Drupal

Drupal is an open source content management system, and it sits at the more technical end of the category. You install it on hosting you control, it is free to use and modify, and nobody can restrict what you build with it. That much it shares with other open platforms. What sets it apart is how far it leans towards being a framework rather than a finished product.

Its content model is the reason. Rather than assuming your site is made of posts and pages, Drupal lets you define your own content types, with your own fields and your own relationships between them, and then build views onto that data. That flexibility is why it turns up so often behind government sites, universities, hospitals and large organisations with complicated, structured content and strict requirements. It is also why it asks more of whoever sets it up.

What a Drupal site publishes about itself

All of the following is visible in ordinary page source on a published site. We checked each one against live Drupal sites while writing this page.

The theme

Themes live in a predictable folder, and every stylesheet and script a theme loads carries that folder in its path, named after the theme itself. Large organisations usually run a custom theme named after the organisation, which makes the site easy to identify but tells you little about how it looks. Sites using one of the themes that ship with Drupal are more informative, because those names are recognisable and tell you roughly which generation of the software you are looking at.

Modules

Modules are how Drupal is extended, and they follow the same pattern: any module loading assets on the front end names itself in the file path. This is often the most revealing part of the source, because module names describe what the site actually does, whether that is security hardening, search, media handling, workflow or integration with other systems. Modules doing their work purely on the server leave nothing visible, so what you can see is a floor rather than the full list.

The version

Drupal adds a generator tag naming itself and its major version. Plenty of sites remove it, since publishing your version to anyone scanning for known weaknesses is poor practice, and its absence is itself mildly informative. Even without it, the software's structure gives the generation away.

The file paths that give it away

This is the most reliable signal of all. Drupal serves uploaded files from a distinctive directory structure that is unlike anything else and rarely changed, because changing it breaks things. Newer versions also embed a block of settings data in the page for their front-end code, which is unmistakable once you have seen it. Between the two, a Drupal site is hard to disguise even when the generator tag has been stripped and the theme has a meaningless custom name.

Why Drupal turns up where it does

Its reputation is built on two things. The first is the content model already described, which handles genuinely complicated structures without strain. The second is its security process: Drupal has a dedicated security team, a formal disclosure procedure and a long record of coordinated fixes, which is exactly what an organisation with compliance obligations needs to see before choosing a platform.

The trade-off is the learning curve. Drupal expects you to model your content properly before you build, and rewards teams who do. For a small brochure site that overhead is hard to justify, which is why you rarely see it there and often see it behind organisations whose content genuinely is complicated.

When detection gets harder

• Aggregated assets. Drupal can combine and compress stylesheets and scripts, which strips the recognisable theme and module names out of the paths.
• A content delivery network in front. Assets served from another domain can obscure the folder structure that would otherwise identify the site.
• Decoupled setups. When Drupal is used only to manage content and something else renders the pages, the public site may show very little of it.
• Deliberate hardening. Removing the generator tag is standard practice on security-conscious sites, and it does remove the easiest signal.

Even so, the file path structure is stubborn. It usually survives all of the above, which is why it is the signal worth checking first.

Frequently asked questions

Can you detect which Drupal theme a site is using?

Usually yes. Themes live in a predictably named folder and every file the theme loads carries that folder name in its path, so the theme name appears throughout the source. The catch is that large Drupal sites tend to run custom themes named after the organisation, so you learn the theme's name without learning anything about the design.

How can you tell a site is Drupal if the generator tag has been removed?

By its file paths. Drupal serves uploaded files from a distinctive directory structure that is rarely altered because altering it breaks things, and newer versions embed a recognisable block of settings data in the page. Either one is enough to identify the software with confidence.

Can you see which Drupal modules a site uses?

Often, yes. Any module that loads a stylesheet or script on the front end names itself in the file path, and module names tend to describe what they do. Modules working entirely on the server side stay invisible, so treat what you can see as a minimum rather than a complete list.

Is Drupal free?

The software is free and open source, and you can download, modify and run it without paying for a licence. The costs are hosting, and the expertise to build and maintain the site, which for Drupal is usually the larger of the two given how much it can be configured.

Why is Drupal used by so many government and university sites?

Because of how it handles structured content and how seriously it treats security. Organisations with complicated content requirements and formal compliance obligations get a content model flexible enough to describe what they actually publish, and a dedicated security team with a documented disclosure process behind the software.

Is Drupal a CMS or a framework?

Both, and that is the honest answer rather than a dodge. It works as a content management system out of the box, and its architecture is open enough that teams routinely build applications on it that go well beyond publishing. Which one it is depends entirely on how far the people building the site chose to take it.

Drupal is one of the more legible platforms to inspect, precisely because it is open and installed rather than rented. If you want to build on it, the software is free and the real question is whether your content is complicated enough to need it.

Try Drupal