Drupal or Wordpress for Security and SEO Success?

[brandnow]

Allow me to provide a little background.

Years ago I developed a few high profile web sites based on Drupal. I like Drupal and it's familiar. I have used Wordpress before too, but I have only done basic testing and playing around with Wordpress.

Both are very popular. Wordpress people say is easy, but Drupal is more familiar to me.

THE PROBLEM: Right now Drupal is in between major releases. Between Drupal 7 and Drupal 8. And I have also not developed any web sites in 3 or 4 years, so I have been " out of the game" as it were.

As I want to get started on developing several new web sites right away. What do you guys suggest? Should I be using Drupal 7 in hopes that it will be easy to upgrade to Drupal 8 in the future? Or have you used both, and would you suggest that I finally make the leap to Wordpress, and begin anew?

My three biggest concerns with this choice.

#1) I need SECURE web sites. I will have 'sensitive' and perhaps controversial articles on these web sites. People like to say that Drupal is more secure than Wordpress, because less sites use Drupal, and perhaps the code of Drupal is also better.. and there are less extensions for Drupal (which means less vulnerability?). But I need some opinions on this one.. is Wordpress REALLY any less secure Drupal?

#2) Now that Google has gone all mobile friendly and sites that are not the most mobile friendly are being punished. How does Drupal 7 compare to Drupal 8 or especially how does Drupal 7 compare to Wordpress in terms of being seen by Google as "mobile friendly." And if I go for Wordpress what are the latest and greatest extensions to make Wordpress mobile and SEO friendly? This is kind of a big concern obviously, but I am interested in the latest opinions. A lot of articles I find through search seem outdated.

#3) Drupal vs. Wordpress? Has anyone used both extensively? I am not the most tech savvy person. I generally do not code, and instead opt to use the tools, extensions, themes, etc. that are already available. With your experience of Drupal 7 and the latest version of Wordpress. Which do you find better?

I really need to get more input from developers before I make a final decision. And I need to make a final decision within the next week or so.

 

[ramkumaritrvs]

Wordpress is growing very fast.

In last 6 months they released lot of versions, so always you have to stay with your developer.

I loved drupal but more people moved to wp just b'coz, lot of plugins & themes availability.

you can create whatever website with wordpress but drupal is not have that much plugins & themes.

I suggested you to stick with wordpress & read security blog's to know the latest vulnerability.

 

[DU]

One thing I like about Wordpress.. but I installed it a few weeks ago to test it out a bit.. is that it updates automatically.. but from reading your post.. I wonder do you have auto-update switched off.. and do you update it manually?

You should never allow updates to a production site automatically ESPECIALLY if security is a concern.

Drupal 7 will be supported for a while so I wouldn't worry too much about that. I think the upgrade to Drupal 8 will be better than 6->7.

The real question is what are you looking for? Wordpress and Drupal have and serve different needs differently. If you are providing a commercial large business product I believe you are better with Drupal (or other options) than Wordpress.

Some of it would be for selfish reasons.

 

[Compassion]

It's been years since I used drupal, but I can say that wordpress seems to work well with SEO. Also as mentioned by ramkumaritrvs - there are so many plugins and themes that integrate into wp making it simple to develop a clean site with features.

Some WP themes are designed to look great on all desktops/tablets/phones - so having to put in code for optimal resolution for each device isn't necessary. Knowing code also helps customize WP sites.

 

[TheWatcher]

@brandnow security is a continuous process not a product. Whether you use WordPress or Drupal or Joomla, they will be vulnerable in time. It's how you approach securing your website, how fast can you update it.

A good example is after the WordPress update to 4.2, security researcher find out about the XSS vulnerability. The day after, WordPress released 4.2.1 to patch it.
Read it here. http://www.king.net/wordpress-4-2-is-affected-by-zero-day/

I moved all my websites from joomla and drupal to WordPress for simple reason. I can update the security of WordPress using the control panel, run update on the site, no need to FTP files. Anyway, I have a Managed WordPress, they update my core automatically once a new release is available.

Hope this help.

 

[Robby Chanly]

Wordpress is more famous and very fast in version update, this is important for security.

