CMS Comparison
|
This content was generated with the assistance of AI and should be verified against the official documentation before being relied on in production. This section’s bibliography lists the reference material consulted while preparing these pages. |
This page compares the two content management systems documented in the CMS section of this site,
WordPress and Webflow, with fourteen other systems that
matter because they are popular, because they are growing, or because they show a different way of building the same
site: traditional open-source systems, hosted website builders, headless and API-first products, and enterprise or
stack-specific systems. Every number was fetched on 2026-10-29 from the sources listed in the
Bibliography, and the figures change monthly, so treat the page as a dated snapshot. The data and the
scripts that draw the figures are in scripts/cms-comparison-charts/, and the charts can be regenerated with
npm run charts:cms-comparison.
The page follows the method of the E-commerce Platforms Comparison, the
Web Frameworks Comparison and the
Documentation Tools Comparison: data kept in CSV files, charts generated from
them, a stated source and date for every figure, and n/a for anything that could not be sourced. It does not repeat
what the platform sections explain: for the detail of one platform, follow the links to the
WordPress comparison and decision guide and the
Webflow comparison and decision guide. To go straight to the
conclusion, read the summary and recommendations at the end.
Scope and inclusion criteria
What is compared. Sixteen systems in four groups. The groups are not the same kind of product, and the page says so wherever it matters:
| Group | Systems | What they have in common |
|---|---|---|
Traditional open-source (self-hosted) |
WordPress (documented on this site), Drupal, Joomla, TYPO3, Craft CMS |
Server-side PHP applications that the site owner (or a host) installs, patches and upgrades, with a plugin, module or extension ecosystem. WordPress, Drupal, Joomla and TYPO3 are free software; Craft CMS publishes its source under a commercial licence. |
Hosted website builders (SaaS) |
Webflow (documented on this site), Wix, Squarespace |
The vendor runs the servers, the editor and the upgrades; the owner configures a site inside the vendor’s product. |
Headless and API-first |
Content is stored and edited in the CMS and delivered through an API to a separate front end. Contentful and Sanity host the content store; Strapi and Payload are open-source applications that the owner can host. |
|
Enterprise and other stacks |
Adobe Experience Manager (AEM, enterprise context), Umbraco (.NET), Wagtail (Python and Django), Ghost (Node.js publishing) |
CMSs tied to a platform or a market: an enterprise suite, and three open-source systems for the .NET, Python and Node.js communities. |
Context rows. Shopify appears only in the market-share and performance charts, because W3Techs counts it as a content management system; it is compared with its competitors in the E-commerce Platforms Comparison and is not scored here. Drupal 7 and Joomla 3 appear only in the support-window chart, to show what the end of a major line looks like (Drupal 7 ended on 2025-01-05 and Joomla 3 on 2023-08-17).
Inclusion criteria. A system is included if it ranks in at least one main source (the W3Techs share of websites, the
HTTP Archive origins, the Stack Overflow Developer Survey, registry downloads or GitHub stars) or if it matters for
enterprise or historical context. WordPress and Webflow are always included. A system without public data for a metric
gets n/a for that metric: hosted SaaS products have no repository, registry or advisory data, and Payload is not a
technology in the HTTP Archive Tech Report, so it has no performance series and no origins count.
Out of scope. E-commerce platforms (Shopify, PrestaShop, Magento and WooCommerce, covered by the E-commerce Platforms Comparison; WooCommerce appears only as an extension of WordPress), static-site generators and documentation tools (see when you do not need a CMS), and the systems that were considered and left out for lack of reachable primary data or marginal rank: Statamic, Concrete CMS, Duda, HubSpot Content Hub, Directus, Storyblok, Hygraph, Sitecore, Optimizely CMS, Blogger, Tilda, Weebly, Movable Type and Plone. WordPress.com is covered as the hosted variant of WordPress, in the cost section only.
Snapshot date. All values were fetched on 2026-10-29, and every CSV row carries its own fetched column. Time series
end at the latest complete period at that date: 2026-09 for the HTTP Archive Tech Report, and 2026 to date for the
yearly series. A value that could not be obtained is shown as n/a, never as zero, and a value that came from a page
that could not be opened from the authoring environment, or from a secondary source, is marked unverified.
How metrics, scales and scores were assigned
Rules that apply throughout.
-
Absolute values from different sources are never plotted on one axis, because they count different things: W3Techs counts the share of websites among the sites it analyses, the HTTP Archive counts origins visited by Chrome users, and registries count downloads, which include continuous-integration and mirror traffic. Downloads from different registries (npm, Packagist, PyPI, NuGet) are never compared with each other.
-
Field data and counts are reported as measured. Where a number is a proxy (CVEs as a proxy for security, Stack Overflow questions as a proxy for community activity), the section says what it cannot show.
-
Colours identify a CMS inside its group: the palette has eight slots for sixteen systems, so a colour is consistent across the figures of one group, and figures that mix groups colour by group or say in their caption that colours are assigned by position in that figure.
-
A pair of numbers from different dates is never compared as if it were one series. INP (Interaction to Next Paint) replaced FID (First Input Delay) in the Core Web Vitals definition on 2024-03-12, so pass rates before and after that date are not strictly comparable, and the charts mark the break.
-
Stack Overflow’s site-wide decline since 2023 affects every tag, so question counts for recent years say little about a CMS on their own.
Scores. The radar charts and the scores table use twelve axes, each scored from 0 to 10 with
higher always better. Five axes are computed from the data by a formula implemented in scores.mjs, and seven are
editorial: a written rubric applied to cited evidence, with the basis and the source ids of every score recorded in
radar-scores.csv. A system whose inputs are missing gets no score, drawn as a gap and never as zero.
| Axis | Kind | Rule |
|---|---|---|
Popularity |
Computed |
Mean of the available log scores of the W3Techs share of all sites (0.01% scores 0, 50% scores 10) and of the HTTP Archive mobile origins (100 scores 0, 5,000,000 scores 10), latest values. It counts visible fingerprints, so headless CMSs are underestimated; Payload has neither input and gets no score. |
Growth |
Computed |
Ratio of the latest HTTP Archive mobile origins to the same month three years earlier: 5 plus 5 times the base-2 logarithm of the ratio, limited to 0 to 10 (unchanged is 5, doubled is 10, halved is 0). No score without both months. |
Talent pool (Stack Overflow) |
Computed |
Log score of the Stack Overflow questions asked with the CMS tag in the last two complete years, 2024 and 2025 (10 questions score 0, 10,000 score 10). The axis measures developer activity only: the job-market signals of Talent pool and job market (survey usage, Hacker News job mentions) cover too few CMSs to score, so they are not part of it. |
Ecosystem and maturity |
Computed |
Mean of the available log scores of the GitHub stars of the main repositories (1,000 scores 0, 100,000 score 10; the WordPress, Drupal and TYPO3 mirrors excluded) and of the total Stack Overflow questions of the tag (100 scores 0, 300,000 score 10). Hosted systems have no repository, so only the second input counts. |
Performance |
Computed |
Mean of the mobile and desktop Core Web Vitals pass rates divided by 10 and of the mobile and desktop median Lighthouse performance scores times 10, latest HTTP Archive month. No score when one input is missing. |
Ease of use (editors) |
Editorial |
Can editors write, preview, schedule and approve without a developer; the visual building, draft preview, scheduling and workflow rows of the feature matrix are quoted in the basis. |
Ease of use (developers) |
Editorial |
Concepts to learn before a first custom template or content type, local setup, API and documentation; the content modelling, configuration-as-code and REST rows of the feature matrix are quoted. |
Features and productivity |
Editorial, rule-based |
Points per feature of the 19-row feature matrix (yes 1, by extension 0.7, partial 0.5, n/a 0) divided by 19, times 10. |
Low cost |
Editorial |
10 is free software with low hosting cost; lower for paid plans and licences. USD and EUR prices are not converted. No score where no sourced price exists (Contentful and AEM). |
Security posture |
Editorial |
Patching model, advisory process, severity and exploitation history, never raw CVE counts, which are not comparable between SaaS and self-hosted systems. |
Low maintenance effort |
Editorial |
10 is vendor-managed with no customer patching; lower for self-hosted systems with frequent major upgrades and short support windows. |
Portability (low lock-in) |
Editorial |
Licence, data format, export and the ability to change host. |
The scores summarise the evidence on this page. They are not a benchmark, and one point is within the uncertainty of the method.
Summary comparison table
The table has one row per CMS and the headline value of each metric. The sections that follow give the definition,
the source and the caveats of every column. Prices are the cheapest paid plan billed yearly, in US dollars per month,
unless stated; free software still needs hosting, extensions and development, so 0 is not a total cost. Core CVEs
are the NVD count for the core of the product by CPE match; hosted products fix their platform without CVEs, so their
cell is n/a (see why SaaS CVE counts are not comparable). The change in
three years compares the HTTP Archive mobile origins of 2026-09 with those of 2023-09.
| CMS | Hosting model and licence | Share of all sites | Mobile origins | Change in 3 years | CWV pass, mobile | Core CVEs 2025 | Entry price per month (USD unless stated) | Ease of use, editors |
|---|---|---|---|---|---|---|---|---|
Self-hosted or WordPress.com; GPL |
39.5% |
2,714,694 |
-21% |
48.3% |
0 |
0 (software); WordPress.com Personal 4 |
8 |
|
Self-hosted; GPL |
0.6% |
94,414 |
-33% |
64.7% |
8 |
0 (software) |
5 |
|
Self-hosted; GPL-2.0 |
1.1% |
84,613 |
-48% |
57.4% |
5 |
0 (software) |
5 |
|
Self-hosted; GPL-2.0 |
0.3% |
40,808 |
-14% |
80.3% |
24 |
0 (software) |
5 |
|
Self-hosted or Craft Cloud; commercial licence, public source |
0.1% |
10,507 |
-10% |
67.5% |
6 |
0 (Solo licence); Cloud Team 110 |
7 |
|
Hosted SaaS; proprietary |
0.8% |
60,687 |
+21% |
71.3% |
n/a |
Basic 15 (no CMS); Premium 25 |
7 |
|
Hosted SaaS; proprietary |
4.2% |
181,912 |
-20% |
80.9% |
n/a |
Light 17.77 |
9 |
|
Hosted SaaS; proprietary |
2.4% |
92,778 |
-7% |
71.0% |
n/a |
EUR 14.52 (Basic) |
9 |
|
Hosted SaaS API; proprietary |
n/a |
9,340 |
-22% |
38.1% |
n/a |
n/a (unverified) |
6 |
|
Self-hosted or Strapi Cloud; MIT |
n/a |
14 |
-48% |
28.6% |
4 |
0 (software); Cloud Starter 29 |
6 |
|
Hosted content store, open-source Studio |
n/a |
10,824 |
+228% |
52.4% |
n/a |
0 (Free); Growth 15 per seat |
7 |
|
Self-hosted; MIT |
n/a |
n/a |
n/a |
n/a |
0 |
0 (software) |
7 |
|
Adobe cloud service; proprietary |
n/a |
19,394 |
-10% |
33.9% |
377 |
n/a (quote only) |
5 |
|
Self-hosted or Umbraco Cloud; MIT |
n/a |
4,389 |
+74% |
76.4% |
13 |
0 (software); EUR 45 (Cloud Starter) |
6 |
|
Self-hosted; BSD-3-Clause |
n/a |
6,309 |
+61% |
62.4% |
1 (keyword search) |
0 (software) |
7 |
|
Self-hosted or Ghost(Pro); MIT |
0.1% |
2,997 |
-2% |
72.8% |
1 |
0 (software); Ghost(Pro) 15 |
8 |
Sources: W3Techs (share of all websites, 2026-10-29), HTTP Archive Tech Report (mobile origins and Core Web Vitals pass rate, 2026-09), NVD (CVEs), the vendor pricing pages and the editorial scores of this page. Payload has no HTTP Archive series, and Wagtail has only a keyword-search CVE series, so its cell is marked as such. Squarespace publishes euro prices (VAT included) and Wix prices include GST for the location of the fetch; Contentful pricing returned HTTP 429 to automated clients and is unverified.
Popularity
Popularity answers one question: how many websites run this CMS, and how much attention does it get from developers? No single source answers it, so the page uses four that count different things and never puts them on one axis: the W3Techs share of websites, the HTTP Archive count of origins, the activity of the developer ecosystem (GitHub, registries) and the questions asked on Stack Overflow. All of them count what can be seen from outside, which favours systems that leave a visible fingerprint in the page. A headless CMS serves content to a front end that shows no sign of it, so it is underestimated by W3Techs and the HTTP Archive; the popularity score of this page has that bias, and the registry downloads below are the better signal for headless products.
Market share
W3Techs reports the share of all websites it analyses and the share of the websites with a known CMS. WordPress is on
39.5% of all websites and on 58.3% of the websites with a known CMS, which is more than the other fifteen systems
and Shopify together. Wix (4.2%), Squarespace (2.4%) and Webflow (0.8%) lead the hosted builders, and Joomla (1.1%),
Drupal (0.6%), TYPO3 (0.3%) and Craft CMS (0.1%) are small shares of a very large denominator. W3Techs reports "less than
0.1%" for Umbraco, Strapi, Sanity and Wagtail, which is too small to give a number, and does not track Contentful as a
content management system; for AEM it tracks only the umbrella "Adobe Systems" (0.6% of all websites), so the AEM cells
are n/a.
| CMS | Share of all websites | Share of websites with a known CMS | Share of all websites on 1 January 2023 and 2025 |
|---|---|---|---|
39.5% |
58.3% |
43.1% and 43.6% |
|
0.6% |
0.9% |
1.2% and 0.9% |
|
1.1% |
1.6% |
1.8% and 1.6% |
|
0.3% |
0.5% |
n/a |
|
0.1% |
0.1% |
n/a |
|
0.8% |
1.2% |
0.6% and 0.8% |
|
4.2% |
6.2% |
2.4% and 3.3% |
|
2.4% |
3.6% |
2% and 2.2% |
|
n/a |
n/a |
n/a |
|
n/a |
n/a |
n/a |
|
n/a |
n/a |
n/a |
|
n/a |
0.1% |
n/a |
|
n/a |
n/a |
n/a |
|
n/a |
n/a |
n/a |
|
n/a |
n/a |
n/a |
|
0.1% |
0.1% |
n/a |
|
Shopify (context) |
5.3% |
7.9% |
3.8% and 4.7% |
Source: W3Techs, content management systems, 2026-10-29.
