Drupal vs Joomla

Drupal follows a predictable rhythm: bugfix releases arrive on the first Wednesday of each month, security releases on the third Wednesday, and new major versions typically every three years. The date that matters most now is December 9, 2026, when Drupal 10 reaches end of life and no new Drupal 10 releases follow. Drupal 12 is scheduled for the week of December 7, 2026, and it requires PHP 8.5 or later, so a Drupal 10 site moving to a newer major also needs a newer PHP runtime and a tested set of contributed modules. Drupal 11 is the current major, so a team still on Drupal 10 has two practical paths: move to 11 now, or plan a jump to 12 once it ships and your modules confirm support. Confirm the Drupal 12 week on the Drupal core release schedule before you set a cutover date, because scheduled weeks can move.

Joomla's window closed on the 5.x line first. Joomla 5.x regular bugfix support ended on October 13, 2026, and 5.x now receives security-only fixes until October 12, 2027. A Joomla 5 site can keep receiving security patches for about one more year, but it no longer gets the bugfixes that may matter for your extensions or content workflows. Joomla 6.x is the line to plan around. According to the Joomla roadmap, its bugfixes run until October 17, 2028 and its security fixes until October 16, 2029. Patch releases typically arrive every 4 to 8 weeks, and minor versions pass through alpha, beta and release candidate phases. That gives Joomla a slower and less fixed calendar than Drupal's monthly and weekly cadence, and the roadmap states that these dates are tentative.

Neither Drupal nor Joomla has a paid core edition. Drupal is licensed under GPL-2.0-or-later and Joomla under the GNU General Public License version 2 or later, so the license line on a quote should be zero for both. The money goes to people and infrastructure: a hosting environment in your cloud account or data center, engineers who build and run the site, a development partner for the build and any migration, paid extensions or theme work where a module does not cover a need, and optional support contracts. Ask each vendor or partner to split a quote into these lines so you can see who is paid for what.

Some costs are one-time. The build covers content type and taxonomy modeling, roles and permissions, the multilingual setup, theme or template work, and integration with your identity provider, for example through the contributed SAML Authentication or OpenID Connect modules on the Drupal side or Joomla's core LDAP and multi-factor plugins. Migration from an existing CMS is also one-time, and it is often the largest item if your current site runs on an old major version. Recurring costs are different: hosting, patching the core and every extension, testing each update in staging, and planning the next major upgrade. Drupal 10 reaches end of life on December 9, 2026, and Joomla 5.x moves to security-only support after October 13, 2026, so a shortlist built today should price the upgrade window explicitly.

Cost moves with the number of contributed or third-party extensions, the number of languages and content types, the complexity of your access rules, and how often you need to deploy. A site with few custom modules and a stable upgrade cadence costs less to run than one that depends on abandoned extensions. In a quote, ask for the assumed Drupal or Joomla version and its end-of-life date, the PHP and database versions in scope, which extensions are included and who maintains them, what the security patching cadence is, how upgrades are tested, and what happens to the work if you change partners later. Confirm each of these in writing before the scope is signed, since the agreed scope defines what you pay for.

Implementation effort on both platforms concentrates in the same places: content modeling, theme build, extension selection, identity integration and hardening. Drupal projects usually spend the most time on content types, fields, taxonomies and view configuration, because these decide how editors work for years. Joomla projects tend to spend more on mapping content into categories, articles and custom fields, and on deciding which template and extensions cover needs that Drupal would often handle in core or contributed modules. In both cases, ask the implementation partner to write down the content model, the list of roles and the permission matrix before any theme work starts. A theme built against an unsettled model is usually rebuilt.

Extension selection is the most common source of overrun. Drupal's contributed modules are GPL-2.0-or-later and Joomla's extensions are mostly free, but free does not mean maintained, compatible or safe. Each module or extension in scope should have a named owner, a supported version for your target core release, and a documented decision on who patches it. For identity, confirm which protocol you need before choosing a module: the contributed SAML Authentication module (samlauth) and the OpenID Connect module have different configuration surfaces, and Joomla's core LDAP and multi-factor plugins cover different needs. Hardening work, including file permissions, admin path restrictions and logging, should appear as its own line in the written scope.

Multilingual content workflows and upgrade regression testing cause the longest delays after launch. Translation is not only an interface problem: confirm whether editors need translated content, translated menus and translated configuration, and who approves each language before publication. Regression testing is where teams underestimate effort. Drupal's bugfix releases arrive on a monthly schedule and its major versions on a multi-year cycle, while Joomla 5.x moved to security-only support after October 13, 2026. Ask the partner to define a test suite covering content types, forms, identity login, multilingual pages and custom code, and to state whether that suite is included in the fixed scope or sold as a retainer.