 

[Tia Wood]

#1)

As @TheWatcher said: security is a continuous process not a product. Wordpress is very conscious about security and fast about getting patches out. See: https://wordpress.org/news/category/security/ and http://codex.wordpress.org/Hardening_WordPress and https://wordpress.org/about/security/

#2)

I can't answer for Drupal but there are many modern themes that support mobile friendliness on Wordpress. Usually using the term 'responsive design'. http://themeforest.net is a good resource for that (make sure you select the Wordpress subcategory)

#3) Good comparison here:
http://websitesetup.org/cms-comparison-wordpress-vs-joomla-drupal/

 

[cron]

Allow me to provide a little background.

Years ago I developed a few high profile web sites based on Drupal. I like Drupal and it's familiar. I have used Wordpress before too, but I have only done basic testing and playing around with Wordpress.

Both are very popular. Wordpress people say is easy, but Drupal is more familiar to me.

THE PROBLEM: Right now Drupal is in between major releases. Between Drupal 7 and Drupal 8. And I have also not developed any web sites in 3 or 4 years, so I have been " out of the game" as it were.

As I want to get started on developing several new web sites right away. What do you guys suggest? Should I be using Drupal 7 in hopes that it will be easy to upgrade to Drupal 8 in the future? Or have you used both, and would you suggest that I finally make the leap to Wordpress, and begin anew?

My three biggest concerns with this choice.

#1) I need SECURE web sites. I will have 'sensitive' and perhaps controversial articles on these web sites. People like to say that Drupal is more secure than Wordpress, because less sites use Drupal, and perhaps the code of Drupal is also better.. and there are less extensions for Drupal (which means less vulnerability?). But I need some opinions on this one.. is Wordpress REALLY any less secure Drupal?

#2) Now that Google has gone all mobile friendly and sites that are not the most mobile friendly are being punished. How does Drupal 7 compare to Drupal 8 or especially how does Drupal 7 compare to Wordpress in terms of being seen by Google as "mobile friendly." And if I go for Wordpress what are the latest and greatest extensions to make Wordpress mobile and SEO friendly? This is kind of a big concern obviously, but I am interested in the latest opinions. A lot of articles I find through search seem outdated.

#3) Drupal vs. Wordpress? Has anyone used both extensively? I am not the most tech savvy person. I generally do not code, and instead opt to use the tools, extensions, themes, etc. that are already available. With your experience of Drupal 7 and the latest version of Wordpress. Which do you find better?

I really need to get more input from developers before I make a final decision. And I need to make a final decision within the next week or so.

Wordpress all the way....forget drupal unless it is something wordpress cannot do.

 

[DU]

Wordpress all the way....forget drupal unless it is something wordpress cannot do.

You should add the word "well" and "properly" to the end of that sentence

 

[brandnow]

Forget about Drupal 7 or 8, you should build your website on Wordpress because it is more secure and SEO friendly than Drupal. No need to worried about its security because in Wordpress your website is secure.

Cool thanks! I think I've decided on Wordpress for all of my new sites, except for one site which I've already started developing on Drupal.

It's just kind of a shame only because I used Drupal for years and consider myself a non-technical Drupal "professional." So I'm going to have to learn the Wordpress interface from scratch, which will take some time. I know it's "easy".. it's just learning something new. But I LOVE the fact that Wordpress is updated regularly and automatically.. whereas Drupal only gets updated is major updates every few years.. and who the heck knows when Drupal 8 will be finished.. and there's still even no automatic updates for Drupal. I loved Drupal a lot for several years. But I GUESS it's time to move on. I don't have as much time as I did in the old days to play around with it and patiently wait for updates.

 

[ulterios]

Having worked with both, I would always choose WordPress for most websites.

There is a lot of info, both B.S. and otherwise about WordPress not being as secure as Drupal. Straight out of the package (just the CMS/etc.), maybe Drupal feels more secure. By feels, I mean that you hear about hacked sites less. That's in part (a big part) because there are less websites using Drupal vs. WordPress and the difference is growing.

I am by no means an expert on either but I do have dozens of developed websites and all of them are built on WordPress. I have over a hundred other sites that are built with basic WordPress installs (not much on them but 3 pages) that are just for sales leads, page indexing, etc...

If you know how to secure a WordPress website then you will be fine. WordPress also has a countless amount of plugins to suit just about any need if you aren't familiar with code yet (I'm Not), I would recommend that you do keep your plugins to a minimum though as there are a few negative affects like page load times, server RAM usage, security (with some plugins),etc...

I did have a couple of my WordPress sites get hacked when I first started using it but now I have come across a couple of things I now do and a couple of plugins that I now use and I have never had a hacked sites since using these.

It is also a lot easier to find and get any needed help with WordPress, it's themes or plugins. This is in part due to the sheer number of people who use and know WordPress.

