The Drupal Government Problem
WebPulse confirmed at scale what security researchers have warned about for years: 53% of government web properties run Drupal. Drupal was the 'enterprise' CMS choice for the public sector — recommended by GSA, adopted by agencies worldwide. But Drupal 7 reached end-of-life in January 2025. Sites still running it receive no security patches from the core team.
The Migration Options
The UK solved this. GOV.UK runs a custom Ruby on Rails application — purpose-built, API-first, and the global benchmark for government digital. Singapore followed a similar path. But most governments don't have GDS-level digital capability.
For the majority: Next.js with a headless CMS is the pragmatic path. It preserves the editorial workflow that non-technical staff depend on while eliminating the legacy CMS attack surface. Astro is the option for purely informational government sites — zero JavaScript, zero client-side attack surface, pennies to host.
India Is Ahead of the US
WebPulse data revealed a counterintuitive finding: Indian government digital properties show higher modern framework adoption than their US counterparts. India's unified digital infrastructure push (Aadhaar, UPI, DigiLocker) drove adoption of modern API-first architectures. The US federal government, with 10x the budget, runs older stacks. Budget doesn't determine modernity — mandate does.
