Drupal

This content was generated with the assistance of AI and should be verified against the official Drupal documentation before being relied on in production.

This sub-section’s Drupal bibliography lists the reference material consulted while preparing these pages.

Drupal is a free and open-source content-management framework written in PHP on top of Symfony components. It stores structured content in entities and fields, keeps site configuration in exportable YAML, renders pages through render arrays and Twig, and exposes the same content through JSON:API, REST, GraphQL and the Model Context Protocol. It runs very large sites and small ones from the same code base, and its distinguishing strengths are content modelling, roles and permissions, multilingual support, a configuration-management workflow and a long security track record. This sub-section explains it from the first composer create-project to a module that syncs museum objects from an API and a headless kiosk that reads them back.

Who this sub-section is for

  • Site builders and editors who model content types, fields, taxonomies, media, menus, blocks, views and layouts, set up roles and a moderation workflow, and write content in CKEditor 5 or Canvas without code.

  • Administrators who install Drupal with Composer and DDEV, configure settings.php per environment, manage configuration between environments, apply security updates, tune caching and cron, back up and restore, and harden a production site.

  • Themers who generate a theme with Starterkit, write Twig templates, preprocess functions, libraries and Single Directory Components, and make the result responsive, accessible and fast.

  • Module developers who write modules with services, OOP hooks, plugins with PHP attributes, routes, forms, entities, queues, the Update and Migrate APIs, tests and Drush commands, and who ship them through CI.

  • Architects and front-end developers who run Drupal as a headless back end behind Next.js, and teams that connect it to AI providers and AI agents.

The running example: Meridian Museum

Every page uses one fictitious scenario, the Meridian Museum, a regional science museum whose site is built step by step. The figure shows how the parts fit together.

Map of the Meridian Museum site: content model, theme meridian, module meridian_collection, recipe meridian_events, a JSON:API kiosk and AI with MCP

  • Content: exhibitions (content type exhibition with dates, gallery and hero media), events (event, with a date range and ticket link), news, basic pages (Visit, Accessibility, About) and a collection of objects, a custom content entity collection_object with the fields accession_number, period, material, dimensions and on_display. The taxonomies are topic and gallery, and the media types are image, document and remote video.

  • People: the roles Administrator, Content Editor, Curator, Reviewer and Member (a logged-in visitor), with a draft, review and published moderation workflow.

  • Languages: English (default) and Spanish, with translated content, configuration and interface.

  • Theme: meridian, generated with Starterkit, with Single Directory Components (card, hero, exhibition-teaser and opening-hours), responsive images and a Canvas code component, ticket-banner.

  • Module: meridian_collection, with the custom entity, routes and a controller, a settings form, a service, an event subscriber, OOP hooks, the block plugin "On display now", a field formatter for accession numbers, a queue worker that syncs objects from a fictitious collections-management API, the Drush command meridian:sync, an Update API post-update, a Migrate source for a CSV import and an access policy for curators.

  • Recipe: meridian_events (content type, fields, view and permissions), applied to a fresh site.

  • Operations: DDEV locally, Docker Compose for CI, staging and production with configuration management, Redis, Varnish, cron, Automatic Updates and backups.

  • Headless and AI: a Next.js gallery kiosk over JSON:API with Simple OAuth, the AI module generating alt text, and the MCP Server module exposing collection search to an AI agent.

No real names, tokens or credentials appear anywhere; secrets always come from environment variables or are obvious placeholders.

Check date and version baseline

Everything in this sub-section was checked against the official documentation on 2026-10-30. The state of the platform on that date is:

Item State on 2026-10-30 What the pages assume

Drupal 11

11.4.0 was released on 2026-07-01 and 11.4.x is the current production branch (11.4.11 is its latest patch release). 11.5 is scheduled for December 2026.

New sites start on Drupal 11.4. Examples are written for 11.4.x.

Drupal 12

Scheduled, not released: 12.0.0 is planned for the week of 2026-12-07. It requires PHP 8.5 and Symfony 8, and it refuses to update from 11.2 or earlier.

