Drupal or Wordpress for Security and SEO Success?

[brandnow]

Allow me to provide a little background.

Years ago I developed a few high profile web sites based on Drupal. I like Drupal and it's familiar. I have used Wordpress before too, but I have only done basic testing and playing around with Wordpress.

Both are very popular. Wordpress people say is easy, but Drupal is more familiar to me.

THE PROBLEM: Right now Drupal is in between major releases. Between Drupal 7 and Drupal 8. And I have also not developed any web sites in 3 or 4 years, so I have been " out of the game" as it were.

As I want to get started on developing several new web sites right away. What do you guys suggest? Should I be using Drupal 7 in hopes that it will be easy to upgrade to Drupal 8 in the future? Or have you used both, and would you suggest that I finally make the leap to Wordpress, and begin anew?

My three biggest concerns with this choice.

#1) I need SECURE web sites. I will have 'sensitive' and perhaps controversial articles on these web sites. People like to say that Drupal is more secure than Wordpress, because less sites use Drupal, and perhaps the code of Drupal is also better.. and there are less extensions for Drupal (which means less vulnerability?). But I need some opinions on this one.. is Wordpress REALLY any less secure Drupal?

#2) Now that Google has gone all mobile friendly and sites that are not the most mobile friendly are being punished. How does Drupal 7 compare to Drupal 8 or especially how does Drupal 7 compare to Wordpress in terms of being seen by Google as "mobile friendly." And if I go for Wordpress what are the latest and greatest extensions to make Wordpress mobile and SEO friendly? This is kind of a big concern obviously, but I am interested in the latest opinions. A lot of articles I find through search seem outdated.

#3) Drupal vs. Wordpress? Has anyone used both extensively? I am not the most tech savvy person. I generally do not code, and instead opt to use the tools, extensions, themes, etc. that are already available. With your experience of Drupal 7 and the latest version of Wordpress. Which do you find better?

I really need to get more input from developers before I make a final decision. And I need to make a final decision within the next week or so.

 

[TheWatcher]

I'm using a Managed Wordpress to take care of my core security and backup.

 

[Tia Wood]

#1)

As @TheWatcher said: security is a continuous process not a product. Wordpress is very conscious about security and fast about getting patches out. See: https://wordpress.org/news/category/security/ and http://codex.wordpress.org/Hardening_WordPress and https://wordpress.org/about/security/

#2)

I can't answer for Drupal but there are many modern themes that support mobile friendliness on Wordpress. Usually using the term 'responsive design'. http://themeforest.net is a good resource for that (make sure you select the Wordpress subcategory)

#3) Good comparison here:
http://websitesetup.org/cms-comparison-wordpress-vs-joomla-drupal/

 

[Alice Wonder Miscreations]

I would personally never use WordPress. They do things like emulate magic_quotes_gpc which was taken out of php for a reason, their database handler doesn't really used prepared statements - it just tries to emulate them with printf - which has resulted in many of the security issues in plugins, etc., gravatar which is enabled by default is a privacy breach, etc.

I don't know that drupal is any better as I don't do anything with it but everytime I write a plugin for wordpress (I don't use it myself, but I code what I'm paid to) I lose hair over finding something new that just drives me insane wondering why they did it that way.

WordPress has an easy install and lots of plugins, but I don't think it will ever really be secure.

Try bringing up the bad design security issues on their forums and the devs just don't want to hear it.

 

[brandnow]

I would personally never use WordPress. They do things like emulate magic_quotes_gpc which was taken out of php for a reason, their database handler doesn't really used prepared statements - it just tries to emulate them with printf - which has resulted in many of the security issues in plugins, etc., gravatar which is enabled by default is a privacy breach, etc.

I don't know that drupal is any better as I don't do anything with it but everytime I write a plugin for wordpress (I don't use it myself, but I code what I'm paid to) I lose hair over finding something new that just drives me insane wondering why they did it that way.