W3Techs publishes yearly history for the larger systems only, hence the n/a cells in the last column.
Figure 1: W3Techs share on 2026-10-29, as a share of all websites and of the websites with a known CMS, ordered by
share of all websites. The two bases differ, so compare bars within one base. Source: W3Techs. A CMS shown as n/a is
not reported by W3Techs, mostly headless and enterprise products that do not leave a visible fingerprint.
Detected origins
The HTTP Archive Tech Report counts the origins (websites visited by Chrome users) in which it detects each technology. It is a measure of visible use that covers the systems W3Techs does not report. In 2026-09 it detects 2,714,694 mobile origins on WordPress, 181,912 on Wix, 94,414 on Drupal, 92,778 on Squarespace, 84,613 on Joomla and 60,687 on Webflow. Payload is not a technology in the Tech Report, so it has no count.
| CMS | Mobile origins 2020-01 | Mobile origins 2023-09 | Mobile peak (month) | Mobile origins 2026-09 | Change in 12 months | Desktop origins 2026-09 |
|---|---|---|---|---|---|---|
1,036,502 |
3,449,912 |
3,471,900 (2023-08) |
2,714,694 |
-14% |
1,626,771 |
|
86,032 |
140,746 |
147,735 (2023-03) |
94,414 |
-16% |
85,562 |
|
73,985 |
163,632 |
184,492 (2022-08) |
84,613 |
-27% |
40,680 |
|
20,733 |
47,245 |
47,844 (2023-03) |
40,808 |
-7% |
23,614 |
|
3,513 |
11,685 |
11,876 (2025-02) |
10,507 |
-7% |
10,066 |
|
5,192 |
49,975 |
66,369 (2026-02) |
60,687 |
-6% |
53,797 |
|
27,226 |
227,182 |
234,844 (2023-08) |
181,912 |
-11% |
79,823 |
|
26,198 |
100,268 |
104,649 (2024-09) |
92,778 |
-8% |
73,064 |
|
2,361 |
12,013 |
12,596 (2023-11) |
9,340 |
-6% |
8,477 |
|
5 |
27 |
33 (2025-07) |
14 |
-42% |
6 |
|
n/a |
3,297 |
10,824 (2026-09) |
10,824 |
+70% |
10,036 |
|
10,853 |
21,669 |
21,864 (2023-10) |
19,394 |
+7% |
15,592 |
|
507 |
2,519 |
5,820 (2023-10) |
4,389 |
-11% |
4,173 |
|
n/a |
3,908 |
6,309 (2026-09) |
6,309 |
+15% |
4,437 |
|
510 |
3,063 |
3,397 (2024-10) |
2,997 |
-8% |
2,835 |
Source: HTTP Archive Tech Report, origins detected in the monthly crawl,
mobile unless stated, 2026-09 as the latest month. Origins are websites visited in the Chrome UX Report, not live
sites. Sanity and Wagtail have no series before 2021-06, so their 2020-01 cell is n/a.
The monthly series are charted in Growth trends, one chart per group.
Developer activity and downloads
GitHub stars and contributors measure the interest of developers in an open-source CMS. They are not usage, and
the main repository of some systems is a read-only mirror: the WordPress repository is a mirror of the Subversion
repository (21,509 stars, and 3,496 more on the wordpress-develop repository where core development happens), and the
Drupal and TYPO3 repositories are mirrors of their own Git hosts. Hosted SaaS products (Webflow, Wix, Squarespace,
Contentful) and AEM are closed and have no repository (n/a). The leaders are Strapi (73,401 stars, 1,412 contributors),
Ghost (55,630 and 943) and Payload (45,570 and 592), the Node.js CMSs, followed by WordPress (mirror), Wagtail (20,594
and 1,125), Sanity (6,380), Umbraco (5,278 and 1,215), Joomla (5,157 and 1,210), Drupal (4,295, mirror), Craft CMS
(3,621) and TYPO3 (1,218 stars, mirror, and 1,289 contributors).
Figure 2: GitHub stars of the main repository of each open-source CMS on 2026-10-29, coloured by group. Source: GitHub REST API. Mirrors understate the interest in WordPress, Drupal and TYPO3.
Figure 3: GitHub contributors (anonymous and unlinked authors included) of the main repository of each open-source CMS on 2026-10-29. Source: GitHub REST API. The WordPress, Drupal and TYPO3 repositories are mirrors where much of the work happens elsewhere, so their counts are low or high for reasons that do not measure the community.
Registry downloads are comparable only inside one registry, so they are charted separately. On Packagist, the
registry of the PHP CMSs that install with Composer, the last 30 days show 1,665,725 installs of Drupal core, 495,192 of
TYPO3 core and 67,602 of Craft CMS; since the first release the totals are 71,617,710, 14,884,682 and 3,830,437, and
1,640, 4,315 and 2,948 other packages require them. WordPress and Joomla are distributed from their own sites
and are not counted in Packagist (n/a).
Figure 4: Packagist installs in the last 30 days (2026-10-29). Source: Packagist. Counts are only comparable between Packagist packages: WordPress, Joomla, Webflow and Wix are not Composer packages.
On npm, Payload and Sanity downloads grow fastest. Yearly downloads of payload rose from 803,016 in 2023 to
6,259,371 in 2025 and 20,715,481 in 2026 to date; those of sanity from 2,870,512 to 10,406,353 and 28,152,851;
contentful from 25,198,810 to 41,765,693 and 49,494,049; @strapi/strapi is flat at 7,724,800 in 2025 and 7,685,201 in 2026
to date; and ghost stays below 600,000 a year. The counts include continuous-integration and mirror traffic, and the
Contentful and Sanity packages are client libraries used by sites built on those hosted services, which is the best
public sign of their use. For the other registries, Umbraco has 8,279,262 cumulative downloads on
NuGet and Wagtail 586,863 PyPI downloads in the last 30 days (PyPI Stats
keeps only about 180 days of history, so there is no yearly series); neither is comparable with npm or Packagist.
Figure 5: yearly npm downloads of the main package of Strapi, Payload, Sanity, Contentful and Ghost, 2020 to 2026 to date. Source: npm downloads API. Colours are assigned by position in this figure, and the 2026 value is a year to date.
The WordPress ecosystem is counted on its own registry: WordPress.org lists 73,152 plugins and 8,799 themes on 2026-10-29 (WordPress.org plugins API, a live count that drifts).
Community questions
Stack Overflow tags show where developers ask for help. WordPress has 189,983 questions in total, against 20,266 for Drupal, 15,003 for Joomla, 10,432 for Wix, 9,752 for TYPO3, 5,003 for AEM, 4,499 for Umbraco and 2,800 for Strapi. The counts per year show the site-wide decline since 2023 rather than the fate of a CMS: WordPress fell from 13,512 questions in 2020 to 5,286 in 2023 and 613 in 2025, Drupal from 411 to 183 and 40, and every other tag followed. The dedicated Stack Exchange sites show the same fall (wordpress.stackexchange.com: 7,268 in 2020, 2,328 in 2023, 468 in 2025). The 2026 values are a partial year and are omitted from the charts.
Figure 6: Stack Overflow questions per year for the traditional open-source CMSs, 2018 to 2025. Source: Stack Exchange API. Every tag falls from 2023, mirroring the decline of the whole site.
Figure 7: Stack Overflow questions per year for the hosted builders, 2018 to 2025. Source: Stack Exchange API.
Figure 8: Stack Overflow questions per year for the headless CMSs, 2018 to 2025. Source: Stack Exchange API. Payload is the only tag whose yearly questions rose between 2023 (14) and 2025 (31).
Figure 9: Stack Overflow questions per year for the enterprise and other-stack CMSs, 2018 to 2025. Source: Stack Exchange API.
Reading the popularity data
WordPress leads every signal that counts websites by a wide margin: about 40% of all websites, 58% of those with a known CMS and about 2.7 million detected mobile origins, 15 times more than the next system. Wix is a distant second, then Drupal, Squarespace, Joomla and Webflow in the same order of magnitude. Among developers the leaders are different: the Node.js CMSs (Strapi, Ghost, Payload) lead GitHub stars, and Contentful, Sanity and Payload lead the growth of npm downloads. Popularity should be read together with the next section: the origins of most systems peaked before 2025.
Growth trends
Growth is measured with the yearly W3Techs share and the monthly HTTP Archive origins. The two series agree on direction for the systems they share, and they show that the market is consolidating around WordPress and the hosted builders at the top while the older open-source systems decline.
The yearly W3Techs share of all websites shows WordPress rising from 23.3% in 2015 to 43.6% in 2025 and then falling to 39.5% in 2026-10, the first fall in the series. Wix rose from 0.1% to 4.2% and Squarespace from 0.2% to 2.4% (Shopify, as context, from 0.3% to 5.3%), and Webflow from 0.1% in 2019 to 0.8%. Joomla fell from 3.3% in 2015 to 1.1% and Drupal from 2.0% to 0.6%.
Figure 10: W3Techs share of all websites on 1 January of each year from 2015 and on 2026-10-29. Source: W3Techs. Shopify is market-share context only. Colours are assigned by position in this figure.
The HTTP Archive series start in 2020-01, when the crawl counted 1,036,502 WordPress mobile origins, and peaked in 2023 and later. Between 2023-09 and 2026-09 most systems lost origins: Joomla -48%, Drupal -33%, Contentful -22%, WordPress -21%, Wix -20%, TYPO3 -14%, AEM -10%, Craft CMS -10%, Squarespace -7% and Ghost -2%. Webflow gained +21%, Sanity +228%, Umbraco +74% and Wagtail +61%. These origin counts depend on the crawl population as well as on real adoption, so read them as relative trends. Strapi has 14 mobile origins (27 in 2023-09) and the percentages of such small counts say little.
Figure 11: mobile origins detected for the traditional open-source CMSs, monthly, 2020-01 to 2026-09. Source: HTTP Archive Tech Report. WordPress peaked in 2023-08 (3,471,900), Drupal in 2023-03 (147,735) and Joomla in 2022-08 (184,492); the desktop crawl shows the same trends.
Figure 12: mobile origins detected for the hosted builders, monthly, 2020-01 to 2026-09. Source: HTTP Archive Tech Report. Webflow rose from 5,192 to 66,369 in 2026-02 before slipping to 60,687; Wix peaked in 2023-08 (234,844) and Squarespace in 2024-09 (104,649).
Figure 13: mobile origins detected for the headless CMSs, monthly, 2020-01 to 2026-09. Source: HTTP Archive Tech Report.
Payload is not a technology in the Tech Report (n/a). Sanity grows steadily from 154 in 2021-06 to 10,824, while
Contentful peaked in 2023-11 (12,596) and Strapi is almost invisible.
Figure 14: mobile origins detected for the enterprise and other-stack CMSs, monthly, 2020-01 to 2026-09. Source: HTTP Archive Tech Report. Wagtail (6,309) reached its peak in the last month, Umbraco peaked in 2023-10 (5,820) and Ghost in 2024-10 (3,397).
Popularity against growth. The scatter chart combines the two computed scores (popularity on the horizontal axis, growth on the vertical axis), coloured by group. The upper right is established and rising, the lower right is established and shrinking, and the upper left is small and rising.
Figure 15: computed popularity (log-scaled W3Techs share and HTTP Archive origins) against computed growth (change in mobile origins over three years; 5 is unchanged, 10 is doubled), coloured by group. Sources: W3Techs and HTTP Archive Tech Report, formulas in How metrics, scales and scores were assigned. Payload has no score on either axis and is not plotted.
The reading is as follows.
-
Established and large: WordPress (popularity 9.6, growth 3.3) and Wix (7.0 and 3.4) are the most visible, and both have lost origins since 2023.
-
Established and shrinking: Joomla (5.9 and 0.2) and Drupal (5.6 and 2.1) combine a large installed base with the weakest growth of the group.
-
Rising from a small base: Sanity (4.3 and 10.0), Umbraco (3.5 and 9.0) and Wagtail (3.8 and 8.5) have the highest growth scores, and Webflow (5.5 and 6.4) is the only system that is both widely deployed and growing.
-
Visible fingerprint, little growth: TYPO3 (4.8 and 3.9), Craft CMS (3.5 and 4.2), Squarespace (6.4 and 4.4), AEM (4.9 and 4.2) and Ghost (2.9 and 4.8) are stable.
-
Contentful (4.2 and 3.2) and Strapi (0.0 and 0.3) are underestimated by this method because headless products leave little trace on the pages they serve; their npm and GitHub figures above tell a different story for Strapi.
Talent pool and job market
The size of the talent pool decides how easy it is to hire a developer or an agency. Public data on it is thin, and the page uses what exists, labelled with its limits.
Developer survey. The Stack Overflow Developer Survey lists only a few CMSs under web frameworks and technologies:
WordPress, Drupal and (in 2024 only) Strapi. Joomla, TYPO3, Craft CMS, the hosted builders, Contentful, Sanity, Payload, AEM,
Umbraco, Wagtail and Ghost are not answer options in 2023 to 2026 (n/a). The share of respondents who did extensive
development work with WordPress was 13.38% in 2023, 11.8% in 2024, 13.61% in 2025 and 13.3% in 2026; for Drupal it was
1.87%, 1.9%, 2.22% and 2.0%; Strapi had 1.7% in 2024. Among professional developers the figures are close
(WordPress 12.59% in 2023, 11.1% in 2024 and 12.38% in 2025; Drupal 1.85%, 1.9% and 2.07%; the 2026 professional
breakdown is not published). The share of users who want to use it again (admired) was 26.5% for WordPress in 2026,
down from 34.5% in 2024, and 37.7% for Drupal, up from 25.69% in 2023; Strapi was 43.4% admired in 2024. The survey
sample shrank from 71,802 respondents to the web frameworks question in 2023 to 10,281 in 2026, so shares are less precise
in the later years.
