Study Measures 424 Drupal Sites Across Federal, State and Territory .gov Domains

Gspikes identified Drupal on 424 of 1,347 federal, state and territory .gov domains that returned HTTP 200 during measurements conducted on 19 September 2026. The study drew its sample from 2,742 federal and state or territory entries in the public U.S. government domain registry. The 424 detections therefore represent 31.5% of responding domains in that selected frame, not 31.5% of the entire U.S. government web.

The sampling frame is narrower than the full government web. The official .gov registry includes several categories of government entities and lists registered second-level domains rather than every hostname in use. Digital.gov's Site Scanning program, by comparison, scans about 26,000 federal .gov and .mil websites and subdomains, so percentages from the two datasets describe different populations and should not be compared directly.

Gspikes reported a median server-time measure of 0.239 seconds across the detected Drupal sites. Each Drupal site was requested three additional times, with the median result used for the site, and 415 of the 424 returned at least two usable measurements. Drupal detection relied on public signals including X-Generator, X-Drupal-Cache, X-Drupal-Dynamic-Cache, session cookie names and markup fingerprints, while platform and edge attribution used vendor response headers.

The platform comparison attributes 47 sites to Pantheon and 97 to Acquia. Gspikes reported median server-time measures of 0.176 seconds for the Pantheon group and 0.306 seconds for the Acquia group. The study cautions that the comparison does not control for factors such as page complexity, traffic, agency budgets or implementation quality, and all measurements originated from a single location in the Gulf region. The results therefore describe differences within this sample rather than establishing that one hosting platform causes faster or slower Drupal performance.

Version data showed a similar association without establishing causation. Gspikes reported a 0.189-second median for 119 Drupal 11 sites and 0.306 seconds for 129 Drupal 10 sites, while noting that recently upgraded sites may also differ in PHP versions, caching and maintenance practices. The measurements show a difference between those groups but do not isolate Drupal core version as the cause.

The study also listed 12 domains exposing signals for Drupal 7, 8 or 9, all versions outside normal Drupal community security support. Official Drupal release records show that Drupal 8 reached end of life on 17 November 2021, Drupal 9 on 1 November 2023 and Drupal 7 on 5 January 2025. Gspikes identified four Drupal 7 domains, one Drupal 8 domain and seven Drupal 9 domains.

A public version signal does not establish that a particular installation is unpatched. Drupal 7 organisations can purchase post-end-of-life security coverage through the Drupal Association's Extended Security Support Provider Program, and Gspikes likewise notes that public headers or fingerprints may reveal an end-of-life major version without showing whether backported patches or vendor support are in place.

Government records independently support one of the Drupal 7 findings, although they do not establish the site's exact status on the September measurement date. Responses dated 21 January 2026 from the District of Columbia's Board of Ethics and Government Accountability described open-dc.gov as requiring migration from Drupal 7 to Drupal 11 and said at least $30,000 was needed for the work. The agency also said its search for a migration vendor had been suspended during fiscal year 2025 because of District budget constraints.

Several subsidiary totals in the published article do not reconcile with the stated 424-site population. The platform rows total 415 sites, the same number that returned at least two usable performance measurements, although the article does not explicitly connect those figures. Its CDN rows total 414, while the displayed Drupal 11, Drupal 10, undisclosed-version and end-of-life groups account for 418 sites. Those differences do not invalidate the reported 424 Drupal detections, but the published material does not provide enough information to reconcile every subgroup.

Earlier analysis by Mike Gifford, published by The DropTimes in 2024, reported Drupal on 55% of government sites where a content management system could be identified using federal Site Scanning data. That analysis covered a different population and detection method, so its percentage cannot be used with the Gspikes figure to infer growth or decline. The Gspikes measurements are best read as a dated snapshot of a defined registry segment, with the version signals and unexplained subgroup totals remaining areas for further verification.