If I had to choose, it would be WordPress for sure! If it was a large business/commercial website then I might consider Drupal, as that is what it is best suited.

 

[brandnow]

Having worked with both, I would always choose WordPress for most websites.

There is a lot of info, both B.S. and otherwise about WordPress not being as secure as Drupal. Straight out of the package (just the CMS/etc.), maybe Drupal feels more secure. By feels, I mean that you hear about hacked sites less. That's in part (a big part) because there are less websites using Drupal vs. WordPress and the difference is growing.

I am by no means an expert on either but I do have dozens of developed websites and all of them are built on WordPress. I have over a hundred other sites that are built with basic WordPress installs (not much on them but 3 pages) that are just for sales leads, page indexing, etc...

If you know how to secure a WordPress website then you will be fine. WordPress also has a countless amount of plugins to suit just about any need if you aren't familiar with code yet (I'm Not), I would recommend that you do keep your plugins to a minimum though as there are a few negative affects like page load times, server RAM usage, security (with some plugins),etc...

I did have a couple of my WordPress sites get hacked when I first started using it but now I have come across a couple of things I now do and a couple of plugins that I now use and I have never had a hacked sites since using these.

It is also a lot easier to find and get any needed help with WordPress, it's themes or plugins. This is in part due to the sheer number of people who use and know WordPress.

If I had to choose, it would be WordPress for sure! If it was a large business/commercial website then I might consider Drupal, as that is what it is best suited.

It's honest opinions like this that were exactly what I was looking to get from this thread. Thanks man.

By the way, would you mind sharing a few of the things you do or plugins you use to make Wordpress more secure?

 

[ramkumaritrvs]

would you mind sharing a few of the things you do or plugins you use to make Wordpress more secure?

Personally i'm using https://wordpress.org/plugins/bulletproof-security/ for all my websites.

it provides more security options via .htaccess. read and then apply.

 

[Alice Wonder Miscreations]

I would personally never use WordPress. They do things like emulate magic_quotes_gpc which was taken out of php for a reason, their database handler doesn't really used prepared statements - it just tries to emulate them with printf - which has resulted in many of the security issues in plugins, etc., gravatar which is enabled by default is a privacy breach, etc.

I don't know that drupal is any better as I don't do anything with it but everytime I write a plugin for wordpress (I don't use it myself, but I code what I'm paid to) I lose hair over finding something new that just drives me insane wondering why they did it that way.

WordPress has an easy install and lots of plugins, but I don't think it will ever really be secure.

Try bringing up the bad design security issues on their forums and the devs just don't want to hear it.

 

[Alice Wonder Miscreations]

If you are vigilant updates you will probably be okay with WordPress. Those I know who use it, with about 80 different blogs, every now and then one gets compromised and usually all that happens is things like casino links get inserted into content. Not the end of the world.

I don't like WordPress but yes, if you have content you need to get out, WordPress is better than not getting it out at all.

 

[brandnow]

I found this article interesting: http://www.commonplaces.com/blog/drupal-vs-wordpress-–-why-considering-the-future-is-important

and

https://wpml.org/2013/11/drupal-developers-make-x10-wordpress-developers/

this too

http://mikeschinkel.com/blog/17-reasons-wordpress-is-a-better-cms-than-drupal/

 

[james haw]

It's been a while since I used Drupal, but from what I remember, the learning curve is much greater than Wordpress, however Drupal is more pliable than Wordpress in some ways, often useful ways.

Also, (again from memory and years ago) Drupal Core is about objects (OOP) and use better approaches in the back end, where Wordpress is just a load of user defined functions glued together and called all over the place (this is an old way of doing things).

While this doesn't necessarily make one better than the other, I personally prefer to trust something which is made in a more robust and frameworky manner - ie MVC, better sanitisation in the core rather than relying on 3rd party public plugins, parameterised statements, etc. While crap plugins will always be written and exist for any CMS which allows publicly shared plugins, a better Core (ie objects) often means developers will write better plugins (or at least they have the ability to do so).

That said, Wordpress is generally secure, and easier to get started, get a template for it, and even configure plugins etc.

The main issue with Wordpress is Wordpress folks make the CMS and the public make the plugins. So, as often happens, the new Wordpress update is not compatible with some of your plugins. So you either don't update Wordpress for a while waiting for plugins to catch up, or end up with plugins which malfunction in some way. This is an urky setup to have to manage, especially when we should update ASAP to be secure etc.