WordPress has an easy install and lots of plugins, but I don't think it will ever really be secure.

Try bringing up the bad design security issues on their forums and the devs just don't want to hear it.

I've read a lot of your posts and I respect what you have to say. I am just curious, because I mainly just develop web sites for my own non-commercial, personal use. Could you recommend any open source CMS that I might want to look at using for my new web site / blog projects coming up? Of course, I just want advice on secure options. I like Drupal, mainly because I have experience with it. But Drupal 8 will be a game-changer from Drupal 7.. but it could be another year before Drupal 8 is stable enough for the developers to release. And apparently it will be quite challenging to upgrade from Drupal 7 to 8. So basically I am in a situation that I can't wait a year for Drupal 8.. and people say that Wordpress might be the only good open source alternative to Drupal. Please let me know if you have any thoughts on it. Thanks

 

[Alice Wonder Miscreations]

I code my own, which is a mistake because it isn't time/cost effective. But it's what I do.

 

[brandnow]

I just want to say that I have been procrastinating and busy over the last few weeks. I have not found the time, and more importantly -the focus-, to begin the projects. Because I want content to be king. For me to write good content, I must have good focus. No doubt, spending too much time on Namepros has not been helpful for focus, though I do enjoy exchanging ideas with people here.

Before I begin building and developing these new sites of mine though I'm just concerned about Alice's last few replies about Wordpress not really being that secure. I am just not sure what to do? Should I just go with what I know.. Drupal 7.. even though it will be a major pain in the ass to upgrade to Drupal 8.. and there are less useful plugins, etc. Because some people say Drupal 8 is more secure? Or should I get used to developing sites with Wordpress, and go for Wordpress because it's easy to use, there are millions of free plugins, and most people say it's pretty secure?

After all of these replies, I regret to say, that I am kind of back at square one with my original question. ;( But I would rather make a final decision that I can stick to BEFORE I BEGIN than find out a year from now that I should change everything and start over again. That's another part of the reason why I have procrastinated so hard to get started. But I do need to get started soon, otherwise I'm afraid these web site projects will never get done. I have a lot of interesting things (I think) to talk about and share with people through these web sites.

 

[Alice Wonder Miscreations]

If you are vigilant updates you will probably be okay with WordPress. Those I know who use it, with about 80 different blogs, every now and then one gets compromised and usually all that happens is things like casino links get inserted into content. Not the end of the world.

I don't like WordPress but yes, if you have content you need to get out, WordPress is better than not getting it out at all.

 

[Clara]

I would prefer wordpress and you can also refer the following article - no_url_shorteners/Kee4uK

 

[brandnow]

I found this article interesting: http://www.commonplaces.com/blog/drupal-vs-wordpress-–-why-considering-the-future-is-important

and

https://wpml.org/2013/11/drupal-developers-make-x10-wordpress-developers/

this too

http://mikeschinkel.com/blog/17-reasons-wordpress-is-a-better-cms-than-drupal/

 

[brandnow]

bump..

Okay sorry for the bump.. but one more request for any advice or thoughts on this.. I haven't began developing my new sites yet. But I will start development in a couple weeks. I just want to do these sites right from the very beginning, if possible.

I am still torn between Drupal and Wordpress. Because I know and love Drupal. But in recent years, it seems like Wordpress with be easier to manage (auto updates) and more options for plugins, themes, etc. The only problem still is that I have zero experience with Wordpress. And even though traditionally people say Wordpress is the "easier" one of the two to learn, for some reason I still have anxiety about learning Wordpress from scratch. Especially because I want hassle free.. and I'm concerned that I may not be able to do ___ with Wordpress or perhaps I will install ___ plugin for Wordpress and it will open up security vulnerabilities by mistake that will let attacks take my sites down. It also seems like Wordpress takes up more web space AND server resources. Ugh, if that's true I could be in trouble as I'm on a shared server. But I may move to a dedicated server in the future pending the success of these blog sites. I will basically become a full time writer over the next year.