Figure 16: share of Stack Overflow Developer Survey respondents who did extensive development work with the CMS in the past year, 2023 to 2026. Source: Stack Overflow Developer Survey. Only these CMSs are listed; Strapi appears in 2024 only. Colours are assigned by position in this figure.
Job demand. The share of the "Ask HN: Who is hiring?" posts on Hacker News that mention each CMS is a demand proxy biased to startups. In 2025, WordPress was mentioned by 14 of 4,032 top-level comments (0.35%), Webflow by 12 (0.3%), Wix by 2 (0.05%) and Drupal, TYPO3, Squarespace and Sanity by 1 each; Joomla, Craft CMS, Contentful, Strapi, Payload, AEM, Umbraco, Wagtail and Ghost had none. In 2026 to date (2,933 comments in 10 threads), Squarespace has 3 mentions (0.1%), Wix 2 (0.07%), and Webflow and Sanity 1 each, and WordPress has none. The series is too sparse for a score and the talent-pool score uses Stack Overflow questions instead.
Figure 17: share of the "Who is hiring?" comments on Hacker News that mention each CMS, per year, 2018 to 2025. Source: Hacker News Algolia search API. It is a demand proxy biased to startups, and mentions stay below about half a percent of postings.
Certification and partner programmes. They signal how easy it is to hire an agency. Both a certification and a partner
programme exist for TYPO3 (certified consultant, developer, integrator and editor, plus official partners), Webflow
(Webflow University certifications and the Webflow Certified Partner programme), Umbraco (training certification in three
tiers, and partners), Sanity (Sanity Learn certifications and agency partners) and Adobe (Adobe Certification and the
Adobe Partner Program, neither specific to AEM). Joomla has a certification exam (Certification Administrator) but no
partner programme page. Craft CMS (Craft Verified partners), Strapi, Payload, Wix (Wix Studio Partner Program),
Squarespace (Squarespace Circle) and Ghost (the Ghost Experts directory) have partner programmes and no certification
page. Drupal’s certification is run by the vendor Acquia, not by the Drupal Association, and its partner programme page
could not be opened (unverified). WordPress has free training on Learn WordPress but no certification or partner
programme page, and Wagtail has neither. Contentful’s pages were unreachable (HTTP 429, unverified). Salary by CMS is not
published by any source used here (n/a).
Stacks and hiring. A CMS shares its language and framework with a wider talent pool. The PHP CMSs draw on the developers described in PHP and Laravel, Wagtail on those of Django, Umbraco on those of ASP.NET, and the headless front ends of Contentful, Sanity, Strapi and Payload usually on Next.js and React developers; the language-level context is in the programming languages comparison.
The talent-pool scores computed from Stack Overflow questions in 2024 and 2025 are 8.4 for WordPress, 5.0 for TYPO3, 4.8 for Strapi, 4.6 for Wix, 3.9 for Drupal and 3.8 for Wagtail, and at most 2.8 for the others; Ghost scores 0.0 and Craft CMS 0.1 because they had almost no tagged questions. WordPress has by far the largest pool of developers and agencies, and Webflow has the clearest dedicated certification and partner path.
Ease of use and learning curve
A CMS has three audiences with different needs, so ease of use is scored twice: for content editors (can they write,
preview, schedule and approve without a developer) and for developers (how many concepts to learn before a first custom
template or content type, how easy is the local setup, how good are the API and documentation). Both scores are editorial,
on a 0 to 10 scale with a written basis per system in radar-scores.csv, and both quote the rows of the
feature matrix they rely on. They are judgements on cited evidence, not user-study results, and
review-site ratings (G2, Capterra) are not used because they are self-selected reviews.
| CMS | Editors | Developers | Basis (abridged) |
|---|---|---|---|
8 |
6 |
Block editor and site editor in core, scheduling, revisions and preview built in, and the most familiar editing interface; developers get PHP with hooks and a large documentation base, but legacy global APIs and block development that needs React. |
|
5 |
4 |
Powerful workflows and Layout Builder but an administration interface with a steep learning curve; a Symfony-based system with many concepts (entities, plugins, services, configuration management). |
|
5 |
5 |
A conventional article manager with revisions and roles but a dated editing experience; PHP MVC with its own conventions and less community material. |
|
5 |
4 |
A mature backend with workspaces and fine-grained rights, where editors need training; Extbase, TypoScript and Fluid make a steep curve with fewer learning resources. |
|
7 |
8 |
Clean entry editing with live preview and drafts, modelled per project by developers; Yii and Twig with clear documentation, element queries and a CLI. |
|
7 |
6 |
A visual Designer plus an in-canvas Editor for content, with partial revisions; little code is needed, but the Data API, Designer API and custom code are limited by the platform. |
|
9 |
6 |
A drag-and-drop editor with templates, the most guided editing experience of the set; Velo (JavaScript) and an app SDK inside a closed platform. |
|
9 |
5 |
Template-based drag-and-drop editing with limited content modelling; templates and a developer platform with limited extensibility. |
|
6 |
7 |
A structured-content editor with roles and localisation, with no built-in front-end preview; REST, GraphQL and SDKs for many languages with good documentation, and the front end is the developer’s job. |
|
6 |
8 |
A Content Manager with draft and publish and review workflows that depend on the plan; Node.js with generated REST and GraphQL APIs, a CLI and TypeScript support. |
|
7 |
8 |
A customisable real-time Studio, which editors depend on a developer to build; schema as code, the GROQ query language and TypeScript SDKs with good tutorials. |
|
7 |
8 |
A modern administration panel with live preview and drafts, with configuration defined in code; TypeScript, Next.js-native, with a local API. |
|
5 |
3 |
Enterprise authoring with Experience Fragments and approvals, with heavy setup and training; Java, OSGi, Sling and Maven, which need specialist skills. |
|
6 |
7 |
A backoffice with block editors and scheduling, where editors depend on developer-defined document types; ASP.NET Core with strong documentation and ordinary .NET tooling. |
|
7 |
8 |
A StreamField page editor with previews, workflow and scheduling; Django with clear documentation and conventions, easy for Python developers. |
|
8 |
7 |
A focused publishing editor with memberships and newsletters, narrow by design; Node.js with Handlebars themes and a Content and an Admin API. |
Source: the feature rows of features.csv and the vendor documentation listed in the Bibliography;
scores of 2026-10-29.
The pattern is the usual trade-off between the audiences. The hosted builders Wix and Squarespace (9) and Ghost and WordPress (8) are the easiest for editors, and the headless and code-first systems (Strapi, Sanity, Payload, Wagtail, Craft CMS, all 8) are the easiest for developers, but their editors depend on the Studio or the admin panel that a developer builds. Drupal, TYPO3 and AEM ask the most of both audiences. The scatter chart in Performance plots the developer score against performance.
For the learning path of each documented system, see the WordPress introduction and architecture and the Webflow introduction and architecture.
Ecosystem and maturity
Ecosystem and maturity is a computed score: the mean of the log score of the GitHub stars of the main repository (1,000 scores 0, 100,000 scores 10) and of the log score of the total Stack Overflow questions of the tag (100 scores 0, 300,000 scores 10). The WordPress, Drupal and TYPO3 repositories are read-only mirrors whose stars understate their communities, so for those three only the Stack Overflow part counts. The score rewards developer attention and accumulated community knowledge, which is a sign of maturity, and it undervalues hosted systems that have no repository. The scores are WordPress 9.4, Strapi 6.8, Drupal 6.6, Wix 5.8, TYPO3 5.7, Ghost 5.4, Wagtail 5.3, Joomla 5.0, AEM 4.9, Payload 4.2, Umbraco 4.2, Sanity 3.3, Contentful 2.7, Squarespace 2.6, Craft CMS 2.0 and Webflow 1.1; the last two figures show the limit of the method, because Webflow’s extension ecosystem is a closed marketplace that a repository count cannot see.
The ecosystem a project depends on is better described by what exists around the core:
-
Extensions: WordPress.org lists 73,152 plugins and 8,799 themes (2026-10-29, official count, a live figure). The directories of the other systems (Drupal modules, the Joomla Extensions Directory, the TYPO3 Extension Repository, the Craft Plugin Store, the Umbraco Marketplace, the Webflow Marketplace, the Wix App Market) were not counted from a primary source, so their sizes are
n/aand are not estimated. On Packagist, 1,640, 4,315 and 2,948 packages require Drupal core, TYPO3 core and Craft CMS respectively, a measure of third-party code built on each. -
Managed hosting and cloud offers: WordPress.com (Free to Commerce plans, 0 to 70 USD per month billed monthly), Craft Cloud, Strapi Cloud, Umbraco Cloud, Ghost(Pro), the Webflow site plans and the Wix and Squarespace plans; Payload Cloud shows no public price (
n/a) and Contentful’s pricing was unreachable. -
Licences and business model: WordPress (GPL), Drupal (GPL), Joomla (GPL-2.0) and TYPO3 (GPL-2.0) are free software; Strapi, Payload, Umbraco and Ghost are MIT-licensed and Wagtail is BSD-3-Clause, each with a paid cloud or enterprise offer; Craft CMS publishes its source under the Craft License and needs a commercial licence for Team and Pro projects; Sanity’s Studio is open source but its content store is a hosted service; Webflow, Wix, Squarespace, Contentful and AEM are proprietary.
-
Current lines and support: WordPress 7.1, Drupal 11, Joomla 6, TYPO3 14 LTS, Craft CMS 5, Strapi 5, Ghost 6, Umbraco 17 LTS and Wagtail 7.4 LTS, with dated windows in Support windows. Drupal 7 (ended 2025-01-05) and Joomla 3 (ended 2023-08-17) are the cautionary tales of the previous generation.
For the platform stacks, see PHP and Laravel (the PHP CMSs), Django (Wagtail), ASP.NET (Umbraco) and Next.js (headless front ends).
Features and productivity
Feature matrix
The matrix has one row per capability and one column per CMS. yes means the capability is in the product or its
official components, ext. means it needs an extension, plugin or module, part. means it is partial or depends on the
plan, and n/a means that no official page opened on 2026-10-29 states it, so it is neither asserted nor denied. Every cell
has a source and a note in features.csv. The AI row is vendor-reported. The matrix has 19 rows, and the first table covers the
traditional open-source CMSs and the hosted builders, the second the headless, enterprise and other-stack systems.
| Feature | WordPress | Drupal | Joomla | TYPO3 | Craft CMS | Webflow | Wix | Squarespace |
|---|---|---|---|---|---|---|---|---|
Content modelling (custom types and fields) |
yes |
yes |
yes |
yes |
yes |
yes |
part. |
n/a |
Visual or page building |
yes |
yes |
n/a |
part. |
part. |
yes |
yes |
yes |
Headless delivery: REST API |
yes |
yes |
yes |
n/a |
n/a |
yes |
yes |
part. |
Headless delivery: GraphQL |
ext. |
n/a |
n/a |
n/a |
yes |
n/a |
n/a |
n/a |
Draft preview |
yes |
part. |
n/a |
yes |
yes |
yes |
n/a |
n/a |
Webhooks |
ext. |
n/a |
n/a |
yes |
n/a |
yes |
n/a |
part. |
Multilingual content |
ext. |
yes |
yes |
yes |
yes |
yes |
n/a |
n/a |
Multisite or multi-brand |
yes |
yes |
n/a |
yes |
yes |
n/a |
n/a |
n/a |
Workflow, roles and permissions |
part. |
yes |
yes |
yes |
yes |
part. |
part. |
part. |
Revisions and versioning |
yes |
yes |
yes |
yes |
yes |
part. |
n/a |
n/a |
Scheduled publishing |
yes |
n/a |
n/a |
part. |
yes |
yes |
n/a |
n/a |
Forms |
ext. |
part. |
part. |
yes |
ext. |
yes |
yes |
n/a |
SEO tooling |
ext. |
part. |
part. |
yes |
ext. |
yes |
yes |
yes |
Media management and image optimisation |
part. |
yes |
part. |
yes |
yes |
n/a |
n/a |
n/a |
Accessibility checker |
ext. |
n/a |
yes |
n/a |
n/a |
part. |
n/a |
n/a |
ext. |
n/a |
n/a |
n/a |
ext. |
yes |
yes |
yes |
|
AI features and agent integration (vendor-reported, see MCP) |
part. |
n/a |
n/a |
n/a |
n/a |
yes |
part. |
yes |
Developer tooling: CLI and configuration as code |
part. |
yes |
part. |
yes |
yes |
part. |
part. |
part. |
Content export |
yes |
part. |
n/a |
yes |
part. |
part. |
n/a |
n/a |
| Feature | Contentful | Strapi | Sanity | Payload | AEM | Umbraco | Wagtail | Ghost |
|---|---|---|---|---|---|---|---|---|
Content modelling (custom types and fields) |
yes |
yes |
yes |
yes |
yes |
yes |
yes |
part. |
Visual or page building |
n/a |
part. |
part. |
part. |
n/a |
part. |
part. |
part. |
Headless delivery: REST API |
yes |
yes |
yes |
yes |
yes |
yes |
yes |
yes |
Headless delivery: GraphQL |
n/a |
ext. |
yes |
yes |
yes |
n/a |
ext. |
n/a |
Draft preview |
yes |
yes |
yes |
yes |
part. |
yes |
part. |
n/a |
Webhooks |
n/a |
yes |
yes |
part. |
n/a |
yes |
n/a |
yes |
Multilingual content |
n/a |
yes |
yes |
yes |
part. |
yes |
yes |
part. |
Multisite or multi-brand |
n/a |
n/a |
n/a |
ext. |
n/a |
yes |
yes |
n/a |
Workflow, roles and permissions |
n/a |
part. |
part. |
part. |
part. |
part. |
yes |
part. |
Revisions and versioning |
n/a |
part. |
part. |
yes |
n/a |
n/a |
yes |
n/a |
Scheduled publishing |
n/a |
part. |
part. |
yes |
yes |
yes |
yes |
n/a |
Forms |
n/a |
n/a |
n/a |
ext. |
n/a |
ext. |
yes |
n/a |
SEO tooling |
n/a |
n/a |
n/a |
ext. |
n/a |
n/a |
part. |
yes |
Media management and image optimisation |
n/a |
part. |
yes |
yes |
n/a |
n/a |
yes |
part. |
Accessibility checker |
n/a |
n/a |
n/a |
n/a |
n/a |
n/a |
yes |
n/a |
n/a |
n/a |
n/a |
ext. |
n/a |
ext. |
n/a |
n/a |
|
AI features and agent integration (vendor-reported, see MCP) |
yes |
yes |
yes |
yes |
n/a |
n/a |
part. |
n/a |
Developer tooling: CLI and configuration as code |
yes |
yes |
yes |
yes |
part. |
part. |
part. |
part. |
Content export |
yes |
yes |
yes |
yes |
n/a |
part. |
n/a |
yes |
Source: the official documentation and pricing pages of each system, as listed per row in features.csv
(WordPress, Webflow, Strapi,
Sanity, Payload, Wagtail
and the others), 2026-10-29.