AFAIK Drupal suffers from the same issue, but a bit less of a problem as I believe Drupal has more "built-in" functionality, so chances are something basic you need (like contact form) will be part of the Drupal system and so updates will be fine along with the core.


It's hard to compare any system to another as often they have different functionality. While Drupal and Wordpress are both "CMS" to build sites with, their approach and thus functionality and usability are quite different. It's like comparing apples and oranges. So depends on the requirements.


Wordpress is easy to use, easy to install, easy to manage. Drupal can be tricky to learn, but it offers much more than Wordpress in some ways, eg Drupal has a fully fledged forum, where Wordpress has, comments.

Wordpress is very quick and easy to install, download and add a template, and get your site online, Drupal takes a bit more time, but can be more worthwhile (depending on your needs).

THE PROBLEM: Right now Drupal is in between major releases.

Not any more

#1) I need SECURE web sites. I will have 'sensitive' and perhaps controversial articles on these web sites.

If this is for you then both are secure, as long as updated.
If for clients, then you should use Wordpress, as they can learn it easier, and any problems and you can say it's mainstream - "used by more than 23.3% of the top 10 million websites as of January 2015" "60 million sites use it" etc.

People like to say that Drupal is more secure than Wordpress, because less sites use Drupal, and perhaps the code of Drupal is also better.. and there are less extensions for Drupal (which means less vulnerability?). But I need some opinions on this one.. is Wordpress REALLY any less secure Drupal?

Yes today, no tomorrow.
Drupal is more secure when Wordpress has a vulnerability, and vice versa, when both are updated, and no-one has found issues, they are both secure. One not really more than another. This wasn't the case years ago, but it is now.

How does Drupal 7 compare to Drupal 8 or especially how does Drupal 7 compare to Wordpress in terms of being seen by Google as "mobile friendly."

Nothing to do with the CMS itself, that's front end/templates/plugins.



In conclusion, I think both are secure as long as updated, and Wordpress is for simpler sites and blogs, where Drupal is more for complex sites which need more complex functionality.
So it depends on your individual needs. What you will use it for, what sort of functionality you want, etc. And if you will only ever need things which both offer, use Wordpress for it's simplicity.

 

[brandnow]

Follow-up bonus question too.. If you are using Drupal 7 now.. do you plan to upgrade to Drupal 8 when the stable version comes out?

 

[brandnow]

@brandnow security is a continuous process not a product. Whether you use WordPress or Drupal or Joomla, they will be vulnerable in time. It's how you approach securing your website, how fast can you update it.

A good example is after the WordPress update to 4.2, security researcher find out about the XSS vulnerability. The day after, WordPress released 4.2.1 to patch it.
Read it here. http://www.king.net/wordpress-4-2-is-affected-by-zero-day/

I moved all my websites from joomla and drupal to WordPress for simple reason. I can update the security of WordPress using the control panel, run update on the site, no need to FTP files. Anyway, I have a Managed WordPress, they update my core automatically once a new release is available.

Hope this help.

One thing I like about Wordpress.. but I installed it a few weeks ago to test it out a bit.. is that it updates automatically.. but from reading your post.. I wonder do you have auto-update switched off.. and do you update it manually?

edit: nevermind.. sorry I didn't read the last sentence on your post until now.

Thanks for your post. Good insight there.

 

[TheWatcher]

 

[brandnow]

This thread is becoming a wake up call for me. It's funny because until recently I was thinking I'd go Drupal all the way with my new sites. But yeah.. from reading.. and realizing the delay of Drupal 8.. and reading comments.. I am seriously wondering if maybe Drupal was "so 2005" and maybe WordPress is the best there is for right now.

 

[cron]

This thread is becoming a wake up call for me. It's funny because until recently I was thinking I'd go Drupal all the way with my new sites. But yeah.. from reading.. and realizing the delay of Drupal 8.. and reading comments.. I am seriously wondering if maybe Drupal was "so 2005" and maybe WordPress is the best there is for right now.

Exactly, but If you like drupal and you are a drupal programmer that is fun otherwise stick with WordPress for now.

 

[domainerfella]

WP any day, any time.

 

[NameOmnia]

WOPPPPPRESSSSSSS!
I'd go with woppressssss

 

[johnfsander]

Forget about Drupal 7 or 8, you should build your website on Wordpress because it is more secure and SEO friendly than Drupal. No need to worried about its security because in Wordpress your website is secure.