Described as an upcoming event. Preparing for Drupal 12 explains how to get ready.

Drupal 10

End of life is scheduled for 2026-12-09. Its last minor is 10.6, and from 10.6 the upgrade target is 11.3 or later.

No page recommends starting a new site on Drupal 10. Upgrading Drupal 10 to 11 covers the move.

Drush

Drush 13 serves Drupal 10.2 and later and 11; Drush 14 serves 11.3 and later and 12.

Install it per project with composer require drush/drush.

PHP

Drupal 11.4 runs on PHP 8.3 and later.

Examples use PHP 8.3 or later syntax.

Drupal uses semantic versioning: a feature minor ships about every six months (June and December), bugfix releases usually come on the first Wednesday of a month and security releases on the third, and security advisories cover the two most recent minors only. Drupal Versions, Release Cycle and Support explains the cadence, the support windows and where to follow change records. Dates marked "scheduled" or "planned" are plans, not facts.

Many older books and tutorials describe Drupal 10.0 or 10.1. They show plugin annotations (attributes since 10.2), hooks only as .module functions (OOP hooks since 11.1), module upload from the administration UI (removed in 10.4 and 11.0), the Article and Page content types created by the Standard profile (no longer created in 11.4), Drush commands declared with annotations and a drush.services.yml file (gone in Drush 13) and Drupal 11 as a future release. Where Older Books and Tutorials Are Outdated lists each point with its correction.

Which pages should I read?

If you want to …​ Read

Build a site without code

Introduction and Architecture, Installation with Composer and DDEV, Content Types and Fields, Taxonomy, Media, Views, Users, Roles and Permissions, Content Moderation, Layout Builder, Canvas and Drupal CMS

Run a site

Requirements and Hosting, settings.php and Environments, Configuration Management, Updates and Security Advisories, Performance and Caching, Security Hardening, Backups, Deployment and CI/CD and Docker and Containers

Build a theme

Theming Overview, Starterkit and Subthemes, Theme Info Files and Regions, Twig Templates, Suggestions and Preprocess, Libraries and Assets, Single Directory Components and Accessibility and Performance

Build modules

Module Anatomy, Services, Hooks, Plugins, Routing, Form API, Entity API, Custom Entity Types, Automated Testing and Drush

Go headless

JSON:API, REST, GraphQL, Authentication and OAuth and Decoupled Drupal with Next.js

Use AI and agents

The AI Module and Providers and MCP Server and AI Agents

Upgrade an old site

Versions and Support, Migrating from Drupal 7, Upgrading Drupal 10 to 11, Removed Core Modules and Preparing for Drupal 12

Decide whether Drupal fits

Comparison and Decision Guide

Check what an older book or tutorial got wrong

Where Older Books and Tutorials Are Outdated

Get a one-page printable summary

Cheat Sheet (PDF)
mindmap root((Drupal)) Getting Started Versions and support Requirements and hosting Composer and DDEV Drupal CMS Site Building Content types and fields Views and display modes Roles and moderation Canvas and Layout Builder Administration Configuration management Updates and security Caching and performance Backups and hardening Theming Starterkit Twig and preprocess Single Directory Components Module Development Services and hooks Plugins and entities Forms and routes Testing APIs and Headless JSON:API GraphQL OAuth Next.js kiosk Tooling and Delivery Drush CI and Docker Coding standards Upgrades Drupal 7 migration Drupal 10 to 11 Drupal 12 AI AI module MCP Server

What’s covered

Getting Started

What Drupal is, how releases and support work, what a server needs, how to install with Composer and DDEV, Drupal CMS and the project layout.

Site Building

Modelling content and presenting it without code: fields, taxonomy, media, editors, menus, blocks, Views, display modes, layouts, Canvas, roles, moderation, Workspaces, languages, search and visitor forms.

Administration

Running a site: settings per environment, configuration management, updates and advisories, recipes, cron, caching, hardening, files, backups, multisite, logging and the administration interface.