Four rows need a comment.
-
Content modelling. Every system except Wix (partial), Squarespace (
n/a) and Ghost (partial) offers custom content types and fields. WordPress has custom post types in core but needs code or a plugin for custom fields. -
AI features and agent integration. Webflow, Squarespace, Contentful, Strapi, Sanity and Payload report an MCP server or an equivalent AI integration; WordPress has the Abilities API and the MCP Adapter as project components (partial), Wix lists AI agents and tools in its plan comparison, and Wagtail has the Wagtail AI package. See the WordPress Abilities API and MCP Adapter, the Webflow MCP server and AI agents and the Model Context Protocol section for what MCP is. These are vendor claims, not measurements.
-
Accessibility checker. This row is about the tools in the editor, not the accessibility of the pages a CMS produces, which depends on the theme, the components and the content. Joomla (Jooa11y) and Wagtail (a built-in content checker) have one in core, Webflow has audit tooling in the Designer (partial), WordPress needs a plugin, and no official page states the capability for the others (
n/a). See the accessibility guide for how to build and check accessible pages, and the Webflow accessibility page. -
E-commerce. Webflow, Wix and Squarespace have it built in, WordPress, Craft CMS, Payload and Umbraco by extension (WooCommerce on WordPress), and the rest have none stated. E-commerce platforms are compared in the E-commerce Platforms Comparison.
Features score. The editorial score is rule-based: yes earns 1 point, ext. 0.7, part. 0.5 and n/a nothing, divided by 19 and scaled to 10. It ranks Payload 8.1, WordPress 7.8, Webflow 7.1, Craft CMS 6.9, Wagtail 6.9, TYPO3 6.8, Sanity 6.3, Strapi 5.9, Drupal 5.8, Umbraco 5.5, Joomla 4.2, Wix 3.7, Ghost 3.7, and Contentful, Squarespace and AEM 3.2. The score measures the evidence that was found, so a low score for AEM or Contentful means that no official page opened and not that the products lack the capability, and the scope of the products differs: Ghost is a publishing platform by design and the hosted builders deliberately leave out multisite and configuration as code.
Reference site. The size of one small reference site (a home page, a blog with categories, a contact form and one custom
content type) built from official starters, as a count of steps or lines of code, was not measured for this
comparison: the column is n/a and no house measurement is used anywhere on this page.
For WordPress and Webflow, the headless and portability options are described in the headless WordPress page and the Webflow Content Delivery API and headless page.
Performance
What it measures. The Core Web Vitals pass rate is the share of the origins detected for a CMS in which at least 75% of real Chrome page loads are good on all three vitals: Largest Contentful Paint (LCP), Interaction to Next Paint (INP) and Cumulative Layout Shift (CLS). It comes from the HTTP Archive Tech Report, which combines the technology detection of the crawl with the Chrome UX Report field data. The median Lighthouse performance score is a lab score (0 to 100) of the same origins from the monthly crawl under a throttled test profile, so it is lower than the real-user experience on fast devices. Both describe populations of sites, not the product in a controlled test.
Caveats. Field data is per origin, not a benchmark: it reflects themes, plugins, hosting and audiences as much as the
CMS. INP replaced FID on 2024-03-12, so the series are not strictly comparable across that date, and every chart marks
the break. Small or shrinking populations can be biased by survivor effects, and Strapi, with 14 mobile origins, has
percentages that say little. A headless CMS does not decide the performance of the site it feeds: the front end does,
so the numbers for Contentful, Strapi and Sanity describe the sites that happen to be detected, and the choice of
front end is discussed in the Web Frameworks Comparison. API latency and rate limits
published by the headless vendors were not collected for this page (n/a), and no house measurement is used.
Core Web Vitals over time
Every group improved a great deal since 2020-01. On mobile, the WordPress pass rate rose from 13.90% in 2020-01 to 34.71% in 2023-09 and 48.32% in 2026-09, the Webflow rate from 31.91% to 53.71% and 71.31%, the Drupal rate from 27.41% to 53.13% and 64.66%, and the Wix rate from 3.00% to 55.70% and 80.90%. Desktop rates are higher for most systems.
Figure 18: Core Web Vitals pass rate on mobile for the traditional open-source CMSs, monthly, 2020-01 to 2026-09. Source: HTTP Archive Tech Report. A dashed line marks 2024-03, when INP replaced FID.
Figure 19: Core Web Vitals pass rate on desktop for the traditional open-source CMSs, monthly. Source: HTTP Archive Tech Report.
Figure 20: Core Web Vitals pass rate on mobile for the hosted builders, monthly. Source: HTTP Archive Tech Report.
Figure 21: Core Web Vitals pass rate on desktop for the hosted builders, monthly. Source: HTTP Archive Tech Report.
Figure 22: Core Web Vitals pass rate on mobile for the headless CMSs, monthly. Source: HTTP Archive Tech Report. Payload has no
series (n/a), and the Strapi series rests on a handful of origins.
Figure 23: Core Web Vitals pass rate on desktop for the headless CMSs, monthly. Source: HTTP Archive Tech Report.
Figure 24: Core Web Vitals pass rate on mobile for the enterprise and other-stack CMSs, monthly. Source: HTTP Archive Tech Report. Wagtail has no series before 2021-06.
Figure 25: Core Web Vitals pass rate on desktop for the enterprise and other-stack CMSs, monthly. Source: HTTP Archive Tech Report.
Current pass rate and Lighthouse
In 2026-09, Wix (80.90%) and TYPO3 (80.33%) lead the mobile pass rate, followed by Umbraco (76.39%), Ghost (72.78%), Webflow (71.31%) and Squarespace (71.00%); Craft CMS (67.53%), Drupal (64.66%), Wagtail (62.37%) and Joomla (57.43%) are in the middle; Sanity (52.36%), WordPress (48.32%), Contentful (38.10%), AEM (33.89%) and Strapi (28.57%) trail. On desktop the leaders are Wix (87.15%), Webflow (82.57%) and Squarespace (76.07%), and the lowest are AEM (44.31%), Strapi (50.00%), WordPress (53.75%) and Contentful (55.51%). For context, Shopify has 76.25% on mobile and 79.50% on desktop.
Figure 26: share of origins passing all Core Web Vitals in 2026-09, mobile and desktop. Source: HTTP Archive Tech Report.
Payload has no series (n/a).
The median Lighthouse performance score on mobile is highest for Ghost (65), Webflow (62.5) and Wix (61), then Strapi (55) and Sanity (51.5); WordPress scores 43, Joomla 42.5 and Squarespace 30, the lowest, with AEM (33). On desktop Wix and Ghost (79.5), Webflow (70.5) and Drupal (69.5) lead, and Strapi (55) and AEM (57) are lowest. The lab score and the field pass rate disagree for some systems, for example Squarespace (a good field pass rate and the lowest mobile lab score), which is why the performance score of the radar charts averages both.
Figure 27: median Lighthouse performance score (0 to 100) in 2026-09, mobile and desktop. Source: HTTP Archive Tech Report.
Lab scores come from a throttled profile, and Payload has no series (n/a).
Figure 28: median Lighthouse performance score on mobile for seven CMSs, monthly, 2020-01 to 2026-09. Source: HTTP Archive Tech Report. Lab scores are low for every CMS; compare the direction of each line. Colours are assigned by position in this figure. Between 2020-01 and 2026-09 WordPress rose from 25 to 43, Drupal from 27 to 47.5, Joomla from 19 to 42.5, Webflow from 31 to 62.5, Wix from 27 to 61, Squarespace from 11 to 30 and Ghost from 39 to 65.
Good LCP, INP and CLS
The three vitals separate the systems very unevenly. The share of origins with a good LCP is the discriminating one: on mobile it ranges from 90.17% for TYPO3 and 87.83% for Umbraco to 55.41% for WordPress, 52.28% for AEM and 42.86% for Strapi. INP and CLS are good for most origins of most systems, except for Contentful, Strapi, Sanity and AEM: on mobile, a good INP is found in 66.82% of the AEM origins, 70.27% of Contentful, 72.73% of Strapi and 75.78% of Sanity, against 85.26% to 97.33% for the other systems, and a good CLS in 50.00% of the Strapi origins and 68.35% of the Contentful origins. LCP is the vital that WordPress origins fail most often (a good LCP on 55.41% of the mobile origins and 69.25% of the desktop ones, the lowest desktop value of the traditional group), which is why the WordPress performance and caching page and the media optimization guide on images and loading are the first things to check on a slow site.
Figure 29: share of mobile origins with a good LCP, INP and CLS in 2026-09. Source: HTTP Archive Tech Report. Payload has no
series (n/a).
Figure 30: share of desktop origins with a good LCP, INP and CLS in 2026-09. Source: HTTP Archive Tech Report.
Performance against ease of use
The scatter chart puts the editorial ease-of-use score for developers (horizontal axis) against the computed performance score (vertical axis, from the pass rates and Lighthouse scores), coloured by group. A CMS with no performance series is not plotted.
Figure 31: ease of use for developers (editorial) against performance (computed from the HTTP Archive Tech Report), coloured by group. Payload has no performance series and is not plotted.
The performance scores are Webflow 7.2, Wix 7.7, Ghost 7.0, TYPO3 6.8, Umbraco 6.4, Drupal 6.2, Craft CMS 6.2, Wagtail 6.1, Sanity 6.0, Squarespace 5.9, Joomla 5.5, WordPress 5.2, Contentful 4.9, Strapi 4.7 and AEM 4.2. There is no strong relation between the two axes: the hosted builders and Ghost are the fastest, the code-first headless systems are the easiest for developers but not the fastest, and the systems that are the most demanding for developers (TYPO3, Drupal) perform above WordPress. The hosted builders deliver performance by controlling the whole stack; for self-hosted systems, performance is a result of hosting, caching and image handling that the owner has to provide.
Security
What the data can and cannot show. CVE counts measure disclosure, not real risk: a project with a mature security team and a large ecosystem publishes many CVEs, and a project that fixes silently publishes few. The sections below use four kinds of evidence: the CVEs published per year in the National Vulnerability Database (NVD), the advisories of the projects themselves, notable incidents with their CVSS score and their entry in the CISA Known Exploited Vulnerabilities (KEV) catalogue, and the patching model of each product. The security score of the radar charts is editorial and is based on the patching model, the advisory process and the severity and exploitation history, never on raw CVE counts.
CVEs per year
The table counts the CVEs published each year in the NVD for the core of each self-hosted product (matched by its CPE
vendor and product identifier) and, where the data allows, for its ecosystem (plugins, modules and extensions, found by
vendor identifier or by keyword search, which also matches unrelated mentions). Hosted products have no series
(n/a) for the reasons given below. NVD tagging of the core can lag, and
2026 is a year to date.
| Series | 2018 | 2020 | 2022 | 2023 | 2024 | 2025 | 2026 to date |
|---|---|---|---|---|---|---|---|
WordPress, core |
18 |
22 |
9 |
5 |
4 |
0 |
3 |
Drupal, core |
12 |
9 |
17 |
8 |
10 |
8 |
9 |
Joomla, core |
24 |
39 |
13 |
6 |
15 |
5 |
66 |
TYPO3, core |
1 |
13 |
15 |
6 |
11 |
24 |
5 |
Craft CMS, core |
3 |
1 |
8 |
14 |
10 |
6 |
40 |
Strapi, core |
0 |
5 |
8 |
9 |
4 |
4 |
6 |
Payload, core |
0 |
0 |
1 |
1 |
0 |
0 |
33 |
Ghost, core |
0 |
1 |
4 |
8 |
5 |
1 |
8 |
Umbraco, core |
2 |
7 |
2 |
10 |
12 |
13 |
6 |
AEM, core |
16 |
24 |
56 |
217 |
313 |
377 |
220 |
WordPress, keyword search (plugins and themes) |
230 |
256 |
1660 |
2113 |
4483 |
4245 |
5955 |
Drupal, vendor CPE (modules) |
14 |
11 |
20 |
9 |
10 |
13 |
9 |
Joomla, keyword search (extensions) |
109 |
62 |
16 |
29 |
12 |
47 |
383 |
TYPO3, keyword search (extensions) |
1 |
31 |
33 |
19 |
17 |
36 |
41 |
Wagtail, keyword search |
0 |
4 |
1 |
4 |
3 |
1 |
15 |
Source: NVD CVE API 2.0, counted by publication year and de-duplicated,
retrieved 2026-10-29. Webflow, Wix, Squarespace, Contentful and Sanity have no NVD series (n/a).
Four facts stand out.
-
WordPress core has few CVEs; the ecosystem has thousands. Core CVEs fell from 22 in 2020 to 5 in 2023, 4 in 2024 and 0 in 2025, because plugin and theme CVEs are filed under their own vendors. A keyword search for WordPress finds 256 CVEs in 2020, 1,660 in 2022, 4,483 in 2024, 4,245 in 2025 and 5,955 in 2026 to date, driven by CNAs that issue CVEs for plugins in bulk.
