The Assumption Is Wrong
The popular narrative is that government websites run WordPress. Our scan data says otherwise. Across 49 government sites in 12 countries, Drupal is the dominant framework — not WordPress, not Joomla.
Why This Matters
Drupal and WordPress have fundamentally different risk profiles. Drupal has 1,374 CVEs (vs WordPress's 18,005). Drupal's architecture is more modular. Drupal's security team is smaller but more focused. The migration conversation for a government on Drupal is completely different from one on WordPress.
Lumping all legacy CMS together misses the nuance that government IT leaders need to make decisions. A Drupal 10 site and a WordPress 4.x site are not the same risk.
The Singapore Exception
Singapore's GovTech agency made a policy decision to build on modern frameworks. Every Singapore government site we scanned runs Next.js. This isn't a technology decision — it's a governance decision. No other country in our scan shows this pattern. The question isn't 'what framework' — it's 'what policy drives the choice.'
The Real Government Migration Question
For most governments, the question isn't 'should we leave WordPress for Next.js?' It's 'should we upgrade from Drupal 7 (EOL January 2025) to Drupal 10, or rethink entirely?' That's a different conversation with different costs, different risks, and different politics.