Theming

Starting a theme and shaping markup: the render pipeline, Twig, preprocess, libraries, Single Directory Components, responsive images, theme settings, tooling, accessibility and mail templates.

Module Development

Writing modules: anatomy, services, hooks, plugins, routes, forms, entities, events, configuration, the database, access, queues, updates, AJAX and HTMX, translation, Migrate and tests.

APIs & Headless

Using Drupal as a content back end: JSON:API, REST, GraphQL, authentication with OAuth and a Next.js front end.

Tooling & Delivery

Drush, coding standards, static analysis, CI/CD, containers and contributing to the community.

Upgrades

Moving forward: Drupal 10 to 11, Drupal 7 migrations, removed core modules and preparing for Drupal 12.

AI

The AI module with its providers and the MCP Server module for AI agents.

Reference

Outdated advice, a comparison with other platforms and a one-page cheat sheet.

Related material elsewhere on this site

Page Why it is related

CMS (Content Management System)

The overview of all CMS sub-sections.

CMS Comparison

Cross-CMS metrics and a decision table; the Drupal decision guide links to it instead of repeating it.

WordPress and Webflow

Sibling sub-sections, for the cases where another CMS fits better.

Joomla

The other PHP CMS sub-section of this site.

PHP and Laravel

PHP web development; its introduction places Drupal among PHP platforms.

PHP

The language itself: Composer, PSR standards, PHPUnit, static analysis, OPcache and debugging.

Backend Frameworks Comparison

Server-side frameworks as an alternative to a CMS.

Docker and Kubernetes

Containers and orchestration behind Docker and Containers.

SQL and Redis

MySQL, MariaDB and PostgreSQL background, and the Redis cache back end.

React, Next.js and CORS

The front end of the gallery kiosk and the cross-origin rules it needs.

Web Accessibility

Background for the accessibility pages of the theming group.

End-to-end Testing

Browser-level testing tools used next to Drupal’s own Nightwatch and functional tests.

OAuth

Background for Authentication and OAuth.

Model Context Protocol

Background for MCP Server and AI Agents.

E-commerce Comparison

Online shops; Drupal Commerce is out of scope here.

Bibliography

Every source below is the official site, repository, release note or documentation page of the product, library or service it supports, and each entry links to it. The links were collected on 2026-10-30 from the == References section of every page in this sub-section, where each page lists the exact pages its facts and examples derive from. Drupal documentation is revised continuously: open an entry and confirm its content and version before you rely on it. Where this bibliography and a page’s own References section appear to disagree, the official documentation linked from the page wins. An entry marked "(unverified)" is a publisher link built from the book’s ISBN that was not confirmed on 2026-10-30; if it does not open, search the publisher’s site for the ISBN.

Books

These books were compared with the official documentation for structure, recipes and operational practice. They describe Drupal 10.0 and 10.1, so where they disagree with the current documentation the pages say so in their own words, and Where Older Books and Tutorials Are Outdated collects the corrections. No text, code or figure is copied from them.

  • Matt Glaman and Kevin Quillen, Drupal 10 Development Cookbook, 3rd ed. (Packt Publishing, 2023), ISBN 978-1-80323-496-0: Packt product page (unverified).

  • Adam Bergstein, Drupal 10 Masterclass (Packt Publishing, 2023), ISBN 978-1-83763-310-4: Packt product page (unverified).

  • Luca Lusso, Modernizing Drupal 10 Theme Development (Packt Publishing, 2023), ISBN 978-1-80323-809-8: Packt product page (unverified).

Drupal User Guide

Getting started, administering, updating and upgrading

Core modules, contributed modules and extending Drupal

Develop: modules, theming, testing and decoupled Drupal

Drupal APIs

Projects, releases, security and community pages

Change records and issues

Drupal API reference (api.drupal.org)

Project documentation on drupalcode.org pages

Source repositories on git.drupalcode.org

Drush

DDEV

Other projects, standards and tools

References