-
Drupal core is stable at 8 to 10 a year since 2023 (17 in 2022). The Drupal vendor series, which also covers contributed projects, is 9 to 20 a year, far below the contributed-module advisories of the Drupal security team (see below).
-
Several products had a recent step. Joomla core went from 5 in 2025 to 66 in 2026 to date, and Joomla keyword CVEs from 47 to 383; Craft CMS from 6 to 40; Payload from 0 to 33; TYPO3 core rose to 24 in 2025. These rises reflect more disclosure and more scrutiny as much as more flaws.
-
AEM is an outlier by an order of magnitude (217 in 2023, 313 in 2024, 377 in 2025 and 220 in 2026 to date), because Adobe files every AEM and add-on component under one product.
Figure 32: CVEs published per year in the NVD for the core of the traditional open-source CMSs, 2015 to 2026 year to date. Source: NVD. WordPress core stays low because plugin and theme CVEs are filed under other vendors. CVE counts measure disclosure, not real risk, and NVD tagging can lag.
Figure 33: CVEs published per year in the NVD for the core of AEM, Umbraco, Strapi, Payload and Ghost, 2015 to 2026 year to date. Source: NVD. AEM counts are an order of magnitude higher because Adobe files every component under one product. Colours are assigned by position in this figure.
Figure 34: CVEs published per year in the NVD for the ecosystems (plugins, themes, modules and extensions, by vendor identifier or keyword search), 2015 to 2026 year to date. Source: NVD. The WordPress series dwarfs the others, and keyword searches also match unrelated mentions. Colours are assigned by position in this figure.
Security advisories
The projects publish their own advisories, which bundle or split issues differently from the CVE counts and cover modules
and extensions that never reach the NVD. Drupal separates core advisories (SA-CORE) from contributed-module advisories
(SA-CONTRIB), and the contributed ones are the large series: 126 against 8 in 2025 and 290 against 16 in 2026 to date. TYPO3
publishes core and extension advisories (23 and 16 in 2025), the Joomla Security Centre 9 core advisories in 2025 and 66 in 2026
to date, and the Node.js, Python and .NET products are covered by GitHub global advisories. Each project counts
differently, so the levels are not comparable between rows. Adobe publishes AEM bulletins and WordPress.org
publishes no advisory series, so both are n/a here.
| Series | 2018 | 2020 | 2022 | 2023 | 2024 | 2025 | 2026 to date |
|---|---|---|---|---|---|---|---|
Drupal core (SA-CORE) |
4 |
13 |
15 |
6 |
8 |
8 |
16 |
Drupal contributed modules (SA-CONTRIB) |
81 |
38 |
63 |
55 |
76 |
126 |
290 |
Joomla Security Centre |
24 |
33 |
13 |
6 |
15 |
9 |
66 |
TYPO3 core advisories |
12 |
12 |
17 |
7 |
12 |
23 |
24 |
TYPO3 extension advisories |
10 |
20 |
18 |
11 |
7 |
16 |
36 |
Craft CMS (GitHub global advisories) |
0 |
0 |
22 |
14 |
9 |
6 |
89 |
Strapi (GitHub) |
0 |
1 |
9 |
3 |
1 |
1 |
1 |
Payload (GitHub) |
0 |
0 |
1 |
1 |
0 |
2 |
26 |
Ghost (GitHub) |
0 |
0 |
4 |
3 |
3 |
1 |
47 |
Wagtail (GitHub) |
0 |
3 |
1 |
3 |
3 |
0 |
18 |
Umbraco (GitHub) |
0 |
0 |
2 |
8 |
5 |
8 |
6 |
Source: Drupal security advisories, Joomla Security Centre, TYPO3 security bulletins and the GitHub global advisory database; links in the Bibliography. Retrieved 2026-10-29, 2026 to date.
Figure 35: security advisories per year for the traditional open-source CMSs, 2015 to 2026 year to date. Source: Drupal, Joomla and TYPO3 security teams and the GitHub advisory database. Each project counts differently (one advisory can bundle several CVEs).
Figure 36: GitHub global advisories per year for Strapi, Payload, Ghost, Wagtail and Umbraco, 2015 to 2026 year to date. Source: GitHub advisory database. Counts are low until 2025 and Ghost jumps in 2026 (47 to date); young projects publish few advisories, which reflects both quality and disclosure habits. Colours are assigned by position in this figure.
Where WordPress vulnerabilities are found. The Patchstack State of WordPress Security in 2026 reports 11,334 new vulnerabilities in the WordPress ecosystem in 2025, of which 91% were in plugins, 9% in themes and 6 (0.05%) in WordPress core. The ecosystem, not the core, is where WordPress sites are attacked. Patchstack and WPScan are the main vulnerability databases for it (the Wordfence Intelligence database returned an HTTP 202 bot wall and no row depends on it).
Figure 37: where the 11,334 new WordPress ecosystem vulnerabilities of 2025 were found: plugins 91%, themes 9% and core 6 vulnerabilities (0.05%). Source: Patchstack, State of WordPress Security in 2026. The share for core is computed from the two published counts.
Notable incidents
The table lists 28 vulnerabilities that were exploited, rated critical or that taught the community something, with the date
of publication, the CVSS score and whether CISA added them to the KEV catalogue (which means exploitation in the wild is
documented). n/a in the CVSS column means that the NVD has no CVSS v3.1 score for the CVE (older records only have a
version 2 score) and, for some 2026 entries, that the score comes from the CNA because the NVD has not scored it yet.
| CMS | Date | CVE | CVSS | CISA KEV (added) | What it was |
|---|---|---|---|---|---|
Drupal |
2014-10-16 |
n/a |
no |
Drupalgeddon: SQL injection in the database layer of Drupal 7, exploitable without authentication |
|
Drupal |
2018-03-29 |
9.8 |
yes (2021-11-03) |
Drupalgeddon 2: remote code execution without authentication in Drupal 7 and 8 core |
|
Drupal |
2018-07-19 |
9.8 |
yes (2022-04-13) |
Drupalgeddon 3: remote code execution in several Drupal 7 and 8 subsystems |
|
Drupal |
2019-02-21 |
8.1 |
yes (2022-03-25) |
Remote code execution through field types that do not sanitise data from non-form sources (Drupal 8) |
|
Drupal |
2020-11-20 |
8.8 |
yes (2022-01-18) |
Uploaded file names not sanitised, so files can run with the wrong extension |
|
Drupal |
2026-05-20 |
9.8 |
yes (2026-05-22) |
SQL injection in Drupal core from 8.9.0 to the 11.x lines |
|
Joomla |
2015-12-16 |
n/a |
no |
PHP object injection through the User-Agent header, exploited in the wild |
|
Joomla |
2023-02-16 |
5.3 |
yes (2024-01-08) |
Unauthorised access to web service endpoints (information disclosure) in Joomla 4.0.0 to 4.2.7 |
|
Joomla |
2026-06-05 |
9.8 |
yes (2026-06-16) |
JCE editor extension: unauthenticated profile creation leads to PHP upload (extension, not core) |
|
Joomla |
2026-06-29 |
9.8 |
yes (2026-07-07) |
Page Builder CK extension: unauthenticated file upload leads to code execution (extension, not core) |
|
WordPress |
2017-04-03 |
n/a |
no |
REST API integer check allowed changing arbitrary posts and pages in WordPress 4.7.0 and 4.7.1 |
|
WordPress |
2020-09-09 |
9.8 |
yes (2021-11-03) |
File Manager plugin: unauthenticated PHP upload and execution |
|
WordPress |
2020-04-13 |
7.5 |
yes (2021-11-03) |
Duplicator plugin: directory traversal allowing file download |
|
WordPress |
2019-03-24 |
6.1 |
yes (2021-11-03) |
Social Warfare plugin: stored cross-site scripting |
|
WordPress |
2026-07-17 |
9.8 |
yes (2026-07-21) |
Core: route confusion in the REST batch endpoint, combined with a SQL injection in WordPress 6.9 and 7.0 |
|
WordPress |
2026-09-22 |
8.1 |
yes (2026-09-25) |
Core: page template resolution can include a local PHP file (under server and theme preconditions) |
|
WordPress |
2026-07-17 |
5.9 |
yes (2026-07-21) |
Core: insufficient sanitisation of the |
|
Craft CMS |
2025-04-25 |
10.0 |
yes (2026-03-20) |
Remote code execution in Craft CMS 3, 4 and 5 |
|
Craft CMS |
2024-12-18 |
9.8 |
yes (2025-06-02) |
Remote code execution when |
|
Craft CMS |
2025-01-18 |
8.1 |
yes (2025-02-20) |
Remote code execution on installs whose security key is already compromised |
|
Craft CMS |
2025-05-07 |
5.3 |
yes (2025-06-02) |
Unauthenticated content stored in session files that can be accessed and executed |
|
TYPO3 |
2020-05-14 |
10.0 |
no |
Calling |
|
Strapi |
2023-04-19 |
4.9 |
yes (2026-10-08) |
Admin users can discover sensitive user details through the query filter |
|
Strapi |
2023-04-19 |
7.2 |
no |
Authenticated server-side template injection leading to code execution from an admin account |
|
Ghost |
2023-08-15 |
6.5 |
no |
Authenticated users can upload symlinks and read arbitrary files on the host |
|
Payload |
2026-10-06 |
10.0 |
no |
Form-builder plugin: a crafted submission executes code on the server (CVSS from the CNA) |
|
Umbraco |
2025-12-22 |
10.0 |
no |
Arbitrary file upload through a crafted PDF, disputed by the supplier |
|
AEM |
2025-08-05 |
10.0 |
yes (2025-10-15) |
AEM Forms misconfiguration allowing code execution without user interaction |
Source: NVD (CVSS) and the CISA KEV catalogue (2026-10-28), retrieved 2026-10-29.
What the reader should take from them:
-
Drupal: the core remote-code-execution flaws of 2014 and 2018 (Drupalgeddon) show that an unauthenticated flaw in a widely deployed core is exploited within days. All five Drupal entries with a CVSS score above 8 are in the KEV catalogue, and the 2026 SQL injection (CVSS 9.8) was added two days after its publication.
-
Joomla: the 2023 web service disclosure has a medium CVSS score (5.3) and is nevertheless in the KEV catalogue, so a low score does not mean a low risk. The two 2026 critical entries are in extensions (JCE and Page Builder CK), not in the core.
-
WordPress: the plugin entries of 2019 and 2020 (Social Warfare, Duplicator, File Manager) are in the KEV catalogue, and so are the 2026 core entries (REST batch route confusion, page-template file inclusion and the sanitisation flaw), added three to four days after publication. The core is not immune, but the volume of exploited flaws is in the plugins.
-
Craft CMS: four exploited flaws in 2024 and 2025 (CVSS 10.0, 9.8, 8.1 and 5.3), all in the KEV catalogue.
-
Other systems: TYPO3’s 2020 flaw (CVSS 10.0), the Strapi, Ghost and Payload entries and the disputed Umbraco entry are not in the catalogue, except one Strapi entry added in 2026-10; the AEM Forms flaw (CVSS 10.0) is.
Why self-hosted CMSs with large plugin ecosystems have a larger attack surface
Three facts in the data explain why the exposure of the self-hosted CMSs, and of WordPress in particular, is larger:
-
The site owner is the patch manager. On a self-hosted system a fix does not protect a site until someone applies it. The KEV catalogue added the 2026 Drupal SQL injection two days after publication and the Craft CMS flaw CVE-2025-32432 eleven months after, which shows that exploitation continues long after a fix exists.
-
Third-party code runs with the privileges of the site. Plugins, modules and extensions run inside the same PHP process, with access to content and users. 91% of the new WordPress vulnerabilities of 2025 were in plugins (Patchstack), Drupal publishes 126 contributed-module advisories against 8 for the core, and the exploited Joomla flaws of 2026 are in extensions.
-
The stack is larger. The web server, PHP or Node.js, the database and the operating system are the owner’s (or the host’s) responsibility, together with the CMS and every extension.
A hosted builder removes the first and third of these, but not the risk of third-party apps with excessive access scopes or of compromised editor accounts. See the WordPress security hardening page for the measures on that platform.
Why SaaS CVE counts are not comparable
Webflow, Wix, Squarespace, Contentful and Sanity (the hosted content store) have no NVD series, and the same is true of
their advisories (n/a). This does not mean they have fewer vulnerabilities. When a SaaS vendor fixes a vulnerability in
its platform, it deploys the fix on its own servers and the customers take no action, so the fix does not become a CVE:
CVEs exist to tell the users of installed software what to update. A count of zero or near zero for a SaaS product
therefore means that its vulnerabilities do not need to be announced to the customers. The same applies in reverse: a
large number of CVEs for a self-hosted product shows transparent disclosure as much as a large number of vulnerabilities,
and AEM’s several hundred CVEs a year show how one vendor files its components, not how insecure AEM is. Counts should be
compared only within one deployment model, and even then they measure disclosure effort, not risk. Hosted vendors are
better compared by their security programmes and compliance (SOC 2 and ISO 27001 attestations, bug bounty and
disclosure programmes, single sign-on, role granularity), which this page does not score numerically because the
attestations were not collected from primary sources (n/a); the security scores of the hosted systems reflect only
that the vendor, and not the customer, patches the platform.
Reading the security data. The evidence supports three statements. First, the owner of a hosted site delegates platform
patching, which removes a whole class of risk. Second, on self-hosted systems the exploited flaws cluster in extensions
(WordPress plugins, Joomla extensions) and in a few core flaws that are exploited within days, so patching speed and the number of third-party
extensions a site installs decide the exposure. Third, Drupal, TYPO3 and WordPress have an advisory process and automatic
or coordinated updates, while the young headless projects publish few advisories, which could mean fewer problems or less
scrutiny. Share of detected sites running unsupported versions, hacked-site report shares and per-version install
statistics were not collected for this snapshot (n/a).
Maintenance
Maintenance effort is the work needed to keep a site secure and supported: applying core, plugin and theme updates, running backups, moving to a new major line before the old one ends, and keeping the hosting stack current. The editorial score is 10 for a vendor-managed product with no customer patching and lower for self-hosted systems with frequent major upgrades and short support windows.
