CMS security compared: WordPress, Drupal, Joomla, TYPO3, Ghost and static sites

Choosing a content management system means choosing a security routine. Every platform in this comparison can run a safe website, and every one of them has been broken into on sites that skipped updates or stacked up extensions. What differs is how much work the safe state takes, how long a version gets fixes and how much code faces the internet. We score six options on those points so you can pick the one your team will actually keep up with.

Seven criteria that decide day to day safety

A CMS (content management system) is the software editors use to change a site without touching code. Its security depends on the people who fix it and on the habits it encourages. We scored each option from 1 to 5 on these criteria, and higher is always better:

• Core security process: a dedicated security team, a clear way to report flaws, published advisories and predictable release days.
• Low extension risk: how much danger add-ons bring, given the size of the ecosystem and any review or coverage rules.
• Update automation: whether security fixes reach the site without a person logging in.
• Long-term support: published end of life dates and how long a version keeps receiving fixes.
• Small attack surface: how much code is reachable from the internet while the site runs.
• Admin protection: multi-factor authentication (MFA) and login rate limits out of the box.
• Low maintenance effort: the skill and time needed to keep the site in a safe state.

One pattern holds across all of them: the core is rarely the weakest part. Most publicly reported WordPress vulnerabilities concern plugins and themes rather than WordPress itself, and extensions carry the same kind of risk on the other platforms. A core has a security team. An add-on may have one part-time maintainer, or none. So the size and quality of the extension ecosystem matters as much as the core.

Interactive comparison

CMS platforms compared by security

Editorial scores from 1 to 5 for teams that run their own website, where higher is always better.

What matters to you?

Core security processSecurity team, reporting route, published advisories and predictable release days.

Normal

Low extension riskHow little risk plugins, modules and themes add, given ecosystem size and coverage rules.

Normal

Update automationHow easily security fixes reach the site without manual work.

Normal

Long-term supportPublished end of life dates and the length of free security support.

Normal

Small attack surfaceHow little code is reachable from the internet while the site runs.

Normal

Admin protectionMFA and login rate limits available without extra extensions.

Normal

Low maintenance effortHow little skill and time it takes to keep the site in a safe state.

Normal

Reset weights

1. Ghost3.9
2. Static site generator3.7
3. Joomla3.4
4. TYPO33.4
5. Drupal3.3
6. WordPress2.9

All scores in a table

Criterion	Ghost	Static site generator	Joomla	TYPO3	Drupal	WordPress
Core security process
Low extension risk
Update automation
Long-term support
Small attack surface
Admin protection
Low maintenance effort

Editorial assessment as of 31 October 2026. Scores from 1 to 5, higher is better. Your weights only change the order.

WordPress: easy to update, easy to overload

WordPress has a large, experienced security team and a long record of shipping fixes quickly. Minor core releases, which carry security fixes, install automatically by default, and since version 5.5 you can switch on automatic updates for each plugin and theme. The catch is the support policy: only the latest version is officially supported. The security team backports fixes to older branches as a courtesy, but you should not plan around that.

The weak spots are mostly the ones you add. The plugin directory is huge and quality varies widely, from well funded teams to abandoned hobby projects. Core has no built-in MFA and no limit on failed logins, and both the login page and xmlrpc.php are public by default. Each of these is fixable with a few settings and one or two well maintained plugins, which is why WordPress scores high on updates but low on extension risk and admin protection.

Drupal and TYPO3: long support, more engineering

Drupal has a dedicated security team, a security release window on the third Wednesday of each month and a published release schedule. Minor versions arrive roughly every six months, and two minor versions at a time receive security advisories. Contributed modules are covered only if their maintainers opt in, and the project page says so. Drupal 10 reaches end of life on 9 December 2026, the same week Drupal 12 is planned to ship, so Drupal 10 sites need an upgrade plan now.

Drupal core includes flood control, which blocks repeated failed logins, while MFA comes from contributed modules. Updates usually run through Composer, the PHP dependency manager, which suits teams with a developer and a deployment pipeline better than a lone editor.

TYPO3 uses a long-term support (LTS) model. TYPO3 v14 LTS was released on 21 April 2026 and receives bug fixes until 31 December 2027 and security patches until 30 June 2029, while v13 LTS is still maintained. After the free LTS period, paid Extended LTS is available. The backend ships with MFA, and the security team publishes advisories for core and for extensions. Like Drupal, TYPO3 is usually built and maintained by an agency or an in-house developer, which shows in the effort score.

Joomla and Ghost: the middle ground

Joomla publishes clear support dates, though the project calls them tentative. The 6.x series, released on 14 October 2025, is planned to receive security fixes until 16 October 2029, and 5.x until 12 October 2027. MFA is built into the core, core updates install with one click from the administrator panel, and the Joomla Security Strike Team handles reports about the core. Extensions vary in quality, as everywhere, but the ecosystem is smaller than that of WordPress.

Ghost is a focused publishing platform built on Node.js. It has no server-side plugin system: you change its look with themes and connect other services through its APIs and webhooks, which removes a whole class of risk. Staff logins from unknown devices must be confirmed with a code sent by email, and login attempts are limited to five per hour per IP address. Self-hosted installs update with one command line call, but someone has to run it.

The current major version is Ghost 6.x. The previous major gets critical fixes as the LTS line, and Ghost 5.x reached end of life in January 2026. Ghost treats every staff user as trusted, including the ability to add scripts, so invite only people you would hand the keys to.

Static site generators: the smallest live surface

A static site generator (Hugo, Jekyll, Eleventy and many others) turns templates and text files into plain HTML before deployment. The live server delivers files and runs no CMS code, no database and no login page. That is why this option scores highest on attack surface. There is no single security team, though: each generator is its own open-source project, and your exposure sits mostly in the build tools and themes you pull in.

The risk does not vanish, it moves. The build pipeline, its dependencies, the git hosting account and the deploy keys now hold the power an admin login used to hold. Contact forms and comments rely on third party services, and you still need HTTPS and security headers. Editors without technical skills may need a headless CMS on top, which brings its own login and updates back.

Which one fits whom

The risk does not vanish with a static site, it moves to the pipeline and the accounts behind it.

Sources and further reading

1. WordPress: Securitywordpress.org
2. Drupal core release scheduledrupal.org
3. Drupal security advisory policydrupal.org
4. TYPO3 v14 LTS announcementnews.typo3.com
5. Joomla development roadmapdeveloper.joomla.org
6. Ghost major versions and LTSdocs.ghost.org

General information, checked on 31 October 2026. Test changes on one system first and keep a way back. Found something outdated? Tell the editors.