lite, WP Offload Media Lite, WP Offload SES Lite, Better Search Replace, Frost, Genesis Blocks and Genesis Custom Blocks. Instructions for setting up updates for these assets are documented here.

Meanwhile, what is going on with Drupal?

Drupalcon Barcelona, one of two annual conferences of the Drupal community, was the week following WordCamp US, and the unprecedented series of events following Matt Mullenweg’s address were absolutely the talk of the conference.

The tumult in the world of WordPress has to some extent overshadowed significant announcements in the Dries Buytaert keynote (the “Driesnote”) about the future direction of Drupal. For the past few Drupalcons, the Driesnote has talked about:

This progression shows the Drupal Association moving from recognition that Drupal faces an existential imperative to innovate, to advancing a strategy, plan and timeline.

In Barcelona in September, Dries announced that the target for the next major Drupal release, branded Drupal CMS, is January 15, 2025. Drupal CMS will be the name of the platform going forward. This next release will include a number of significant innovations:

  • A trial experience: A trial experience that lets you try Drupal CMS with a single click that runs entirely in the browser – no servers to install or manage.
  • An improved installer: An installer that lets users install recipes – pre-built features that combine modules, configuration, and default content for common website needs.
  • Project Browser support for recipes: Users can browse the Drupal CMS recipes in the Project Browser, and install them in seconds.
  • Events recipe: A simple events website that used to take an experienced developer a day to build can now be created in just a few clicks by non-developers.
  • SEO Recipe: Combines and configures all the essential Drupal modules to optimize a Drupal site for search engines.
  • AI for site building: AI agents capable of creating content types, configuring fields, building Views, forms, and more.
  • AI-assisted content migration: AI will crawl your source website and handle complex tasks like mapping unstructured HTML to structured Drupal content types in your destination site, making migrations faster and easier.

A second wave of features will be released later in 2025, including:

  • An early preview of an out-of-the-box Experience Builder tool for content creators and designers, offering layout design, page building, basic theming and content editing tools.
  • Progressive conversion of Drupal’s backend UI with React (incrementally replacing PHP).
  • In addition to the Events and SEO recipes, 12 more are currently in development.

Support for non-technical marketers is a key focus of this reinvention, allowing marketers to build functional sites with prebuilt recipes, AI assistants and no-code admin UI. This is specifically focused on making Drupal a viable choice for users who have historically been attracted to Wix and Squarespace as well as customers of rising low-code competitors like Webflow and Framer.

The Drupal Association recognizes that current documentation is only useful to experienced insiders and that clear, effective documentation will be key to Drupal CMS’s success. They’ve hired a dedicated Documentation Lead, responsible for creating new documentation created specifically for end users.

With all of this significant innovation, I think that in settling on Drupal CMS as the brand of the product going forward, there was a major missed opportunity for a fresh start in the market. For comparison, the rebranding of Episerver as Optimizely has helped Optimizely quickly vault to a market-leading position, competing head-to-head with Adobe. I understand the passionate affection for the Drupal brand amongst the core community, but as discussed further below, the brand no longer excites the broader developer community, so the hurdles to win back developers will be steep.

What this means for you as a Drupal user

First of all, this is fantastic news for the core Drupal community, who are inspired by the Drupal Association’s strategy and this measurable momentum towards addressing the issues that have challenged Drupal’s utility and market reputation. Drupal CMS looks to be a fundamentally more competitive, forward-looking product, backed by a reinvigorated Drupal community, all of which bodes well for organizations invested in Drupal.

While new websites built natively in Drupal CMS in 2025 will be able to take advantage of all the innovations out of the gate, we haven’t yet heard the vision for updating existing Drupal websites to Drupal CMS, or if a full upgrade would be needed. There are many new modules coming that will collectively create the Drupal CMS experience, but because all will be built on the current Drupal core, it may be possible to pick and choose which modules to add to an existing Drupal site that is updated to the latest version. The most anticipated and revolutionary module is the Experience Builder, which will be released in mid-2025, so we expect conversations with existing Drupal clients about when and what to update to happen around this stage.

For Drupal sites that have not been kept pace with current releases, updating to incorporate Drupal CMS features might prove more challenging. Although upgrades from Drupal 8 forward have become progressively more streamlined, jumping from a D8 or D9 build to Drupal CMS might look more like migration rather than an upgrade. The emphasis on developing AI-assisted migration tools may help current users move existing Drupal sites running older versions to Drupal CMS. There are many sites still running on D7, which (after many reprieves) reaches end of life on January 5, 2025, so the migration assist tools may provide those users a path to stay on Drupal as well.

Still, the forecast for WordPress and Drupal looks stormy

For those of us working in WordPress and Drupal every day, it is easy to feel that these platforms are going to keep chugging along and remain at the top of the heap for years to come. But the news from this month shows that the founders of these projects recognize that there are serious challenges ahead. Matt Mullenweg went nuclear with WP Engine because he sees declining volunteer contributions to WordPress and a need for commercial interests using WordPress to fill the gap. Dries Buytaert has recognized that Drupal must quickly evolve now or it will slip in market perception to an unrecoverable position.

In 2023, I wrote a CMS forecast article predicting that WordPress and Drupal are in trouble, referencing the 2023 Stack Overflow developer survey. The 2024 Stack Overflow developer survey continues to paint a bleak picture for WordPress and Drupal. In the admired/desired chart which shows what frameworks developers most like working in and want to learn:

  • A measly 5.5% of developers admire WordPress, and 34.5% want to learn more about it.
  • A devastating 0.9% of developers admire Drupal, and 28.5% want to learn more about it.
  • Compare this with the most popular frameworks, React and Node.js, at over 30% admired and over 60% desired.
  • PHP is also sinking, sitting at 9.6%/43.8% compared to 39.8%/58.3% for Javascript and 33.8%/69.5% for Typescript, the ascendant languages for web development.

So the real challenge to the long-term outlook of WordPress and Drupal is developer support. The central premise – and selling point – of these PHP-based CMSs is that they are supported by massive developer communities that will continue to maintain the code base and continuously innovate to push the CMS forward. The Stack Overflow numbers show that developers have turned their backs. Unless this existential issue is addressed, these communities are going to rapidly decline. This matches what I am hearing consistently from colleagues in the space that no developers under 30 are working in WordPress and Drupal.

So, despite massive user bases for WordPress and Drupal currently, a website strategy centered almost entirely on these two CMSs is not going to be sustainable indefinitely. But if not WordPress and Drupal then what? Stay tuned for part 2.