Support windows
Release lines have a standard phase (features and fixes), a security phase (security fixes only) and sometimes a paid extended phase. The chart shows the windows of the six self-hosted CMSs that publish dated release policies, and marks the check date, 2026-10-29. Open-ended windows run to the right edge. Drupal 7 and Joomla 3 are included as the previous generation.
Figure 38: support windows of the release lines of WordPress, Drupal, Joomla, TYPO3, Umbraco and Craft CMS, 2019 to 2033, with the check date 2026-10-29 marked. Source: endoflife.date and the official lifecycle policies listed in the Bibliography. Opacity shows the phase: standard support, security fixes only, and extended or paid support (TYPO3 ELTS, Drupal 7 vendor support).
The dates behind the chart and the other systems are:
-
WordPress: the current release is 7.1 (since 2026-08-19; 7.2 is planned for 2026-12-10, a planning date only). The branches 6.8, 6.9 and 7.0 are in the security phase with no end date in the data, so the policy is better read as "update to the latest release".
-
Drupal: Drupal 11 (standard since 2024-08-02, security phase from 2026-07-01 to 2027-07-07); Drupal 10 is in security support until 2026-12-09; Drupal 7 ended on 2025-01-05 and only vendor-supported extended support remains.
-
Joomla: Joomla 6 (standard from 2025-10-14 to 2028-10-17, security to 2029-10-16); Joomla 5 is in security support from 2026-10-13 to 2027-10-12; Joomla 4 ended on 2025-10-14 and Joomla 3 on 2023-08-17.
-
TYPO3: TYPO3 14 LTS (standard from 2025-11-25 to 2027-12-31, security to 2029-06-30, paid ELTS to 2032-06-30); 13 LTS has security fixes to 2027-12-31 and 12 LTS to 2026-04-30, after which only the paid ELTS remains (2029-04-30 for 12 LTS and 2027-10-31 for 11 LTS).
-
Craft CMS: Craft 5 is supported until 2030-12-31 with security fixes to 2031-12-31, the longest unpaid window of the six; Craft 4 ended on 2026-04-30 and Craft 3 on 2024-04-30.
-
Umbraco: 17 LTS (standard to 2027-11-27, security to 2028-11-27) and 13 LTS (security to 2026-12-14).
-
Wagtail: LTS releases are supported for about 18 months (7.4 LTS from 2026-05-04 to 2027-11-02; 7.0 LTS to 2026-11-02).
-
Strapi: Strapi 5 is current since 2024-09-18, and Strapi 4 ended its security phase on 2026-06-09.
-
Ghost: Ghost 6 is current since 2025-08-04, and Ghost 5 ended in 2026-01.
-
Webflow, Wix, Squarespace, Contentful, Sanity and AEM as a Cloud Service: the vendor runs the platform and ships updates continuously, so there are no customer-visible release lines (
n/a).
The pattern is clear. Major lines of Drupal, Joomla and Strapi are replaced every few years and a site that does not move is out of support, TYPO3 and Craft CMS give the longest windows, and the paid ELTS of TYPO3 and the Drupal 7 vendor support show that "end of life" is often a commercial question. For hosted systems, the only maintenance is the content and the front end.
Patching model
| CMS | Who patches | How fixes arrive | Support policy |
|---|---|---|---|
The site owner or the host |
Core with automatic updates; plugins and themes updated by the owner or the host |
Latest release; branches 6.8, 6.9 and 7.0 in the security phase |
|
The site owner |
Composer-managed core and contributed modules; coordinated advisories |
Drupal 11 and 10 supported; Drupal 7 ended |
|
The site owner |
Core and extension updates; Joomla Security Centre |
Joomla 6 and 5 supported; 3 and 4 ended |
|
The site owner |
Security team and advisories; paid ELTS after the LTS |
LTS every 18 months, with ELTS |
|
The site owner or Craft Cloud |
Composer updates |
Craft 5 until 2030-12-31 and security to 2031-12-31 |
|
The vendor |
Continuous deployment; no customer patching |
No customer-visible lines |
|
The vendor for the content store; the customer for the front end and Studio |
Continuous deployment of the API; the customer updates the SDKs and the Studio |
No customer-visible lines |
|
The site owner, or the vendor on Strapi Cloud |
Node.js package upgrades between majors |
Strapi 5 current, Strapi 4 ended; Payload n/a |
|
Adobe on the Cloud Service; the customer on-premises |
Continuous updates on the Cloud Service |
n/a |
|
The site owner, or the vendor on Umbraco Cloud |
LTS every two years plus .NET upgrades |
17 LTS and 13 LTS supported |
|
The site owner |
LTS releases and Django upgrades |
LTS for about 18 months |
|
The site owner, or the vendor on Ghost(Pro) |
ghost-cli upgrades for self-hosting |
Ghost 6 current, Ghost 5 ended |
Source: the radar basis and the lifecycle rows of support-windows.csv; the model describes how fixes are delivered, not how quickly. Built-in two-factor
authentication, single sign-on, role granularity and SOC 2 or ISO 27001 attestations were not collected from primary
sources and are n/a.
The maintenance scores follow from this: Wix and Squarespace 10, Webflow and Contentful 9, Sanity 8, AEM 7 and Ghost 7, then Craft CMS 6, Umbraco 6, WordPress 5, Joomla 5, Strapi 5, Payload 5, Wagtail 5, and Drupal and TYPO3 4.
Cost and total cost of ownership
What is compared. Three kinds of cost decide the price of a site: the licence or plan (free for open-source software,
a monthly plan for hosted products, a one-time licence for Craft CMS), the hosting of a self-hosted system, and the
people: extensions, themes, maintenance hours and development. The prices below were read from the official pricing
page of each vendor on 2026-10-29, excluding VAT unless stated, with the limits that decide the real price next to them.
Quote-only prices (AEM, Webflow Enterprise, Sanity Enterprise, Strapi and Payload enterprise offers) are n/a (quote only)
and are never estimated.
Plan prices
The cheapest paid plan of each CMS, billed yearly where the vendor offers it, is charted below. Free software is shown as
0, which is not a total cost: it still needs hosting and development. Squarespace and Umbraco Cloud publish euro prices
and are therefore n/a in this US-dollar chart, and Contentful’s pricing page returned HTTP 429 (unverified).
Figure 39: entry price per month in US dollars, billed yearly where the vendor offers it (Sanity Growth is per seat and billed monthly), on 2026-10-29. Source: the vendor pricing pages listed in the Bibliography. Free software still needs hosting, extensions and development.
| CMS | Plans and prices (per month, billed yearly, with the monthly-billing price in brackets) | Limits and notes that decide the real price |
|---|---|---|
Software: free (GPL). WordPress.com: Free USD 0; Personal USD 4 (9); Premium USD 8 (18); Business USD 25 (40); Commerce USD 45 (70) |
Storage 6, 13, 50 and 50 GB; plugin installation only on Business and Commerce; 36-month billing lowers the price further (Personal USD 2.75). Self-hosted: hosting, themes and plugins extra. |
|
Starter USD 0; Basic USD 15 (25), with no CMS; Premium USD 25 (39), with the CMS. Team platform plan USD 2,500 on an annual contract; Enterprise is quote only |
Basic: 10 GB bandwidth and 300 static pages. Premium: 20,000 CMS items, 40 collections, 50 GB bandwidth in the base tier (USD 69 monthly with the 100 GB tier) and 120 CMS API requests per minute. Localize adds USD 9 (Essential) or USD 29 (Advanced) per month for one locale. |
|
Light USD 17.77; Core USD 29.77; Business USD 39.77; Business Elite USD 159.77. The monthly-billing price is |
Storage 2, 50, 100 GB and unlimited; collaborators 2, 5, 10 and 100. The page was served in USD with GST included for the location of the fetch. |
|
EUR 14.52 Basic (20.57); EUR 21.78 Core (29.04); EUR 38.72 Plus (50.82); EUR 83.49 Advanced (95.59), VAT included |
Card fees of 2.0%, 2.0%, 1.7% and 1.5% per transaction; Basic includes 2 contributors; no cap on bandwidth or storage. |
|
|
The pricing page returned HTTP 429 on every attempt. |
|
Community: free (MIT). Strapi Cloud Starter USD 29 (35), Pro USD 75 (90), Business USD 375 (450) per project |
API requests 100k, 1M and 10M a month; asset storage 50, 250 and 1,000 GB; extra bandwidth USD 30 per 100 GB. Enterprise is quote only. |
|
Free USD 0; Growth USD 15 per seat per month (no yearly price published) |
Free: 20 seats, 10k documents; Growth: 50 seats, 25k documents; 1M CDN requests and 250k API requests a month, with overage fees. Add-ons: increased quota USD 299, dedicated support USD 799; Enterprise is quote only. |
|
Free to self-host (MIT) |
Enterprise terms are quote only and Payload Cloud shows no public price ( |
|
Solo free; Team USD 279 and Pro USD 399 one-time per project; Craft Cloud Team USD 110 (120) and Pro USD 220 (240) |
Updates after the first year cost USD 99 a year on Team and Pro; Solo allows one user; Enterprise is quote only. |
|
|
Adobe publishes no price, and the Adobe business pages did not open from the authoring environment. |
|
CMS free (MIT). Umbraco Cloud Starter EUR 45, Standard EUR 280, Professional EUR 730 per month |
Media storage 5, 50 and 500 GB; bandwidth 50, 300 and 1,000 GB a month; a staging environment adds EUR 70 a month. Enterprise is custom. |
|
Self-hosted free (MIT). Ghost(Pro) Starter USD 15 (18), Publisher USD 29 (35), Business USD 199 (239), for 1,000 members at the entry price |
Staff users 1, 3 and 15; Business includes 10,000 members and a Publisher plan with 10,000 members is USD 105 a month; Custom is quote only. |
|
Free software (GPL for Drupal, GPL-2.0 for Joomla and TYPO3, BSD-3-Clause for Wagtail) |
Hosting, extensions and maintenance are the cost. |
Source: vendor pricing pages (Webflow, Wix, Squarespace, WordPress.com, Ghost, Strapi, Sanity, Craft CMS and Umbraco), read on 2026-10-29. Plan prices are shown in the currency the vendor publishes and are not converted; only the hosting costs of the total-cost-of-ownership scenarios below are converted to euros, at the ECB reference rate.
Hosting assumptions
Self-hosted systems need a server. The hosting costs below come from the Cloud Providers Comparison of this site (US East list prices, in US dollars): a static website of 50 GB of files and 500 GB of egress a month, and a simple dynamic site on a 2 vCPU, 8 GiB virtual machine with a small managed PostgreSQL database, 100 GB of uploads and backups and 200 GB of egress. A static site costs USD 48.20 (AWS), 46.59 (Azure) or 63.05 (Google Cloud) a month, and a simple dynamic site USD 147.08, 144.95 or 186.13.
Figure 40: monthly hosting cost in US dollars of the two profiles on AWS, Azure and Google Cloud. Source: the cloud providers comparison page of this site (2026-10-26), which compiles the provider price lists.
Scenarios and total cost of ownership
The total cost of ownership over 3 years is computed for a self-hosted free-software CMS (WordPress, Drupal, Joomla, TYPO3, Strapi, Payload, Wagtail, Umbraco or Ghost on its own server), in euros. The labour and extension assumptions are in euros; the hosting costs are in US dollars and are converted at the ECB euro reference rate of 2026-10-28, USD 1.1133 per EUR (the last rate published before the snapshot date). The model is editorial: the maintenance hours and the hourly rate are assumptions, not measurements. The assumptions of each scenario are:
| Scenario | Editors | Languages | Maintenance hours a month | Paid extensions a year (EUR) | Labour over 3 years (EUR) | Hosting profile (self-hosted systems) |
|---|---|---|---|---|---|---|
Small brochure site |
1 |
1 |
2 |
50 |
4,320 |
Static website; USD 1,677 to 2,270 over 3 years |
Blog or publication |
2 |
1 |
4 |
100 |
8,640 |
Simple dynamic site; USD 5,218 to 6,701 |
Multilingual corporate site with 5 editors |
5 |
3 |
10 |
500 |
21,600 |
Simple dynamic site; USD 5,218 to 6,701 |
Headless multi-channel with a separate front end |
5 |
2 |
20 |
0 |
43,200 |
Dynamic site for the CMS plus a static front end; USD 6,895 to 8,970 |
Source: cost.csv (editorial assumptions of 2026-10-29): 36 months, an hourly rate of EUR 60, and the maintenance hours and
paid extensions shown. Labour is the hours multiplied by EUR 60 and by 36 months; the hosting range is the monthly cost
of the three providers multiplied by 36 months. A hosted system has no hosting item but pays the plan prices above, which
depend on seats, locales, API calls and bandwidth.
Figure 41: 3-year total cost of ownership, in euros, of the four scenarios for a self-hosted free-software CMS: labour, paid
extensions, hosting (mean of AWS, Azure and Google Cloud, converted at USD 1.1133 per EUR) and the total. Sources: the
editorial assumptions in cost.csv, the Cloud Providers Comparison and the ECB
reference rate of 2026-10-28.
The totals are about EUR 6,200 for the small brochure site, EUR 14,100 for the blog, EUR 28,300 for the multilingual corporate site and EUR 50,100 for the headless multi-channel setup, of which hosting is EUR 1,700, 5,150, 5,150 and 6,860. A hosted plan replaces the hosting and most of the maintenance: Webflow’s Team platform plan at USD 2,500 a month on an annual contract is about EUR 80,800 over three years, more than any self-hosted scenario, while an entry plan of a hosted builder costs a few hundred euros over the same period but limits seats, locales and CMS items.
