WordPress vs Drupal: The CMS Showdown

Author: Jack Martin

When creating your business’s website, it is important to figure out which web framework is right for you. Content Management Systems (CMS) allow you to make site edits yourself, without the need to know any code. You can have multiple users with restrictions on what they can do, content can be scheduled, and you don’t have to wait for a developer to update your website.

This article will focus on two of the largest open-source, free Content Management Systems you have to choose from: Drupal and WordPress. While sharing similar aspects, both platforms have many considerable differences that will make an impact on your business and the content you choose to put on your website.

We will explain key areas in which the Content Management Systems differ from each other, which will hopefully give you a better understanding on which platform is right for your company.


When it comes to the protection of your website, there are some important notes to consider. Because WordPress is such a popular CMS, it is an appealing target for hackers. WordPress’ code isn’t as robust as other CMS’ in terms of security, lacking some important and popular security features by default.

This means that you will either end up needing to install a variety of plugins in order to force those security features, or you will need to code in some protection yourself. To help to ensure total protection of your online information and also cut down on the site speed lost to hackers trying to gain access, it is also suggested that you use a host that will cater to WordPress’s needs specifically, such as WP Engine.

Drupal comes with enterprise level security, which is trusted by top government websites such as whitehouse.gov. It has built-in IP blocking and effective brute force protection, in a way that won’t slow down your servers. Additionally, It tells you when an update is unsupported, or when a security update is needed, making for quick and assured updating of the CMS’ software.

Winner: Drupal


With Drupal, you no longer need to hire a designer to edit images for the website as you are able to easily create custom Image Styles through the admin interface when logged in which scale, crop and apply effects to images in any way you’d like. For example, you are able to upload a standard, unedited photo to the image upload field and the image styles willscaledown the image and crop it to an appropriate size, in the shape of an arrow, with the image fading to transparent at one end.

WordPress does not have this feature by default, and there is no way to limit the upload size of media unless you edit the site configuration file to change the limit for all files as a whole – there isn’t a way to change these settings through the admin interface when logged in, and you cannot make it specific to the type of file (it will apply this limit to everything). For this reason, the server can quickly get filled up by site editors uploading huge PDFs, Docs, and Images, and the Bandwidth limit will be hit and exceeded quickly.

There is one WordPress plugin that can help but only with images. Drupal allows you to apply custom maximum upload size limits to each file field uploader on the site and also has a setting to limit upload size for files uploaded through the content editor.

Winner: Drupal

Software Updates

When using either platform you need to take caution when updating major versions of the core code (tip: always backup the site and database files first). WordPress core version updates are currently easier and often take less effort. Drupal major core version updates are difficult and sometimes just end up with a redesign because it’s much easier (Drupal 6 to 7 or Drupal 7 to 8, for example). But they plan to change this in the near future, following Drupal 8.

If you are using WordPress you have to install the Updates Notifier plugin in order to get email alerts for updates to themes, plugins, and core code. When you do receive an update notification, you must determine if it’s security-related by reading the changelogs. Sometimes the changelog is not updated or accurate, leading towards the possibility of being unaware that there is a major security hole present on your website.

Winner: Tie, Actual Update – WordPress; Awareness – Drupal


The flexibility Drupal offers users for editing the layouts and design on their own is very limited. This is why WordPress continues to be a leader in the CMS wars. If you have the time, you could build a custom, secure, UI-friendly WordPress theme with drag and drop functionality, giving site editors the option to create and edit custom page layouts easily, all by themselves. You just need to make sure it’s coded to WordPress standards so the code is secure.

On the other hand, Drupal websites are built according to custom designs and coding typically performed by the developer or agency. There are ways to code in some of this functionality, but it’s nowhere near what you can offer with WordPress at the moment. Drupal would be good for users who don’t require too many design changes.

Winner: WordPress

Both Drupal and WordPress are powerful systems that can help your business thrive in an online setting. However, at Keystone Click, we believe that Drupal offers more attributes to help your company succeed in an online setting. If you would like further details on both options, feel free to drop us an email here.