I love everybody's input on here so far. So I wanted to ask for one last call for any advice or comments on which one is better to use. Or perhaps use Drupal on a few of the sites where security and taxonomy organization is vital? And sites that will be just blogs.. then I can use Wordpress?

What do you think guys (and girls)?

 

[Cinderella1]

I often find a lot of the plugins are out of date with drupal. At least with wordpress there is always some other free version or even better a premium version out there.

I don’t believe wordpress will be around forever. I just don’t think everyone will make the switch until something new comes out that is currently not on the market.

 

[james haw]

It's been a while since I used Drupal, but from what I remember, the learning curve is much greater than Wordpress, however Drupal is more pliable than Wordpress in some ways, often useful ways.

Also, (again from memory and years ago) Drupal Core is about objects (OOP) and use better approaches in the back end, where Wordpress is just a load of user defined functions glued together and called all over the place (this is an old way of doing things).

While this doesn't necessarily make one better than the other, I personally prefer to trust something which is made in a more robust and frameworky manner - ie MVC, better sanitisation in the core rather than relying on 3rd party public plugins, parameterised statements, etc. While crap plugins will always be written and exist for any CMS which allows publicly shared plugins, a better Core (ie objects) often means developers will write better plugins (or at least they have the ability to do so).

That said, Wordpress is generally secure, and easier to get started, get a template for it, and even configure plugins etc.

The main issue with Wordpress is Wordpress folks make the CMS and the public make the plugins. So, as often happens, the new Wordpress update is not compatible with some of your plugins. So you either don't update Wordpress for a while waiting for plugins to catch up, or end up with plugins which malfunction in some way. This is an urky setup to have to manage, especially when we should update ASAP to be secure etc.

AFAIK Drupal suffers from the same issue, but a bit less of a problem as I believe Drupal has more "built-in" functionality, so chances are something basic you need (like contact form) will be part of the Drupal system and so updates will be fine along with the core.


It's hard to compare any system to another as often they have different functionality. While Drupal and Wordpress are both "CMS" to build sites with, their approach and thus functionality and usability are quite different. It's like comparing apples and oranges. So depends on the requirements.


Wordpress is easy to use, easy to install, easy to manage. Drupal can be tricky to learn, but it offers much more than Wordpress in some ways, eg Drupal has a fully fledged forum, where Wordpress has, comments.

Wordpress is very quick and easy to install, download and add a template, and get your site online, Drupal takes a bit more time, but can be more worthwhile (depending on your needs).

THE PROBLEM: Right now Drupal is in between major releases.

Not any more

#1) I need SECURE web sites. I will have 'sensitive' and perhaps controversial articles on these web sites.

If this is for you then both are secure, as long as updated.
If for clients, then you should use Wordpress, as they can learn it easier, and any problems and you can say it's mainstream - "used by more than 23.3% of the top 10 million websites as of January 2015" "60 million sites use it" etc.

People like to say that Drupal is more secure than Wordpress, because less sites use Drupal, and perhaps the code of Drupal is also better.. and there are less extensions for Drupal (which means less vulnerability?). But I need some opinions on this one.. is Wordpress REALLY any less secure Drupal?

Yes today, no tomorrow.
Drupal is more secure when Wordpress has a vulnerability, and vice versa, when both are updated, and no-one has found issues, they are both secure. One not really more than another. This wasn't the case years ago, but it is now.

How does Drupal 7 compare to Drupal 8 or especially how does Drupal 7 compare to Wordpress in terms of being seen by Google as "mobile friendly."

Nothing to do with the CMS itself, that's front end/templates/plugins.



In conclusion, I think both are secure as long as updated, and Wordpress is for simpler sites and blogs, where Drupal is more for complex sites which need more complex functionality.
So it depends on your individual needs. What you will use it for, what sort of functionality you want, etc. And if you will only ever need things which both offer, use Wordpress for it's simplicity.