Reading the scenarios gives three conclusions. First, labour is the largest component in every scenario: about 70% of the total for the brochure site, 61% for the blog, 76% for the corporate site and 86% for the headless setup. The assumed hours are those of a site that is patched by a developer (updates, backups, security patches and minor edits), so they are the hours that a hosted system removes: a hosted builder (maintenance score 9 to 10) saves more than any licence discount, while a free system with a heavy upgrade path (Drupal and TYPO3, maintenance score 4) costs more in people than its licence saves. Second, usage limits decide the real price of hosted and API-first products: seats and locales (Sanity per-seat pricing, Webflow Localize per locale), API calls and bandwidth (Strapi Cloud, Sanity) and CMS items (Webflow Premium) change the plan that a scenario needs. Third, the multilingual and headless scenarios are where plans start to matter: Webflow’s Team platform plan is USD 2,500 a month on an annual contract and Umbraco Cloud Professional is EUR 730 a month, which is to be put against the labour and hosting of an equivalent self-hosted setup.
The cost score of the radar charts is editorial, on the evidence of this section: 10 is free software with low hosting
cost, and the score falls for paid plans and licences. It is n/a for Contentful (unverified) and AEM (quote only). The
cost axis is therefore the least comparable of the twelve, because it mixes currencies and billing models, and it should be
read together with the maintenance axis.
Figure 42: editorial low-cost score (horizontal axis, higher means cheaper) against the feature-matrix score (vertical axis),
coloured by group. Sources: vendor pricing pages and the feature matrix. Contentful and AEM have no cost score (n/a) and
are not plotted.
The chart shows no trade-off between cost and features: WordPress (cost 8, features 7.8), Payload (8 and 8.1) and Wagtail (8 and 6.9) combine a low cost with many features, while Wix (7 and 3.7) and Squarespace (6 and 3.2) pair a plan price with fewer rows of the feature matrix than the open-source systems. The comparison is limited by plan prices in different currencies and billing models and by the feature score, which does not credit capabilities that no official page states.
Other metrics: lock-in, portability and scalability
Lock-in and data portability is the ease of leaving: the licence, the data format, the export tools and the ability to change host. The portability score is editorial (10 is the least lock-in) and uses the "content export" row of the feature matrix.
| CMS | Score | Basis |
|---|---|---|
9 |
GPL, a standard database, the WordPress eXtended RSS (WXR) export and the REST API. See the importing, exporting and migrating page. |
|
8 |
GPL (MIT for Umbraco), a standard database and open data models. TYPO3 has import and export in core (XML or T3D); Drupal reads content as JSON and migrates it with the Migrate framework; Umbraco content is in your SQL database and available through the Management API; Joomla’s export capability is |
|
7 |
Source-available licence with a standard database; element exporters produce CSV, JSON and XML. |
|
9 |
Open source and self-hostable on your own database. Strapi has a CLI export, import and transfer, Payload an import-export plugin (CSV and JSON), Ghost a JSON export of all content, and Wagtail’s export capability is |
|
6 |
Content is exportable (NDJSON export API and CLI), but the hosted content store and the GROQ query language are proprietary. |
|
5 |
Content and models are exportable to JSON, but the service and the data model are proprietary. |
|
4 |
Proprietary stack and content repository; export capability |
|
3 |
Closed SaaS. Webflow content can be exported as CSV and the site as static code on paid Workspace plans, but the CMS is not part of that bundle and hosting stays on Webflow; Squarespace has limited export ( |
|
2 |
Closed SaaS with no code export of the site; export capability |
Source: features.csv (content export row) and radar-scores.csv, 2026-10-29.
The spread of the axis is the widest of the twelve: the open-source systems score 7 to 9, and the closed hosted builders 2 to 3. That is the price of the low maintenance of the same hosted systems, which score 9 to 10 there.
Scalability, high availability and data residency. Official guidance on scaling, multi-region deployment and data
residency options was not collected for this snapshot, so those metrics are n/a and no score uses them. The hosted
vendors state their infrastructure in their own documentation; the WordPress and Webflow platform pages cover
WordPress scaling and high availability and the
Webflow CMS limits and scaling.
Accessibility, SEO and internationalisation. Accessibility tooling and the AI integrations are in the feature matrix; the SEO tooling and multilingual rows are summarised there too. Multilingual content is in core or official components for Drupal, Joomla, TYPO3, Craft CMS, Webflow, Strapi, Sanity, Payload and Umbraco and Wagtail, and by extension for WordPress; SEO tooling is built in for TYPO3, Webflow, Wix, Squarespace and Wagtail.
Scores on twelve axes
The scores combine the evidence of the previous sections with the rules in
How metrics, scales and scores were assigned. Five axes are computed
(popularity, growth, talent pool on Stack Overflow, ecosystem and maturity, performance) and seven are editorial (ease of use for
editors and for developers, features, cost, security, maintenance and portability). n/a means that the inputs were
missing, not zero.
| CMS | Popularity | Growth | Talent pool (Stack Overflow) | Ease of use (editors) | Ease of use (developers) | Ecosystem and maturity | Features / productivity | Performance | Low cost | Security posture | Low maintenance effort | Portability (low lock-in) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
9.6 |
3.3 |
8.4 |
8 |
6 |
9.4 |
7.8 |
5.2 |
8 |
5 |
5 |
9 |
|
5.6 |
2.1 |
3.9 |
5 |
4 |
6.6 |
5.8 |
6.2 |
6 |
8 |
4 |
8 |
|
5.9 |
0.2 |
2.4 |
5 |
5 |
5 |
4.2 |
5.5 |
7 |
6 |
5 |
8 |
|
4.8 |
3.9 |
5 |
5 |
4 |
5.7 |
6.8 |
6.8 |
6 |
8 |
4 |
8 |
|
3.5 |
4.2 |
0.1 |
7 |
8 |
2 |
6.9 |
6.2 |
6 |
7 |
6 |
7 |
|
5.5 |
6.4 |
1.6 |
7 |
6 |
1.1 |
7.1 |
7.2 |
5 |
8 |
9 |
3 |
|
7 |
3.4 |
4.6 |
9 |
6 |
5.8 |
3.7 |
7.7 |
7 |
8 |
10 |
2 |
|
6.4 |
4.4 |
2.1 |
9 |
5 |
2.6 |
3.2 |
5.9 |
6 |
8 |
10 |
3 |
|
4.2 |
3.2 |
1.9 |
6 |
7 |
2.7 |
3.2 |
4.9 |
n/a |
8 |
9 |
5 |
|
0 |
0.3 |
4.8 |
6 |
8 |
6.8 |
5.9 |
4.7 |
7 |
6 |
5 |
9 |
|
4.3 |
10 |
2.8 |
7 |
8 |
3.3 |
6.3 |
6 |
7 |
8 |
8 |
6 |
|
n/a |
n/a |
2.6 |
7 |
8 |
4.2 |
8.1 |
n/a |
8 |
6 |
5 |
9 |
|
4.9 |
4.2 |
2.6 |
5 |
3 |
4.9 |
3.2 |
4.2 |
n/a |
6 |
7 |
4 |
|
3.5 |
9 |
2.5 |
6 |
7 |
4.2 |
5.5 |
6.4 |
7 |
7 |
6 |
8 |
|
3.8 |
8.5 |
3.8 |
7 |
8 |
5.3 |
6.9 |
6.1 |
8 |
8 |
5 |
9 |
|
2.9 |
4.8 |
0 |
8 |
7 |
5.4 |
3.7 |
7 |
8 |
7 |
7 |
9 |
Source: scores.mjs for the computed axes and radar-scores.csv (basis and source of every editorial score), data of
2026-10-29. Scores are rounded to one decimal; one point is within the uncertainty of the method.
There are limits to bear in mind. The cost axis is editorial and mixes currencies and billing models. The popularity and growth axes count visible fingerprints, so they underestimate headless products, and the growth axis compares two months and is sensitive to the crawl population. Payload has no HTTP Archive series and gets no popularity, growth or performance score. Contentful and AEM have no cost score. The colours of a CMS are consistent only inside its group, because the palette has eight slots for sixteen systems.
Radar charts by group
Each group has its own chart, so every chart stays readable.
Figure 43: scores on twelve axes of the traditional open-source CMSs. Sources: W3Techs, HTTP Archive Tech Report, GitHub, Stack Exchange, vendor documentation and the editorial rubric (2026-10-29). WordPress leads popularity (9.6), talent pool (8.4), ecosystem (9.4) and features (7.8) and trails in performance (5.2) and security (5); Drupal and TYPO3 lead security (8 each) and have the lowest maintenance scores (4).
Figure 44: scores on twelve axes of the hosted website builders. Sources as above. Wix and Squarespace lead ease of use for editors (9) and maintenance (10); Webflow has the highest growth (6.4), features (7.1) and security score (8, shared) of the group, and all three have the lowest portability (2 to 3).
Figure 45: scores on twelve axes of the headless and API-first CMSs. Sources as above. Sanity has the highest growth (10) and ease of use for developers (8, shared with Strapi and Payload); Strapi the highest ecosystem score (6.8); Payload the highest features (8.1) and, with Strapi, portability (9) but no popularity, growth or performance score; Contentful has no cost score.
Figure 46: scores on twelve axes of the enterprise and other-stack CMSs. Sources as above. Umbraco and Wagtail have the highest growth (9 and 8.5) and Wagtail and Ghost the highest portability (9); AEM has the lowest ease of use for developers (3), features (3.2) and portability (4) of the set.
WordPress against Webflow
The two CMSs documented on this site have opposite profiles: WordPress is the most popular and flexible, Webflow the most managed and the easiest to operate.
Figure 47: scores on twelve axes of WordPress and Webflow. Colours are assigned by position in this figure. WordPress is ahead on popularity (9.6 against 5.5), talent pool (8.4 against 1.6), ecosystem (9.4 against 1.1), cost (8 against 5) and portability (9 against 3), and tied on developer ease of use (6 against 6); Webflow is ahead on growth (6.4 against 3.3), performance (7.2 against 5.2), security (8 against 5) and maintenance (9 against 5), and nearly equal on features (7.1 against 7.8) and ease of use for editors (7 against 8). For the platform-specific detail see the WordPress comparison and decision guide and the Webflow comparison and decision guide.
Mainstream picks
The "mainstream" chart shows the CMS with the highest computed popularity in each group: WordPress, Wix, Sanity and AEM.
Figure 48: scores on twelve axes of the CMS with the highest computed popularity in each group: WordPress, Wix, Sanity and AEM. Colours are assigned by position in this figure. The chart compares four different kinds of product, so a larger area is not a recommendation: Sanity leads growth and developer ease of use, Wix leads performance and maintenance, WordPress leads popularity, talent pool, ecosystem and portability, and AEM has the lowest developer ease of use (3), features (3.2) and portability (4) of the four and no cost score.
Strengths and weaknesses
| CMS | Strengths | Weaknesses |
|---|---|---|
The largest share (39.5% of all websites), talent pool (score 8.4), ecosystem (73,152 plugins) and portability (9); features score 7.8; free software. |
The lowest Core Web Vitals pass rate of the traditional group (48.3% on mobile); 91% of its ecosystem vulnerabilities are in plugins; the owner patches; origins down 21% since 2023. |
|
Strong security posture (8), config-as-code and workflows in core, a dedicated security team, 64.7% mobile pass rate. |
A steep learning curve for editors (5) and developers (4); shrinking (-33% origins, 0.6% share); the maintenance score is 4 and a 2026 SQL injection was exploited within two days. |
|
Free software, core workflows and an accessibility checker in core, portability 8. |
The weakest growth (-48% origins), a share that fell from 3.3% to 1.1%, exploited extension flaws in 2026, and the lowest features score of the PHP systems (4.2). |
|
The best mobile pass rate of the traditional group (80.3%), security 8, features 6.8, the longest paid support (ELTS to 2032). |
A steep learning curve (editors 5, developers 4), a small share (0.3%) and a CVE count that rose to 24 in 2025; maintenance 4. |
|
Easy for developers (8) and a clean editing experience (7), a long supported major (Craft 5 to 2030-12-31). |
A small ecosystem (score 2.0, 0.1% of sites), four exploited flaws in 2024 and 2025 and a commercial licence for Team and Pro. |
|
Visual building with a managed platform: maintenance 9, security 8, performance 7.2, growth 6.4 and features 7.1. |
Lock-in (portability 3), a small ecosystem and talent pool (1.1 and 1.6 by the repository-based method), a plan price that depends on sites and seats, and a proprietary closed platform. |
|
The easiest for editors (9), no maintenance (10), the best mobile and desktop pass rates (80.9% and 87.2%), 4.2% of all websites. |
The lowest portability (2), a closed platform for developers (Velo and an app SDK), and 20% fewer detected origins than in 2023. |
|
Easy for editors (9), no maintenance (10), a good desktop pass rate (76.1%). |
The lowest mobile Lighthouse score (30), limited content modelling and export, and euro-only prices on the fetched page. |
|
A mature API-first product with REST and GraphQL, an official MCP server and a growing client-library download count (49.5 million in 2026 to date). |
Pricing could not be verified, the third-lowest mobile pass rate of the sixteen (38.1%) and a proprietary model (portability 5). |
|
The most GitHub stars (73,401), ease of use for developers (8), portability (9) and a free self-hosted edition. |
Few detected origins (14), a low pass rate on the few it has, flat npm downloads and review workflows reserved for the Enterprise plan. |
|
The highest growth (10), ease of use for developers (8) and rapidly rising downloads (28.2 million in 2026 to date). |
The editors depend on a Studio that a developer builds, a proprietary content store and query language (portability 6) and a pass rate of 52.4% on mobile. |
|
The highest features score (8.1), MIT licence (portability 9) and the fastest npm growth. |
No HTTP Archive series, a CVSS 10.0 form-builder flaw in 2026-10 and a young ecosystem. |
|
An enterprise suite on a managed cloud service, with maintenance 7 and Adobe’s partner programme. |
The lowest pass rates (33.9% on mobile), the lowest developer ease of use (3), quote-only pricing hundreds of CVEs a year and an AEM Forms flaw in the KEV catalogue. |
|
Strong growth (+74% origins), a good mobile pass rate (76.4%), MIT licence on .NET and certification in three tiers. |
A small community by stars and questions (ecosystem 4.2), and workflow that needs a package. |
|
Strong growth (+61% origins), ease of use for developers and editors (8 and 7), portability 9 and a built-in accessibility checker. |
Few jobs and no certification, a small share (below 0.1%) and a mobile pass rate of 62.4%. |
|
A focused publishing editor (8), the best mobile Lighthouse score (65), MIT licence and a JSON export. |
A narrow scope by design, few detected origins (2,997) and the lowest talent-pool score (0.0). |
Source: the data and scores of the sections above, 2026-10-29. Strengths and weaknesses are relative to the CMSs of this comparison.
