Download websites that use Drupal

About Drupal

On most software a version number is a maintenance detail. On Drupal the version splits the detected sites into populations that share a name and very little else, which is why the version column is the one to read first here.

The project has been developed in the open since 2001, written in PHP, released under GPL v2 and stewarded by Drupal Association alongside a large contributor community. The platform gets chosen where content relationships turn complicated: government portals, universities, hospital groups, newsrooms, membership organisations and internal applications. Sites in the CMS group that land on it are usually sites that had a procurement process rather than a weekend.

As of September 2026 we detect it on 266,592 sites, and we see 51 distinct version strings across them, with 7 still carrying a substantial share. Fragmentation on that scale is not laziness. Major upgrades in this project are rebuilds rather than updates, because themes and contributed modules have to be ported and content migrated, so a site left on a legacy line reflects a budget decision somebody deferred rather than a button nobody pressed.

Deferred budget decisions are what several industries sell into. Agencies quote migrations and want to know who is due one. Security vendors and insurers care about unsupported code running in regulated sectors, and legacy installations in health, education and local government are exactly where that concern lands. Hosting companies and competing platforms pitch the same sites from opposite directions. A list of installations segmented by version string is the raw material for all of those conversations, and a per-domain lookup cannot produce it, because the value only appears once the whole population is sorted at once.

A detection also says something about the organisation, not only the code. Choosing this platform normally means a specification was written, an agency was engaged, and a budget line survived a committee, so the sites in this population tend to come with procurement cycles, framework agreements and multi-year support contracts attached. Selling into them is slow and the contracts are large, which suits some vendors and rules the segment out for others. Knowing which sites they are before the pitch is written is the practical use of the list.

Geography needs the same care. 86,108 of the detections sit in United States and .com carries much of the population, but institutional deployments hide behind national and sectoral suffixes that a generic count will understate, so filtering on suffix and country together lands closer to the real picture than either does alone.

Version recognition here rests on a handful of disclosures: a generator declaration in the markup, the paths and query strings on core assets, and files left in the document root. Major line detection is considerably more dependable than point release detection, so a bucket of legacy versus current is a claim the data supports, while treating an exact string as the site's true patch level is not.

The version data comes with a limit that should be stated rather than buried. Hardened installations deliberately suppress version output, and the administrators who bother to suppress it tend to be the ones running high-value sites with someone competent looking after them. The observed distribution therefore leans toward installations that expose themselves, and any count of legacy sites should be read as a floor rather than a census. Stated plainly, the row is still the useful one, because a floor drawn from a full population beats a confident number drawn from a sample, and the sites that do disclose their release are precisely the sites where a stale release matters most.