Decision flowchart
The flowchart follows the recommendations below. Start from what the site is for, then decide who will host and patch it, and only then choose between the products that fit.
Figure 49: decision flowchart for choosing a CMS. It is a starting point; check the metrics and caveats above before deciding, and treat the end nodes as shortlists, not verdicts.
Recommendation matrix
The matrix shows how well each group of CMSs fits each purpose, on the evidence of this page: good means the group has a system whose data supports the purpose, possible means it can work with extra effort or a trade-off, and poor means that a documented weakness gets in the way. It is an editorial judgement, and the table after it names the systems and the evidence.
| Purpose | Traditional open-source | Hosted builders | Headless and API-first | Enterprise and other stacks |
|---|---|---|---|---|
Personal site or blog |
Good (WordPress) |
Good (Wix, Squarespace) |
Possible |
Good (Ghost) |
Small business brochure site |
Good (WordPress) |
Good (Wix, Squarespace, Webflow) |
Poor |
Possible |
Design-led marketing site |
Possible |
Good (Webflow) |
Possible |
Poor |
Publication or newsroom |
Good (WordPress, Drupal) |
Possible |
Possible |
Good (Ghost, Wagtail) |
Multilingual corporate site |
Good (Drupal, TYPO3) |
Possible (Webflow Localize) |
Possible |
Good (Umbraco, Wagtail, AEM) |
Government or regulated site |
Good (Drupal, TYPO3) |
Possible |
Possible |
Possible |
Headless multi-channel content |
Possible (headless WordPress) |
Poor |
Good (Sanity, Payload, Strapi, Contentful) |
Possible (Wagtail) |
Enterprise digital experience |
Possible (Drupal, TYPO3) |
Poor |
Possible |
Good (AEM, Umbraco) |
Developer-centred project with a custom front end |
Possible (Craft CMS) |
Poor |
Good (Payload, Strapi, Sanity) |
Good (Wagtail, Umbraco) |
Summary and recommendations
The data snapshot date for every figure below is 2026-10-29, and the data changes monthly (the HTTP Archive and W3Techs figures each month, the NVD and the registries every day). The recommendations are justified only by the data on this page. They name the option the evidence favours first and what to check; they are not rankings, and a team with deep experience of one system can reasonably choose it against the table.
In short. Choose WordPress for a self-hosted site where the largest talent pool, ecosystem and portability matter and where you can pay for managed hosting and plugin vetting, and Webflow for a design-led marketing site that should have no server to run and no patching. For headless content, Sanity (hosted) or Payload and Strapi (self-hosted) are the current choices, Drupal or TYPO3 fit complex multilingual or regulated sites, and Joomla, Drupal 7 and other end-of-life lines should be kept only for existing sites.
Recommendations by purpose
| Purpose | Fits best | Evidence on this page | What to check, and where to read more |
|---|---|---|---|
Personal site or blog |
WordPress (self-hosted or WordPress.com); Ghost for a publication |
WordPress is on 39.5% of all websites with a talent pool score of 8.4; WordPress.com Personal costs USD 4 a month billed yearly. Ghost has an editor score of 8, the best mobile Lighthouse score (65) and a free self-hosted edition. |
Who updates a self-hosted WordPress and its plugins. See WordPress. |
Small business brochure site |
Wix, Squarespace or Webflow; WordPress on managed hosting |
Wix leads the pass rates (80.9% mobile, 87.2% desktop) and has ease of use for editors of 9 and maintenance of 10; Squarespace has the same editor and maintenance scores; entry plans cost USD 15 (Webflow Basic, without a CMS) to USD 17.77 (Wix Light) or EUR 14.52 (Squarespace Basic) a month billed yearly, and Webflow Premium with the CMS USD 25. |
Portability is 2 to 3 for the hosted builders; plan limits (storage, collaborators, CMS items). See Webflow. |
Design-led marketing site |
Webflow |
Performance 7.2, maintenance 9, security 8, growth 6.4 and +21% detected origins since 2023, a 71.3% mobile pass rate and a Premium plan at USD 25 a month billed yearly. |
Lock-in (portability 3), a small talent pool (1.6) and plan limits (20,000 CMS items on Premium). See the Webflow comparison and decision guide. |
Publication or newsroom |
WordPress; Ghost; Wagtail; Drupal for large editorial teams |
WordPress has the largest ecosystem (73,152 plugins), Ghost the highest mobile Lighthouse score, Wagtail an editor score of 7 with workflow and scheduling, and Drupal workflows and moderation in core. |
WordPress workflow beyond the Pending Review needs plugins; Drupal’s learning curve (editors 5). See Django for Wagtail’s stack. |
Multilingual corporate site |
Drupal or TYPO3; Umbraco or Wagtail on their stacks |
Multilingual content is in core for Drupal, Joomla, TYPO3, Craft CMS, Umbraco and Wagtail; TYPO3 has an 80.3% mobile pass rate and security 8; Drupal has workflows and configuration management in core. |
Maintenance 4 for both and steep learning curves; WordPress needs an extension for multilingual content. See PHP and Laravel and ASP.NET. |
Government or regulated site |
Drupal or TYPO3 (open source, security 8); a hosted option whose contract satisfies the rules |
Drupal and TYPO3 have a security team and an advisory process, and Drupal ships workflows and role-based permissions in core. |
This page has no dataset on data residency or compliance attestations ( |
Headless multi-channel content |
Sanity or Contentful (hosted); Payload or Strapi (self-hosted) |
Sanity has growth 10, developer ease of use 8 and 28.2 million npm downloads in 2026 to date; Payload has the highest features score (8.1), an MIT licence and the fastest npm growth; Strapi has the most GitHub stars (73,401); Contentful has an official MCP server and a mature API. |
Contentful pricing could not be verified; the front end sets the performance (see the Web Frameworks Comparison and Next.js); Payload had a CVSS 10.0 plugin flaw in 2026-10. |
Enterprise digital experience |
Adobe Experience Manager if the organisation is already on Adobe; otherwise Drupal, TYPO3 or Umbraco |
AEM is quote-only, has the lowest developer ease of use (3), a 33.9% mobile pass rate and hundreds of NVD CVEs a year, but also maintenance 7 and a partner programme; Umbraco has +74% origins and a 76.4% pass rate on .NET. |
Specialist skills and a long project; compare the total cost with the open-source alternatives. See ASP.NET. |
E-commerce |
See the e-commerce comparison |
Shopify, PrestaShop, Magento and WooCommerce are compared in their own page; Webflow, Wix and Squarespace have built-in e-commerce, and WordPress, Craft CMS, Payload and Umbraco have it by extension. |
|
Developer-centred project with a custom front end |
Payload, Strapi or Sanity; Wagtail or Craft CMS on a PHP or Python stack |
Developer ease of use 8 for all five; Payload and Strapi are open source and portable (9); Wagtail has growth 8.5 and Craft CMS a supported major to 2030. |
A custom front end adds a front-end team and its own performance and security work. See Next.js and React. |
Trends, cautions and legacy
-
Trends to watch. Sanity (+228% detected origins in three years and rising downloads), Umbraco (+74%), Wagtail (+61%) and Webflow (+21%) are the only systems whose detected origins grew in three years, and Payload has the fastest npm growth; each starts from a small base except Webflow.
-
Established, but under pressure. WordPress and Wix lost about a fifth of their detected origins since 2023, and the W3Techs share of WordPress fell for the first time, from 43.6% to 39.5%. They remain the largest by far, so the figures describe a market that is consolidating, not collapsing.
-
Keep for legacy maintenance, avoid for new projects. Drupal 7 (ended 2025-01-05), Joomla 3 (ended 2023-08-17), Joomla 4 (ended 2025-10-14), Craft 4 (security ended 2026-04-30) and Strapi 4 (security ended 2026-06-09) are out of support. Joomla as a whole declines in every popularity signal (origins -48%, W3Techs share from 3.3% to 1.1%, weakest growth), so a new project is better served by another system.
-
Cost and security perspective. The hosted builders minimise labour (maintenance 9 to 10) and move patching to the vendor, which removes the largest class of risk, at the price of portability (2 to 3). Among the self-hosted systems the exploited flaws cluster in extensions and a few core flaws exploited within days, so budget for patching speed and for a short list of vetted extensions.
-
Hiring perspective. WordPress has by far the largest pool (talent score 8.4 and 13.3% of the 2026 survey respondents). TYPO3, Drupal and Webflow have dedicated certification and partner paths; the headless systems draw on JavaScript and TypeScript developers, and Umbraco and Wagtail on .NET and Python ones.
Framework alternatives
When the requirements go beyond content (application logic, a customised user experience, data that is not editorial), a web framework may fit better than a CMS, or a CMS can be used as the editorial back end of a framework-built front end. The Web Frameworks Comparison and the Backend Frameworks Comparison cover Next.js, Laravel, Django and the others; the stacks are described in Next.js, PHP and Laravel and Django.
When you do not need a CMS
A CMS earns its cost when non-developers edit content regularly. A documentation site or a small site edited by developers in Git needs none: a documentation generator or a static-site generator (Hugo, Jekyll, Eleventy or Gatsby, which are out of scope here) gives lower hosting cost, no patching of a database-backed application and no plugin attack surface. See the Documentation Tools Comparison for that choice.
Bibliography
Every source was opened on 2026-10-29 unless it is marked unverified, which means that the page returned an error or a bot wall to automated clients, or that the figure comes from a secondary source.
Popularity, growth and talent pool
-
W3Techs: usage statistics of content management systems (W3Techs, 2026-10-29). Share of websites, market share and yearly history. Used by the market-share table and charts, the growth charts and the popularity score.
-
HTTP Archive Technology Report and the adoption, cwv and lighthouse endpoints (HTTP Archive, monthly until 2026-09). Origins, Core Web Vitals pass rates and Lighthouse medians. Used by the origins, performance and growth sections.
-
Web Almanac 2025: CMS (HTTP Archive, 2025). Context for the CMS shares and vitals; the values are kept in
performance.csv, and the charts use the Tech Report. -
Chrome UX Report (Google). Definition of the field data behind Core Web Vitals.
-
web.dev: INP becomes a Core Web Vital on March 12 (Google, 2024). The break in the Core Web Vitals series.
-
GitHub REST API (GitHub, 2026-10-29). Stars, contributors and releases. Used by the developer-activity figures and the ecosystem score.
-
npm downloads API (npm), Packagist, PyPI Stats and NuGet (2026-10-29). Registry downloads and installs, each compared only inside its registry.
-
WordPress.org plugins API (WordPress.org, 2026-10-29) and WordPress.org statistics. Plugin and theme counts. The Drupal.org project usage page is unverified (bot wall), so Drupal usage is
n/a. -
Stack Exchange API (Stack Exchange, 2026-10-29). Questions per tag and per year, used by the community-question figures and the talent score.
-
Stack Overflow Developer Survey (2023, 2024, 2025 and 2026 editions). Usage, admired and desired.
-
Hacker News "Who is hiring?" through the Algolia search API (2018 to 2026-10). Job demand proxy.
-
The certification and partner pages of the vendors (Acquia, TYPO3, Webflow University, Sanity Learn, Umbraco Training and Adobe Certification), opened on 2026-10-29.
Performance
-
The HTTP Archive Technology Report, the Chrome UX Report and the web.dev INP note above. Used by all Core Web Vitals, Lighthouse and scatter figures.
Security
-
NVD CVE API 2.0 (NIST, 2026-10-29). CVEs per year and CVSS scores.
-
CISA Known Exploited Vulnerabilities catalogue (CISA, 2026-10-28). Exploitation status of the incidents.
-
GitHub global advisory database (GitHub). Advisories for the npm, Packagist, PyPI and NuGet packages.
-
Drupal security advisories, Joomla Security Centre and TYPO3 security advisories. Advisories per year and notable incidents.
-
Patchstack: State of WordPress Security in 2026 (Patchstack, report year 2025) and WPScan. The ecosystem share of WordPress vulnerabilities. Wordfence Intelligence was unverified (HTTP 202 bot wall) and no row depends on it.
Support windows
-
endoflife.date and the official lifecycle policies: WordPress roadmap, Drupal core release cycles, Joomla on endoflife.date (the joomla.org roadmap returned HTTP 404 and docs.joomla.org HTTP 403), TYPO3 roadmap, Umbraco long-term support, Wagtail release schedule, Ghost major versions and AEM release information. Used by the support-window chart and the patching model.
Cost
-
The pricing pages, read on 2026-10-29: Webflow, Wix, Squarespace, WordPress.com, Ghost(Pro), Strapi Cloud, Sanity, Payload, Craft CMS and Umbraco Cloud. Contentful returned HTTP 429 on every attempt (unverified), and Adobe Experience Manager is quote only (the Adobe business pages did not open).
-
The Cloud Providers Comparison of this site, for the hosting costs. The scenario assumptions (hours, hourly rate, extensions) are editorial and are stated in the cost section.
-
ECB euro foreign exchange reference rates, read on 2026-10-29 through the ECB Data Portal API (series EXR/D.USD.EUR.SP00.A): the USD per EUR rate of 2026-10-28 that converts the hosting costs of the total-cost-of-ownership scenarios.
Features and documentation
-
Official documentation of each system, used as evidence for the feature matrix and the ease-of-use scores: WordPress, Drupal source (drupal.org was behind a bot wall) and Drupal licensing, Joomla source, TYPO3, Craft CMS, Webflow, Wix, Squarespace, Contentful (the documentation returned HTTP 429, so the evidence comes from the official GitHub organisation), Strapi, Sanity, Payload, AEM, Umbraco, Wagtail and Ghost.
Related pages of this site