The 2026 CMS Field Guide

The most important number in this year’s CMS market is not WordPress’s 41.5%. It’s the direction. After a decade parked at 43% of the web, WordPress’s share broke downward in 2026, the first sustained decline in its history, and here’s the part worth sitting with: its competitors barely gained. The growth went to sites with no detectable CMS at all. Static output, framework builds, AI-generated pages. The pie isn’t being re-divided; the pie is changing shape.

After the FedRAMP piece, a fair question came back: fine, but what if you’re not in government? What does the field actually look like in 2026, with no compliance filter doing the eliminating for you? So I did the survey properly: the open-source platforms, the headless SaaS vendors, the enterprise suites, the site builders, checked against primary sources in July 2026. This is the field guide, and the direction I think it points.

The frame, restated

In What the Job Postings Know I argued that generating and rendering pages have commoditized, so durable value moved to governance (accessible, on-brand, compliant, non-redundant content) and distribution (publish everywhere, including to AI agents). A year of market data later, I’d upgrade that from thesis to scoreboard. Two things happened in 2026 that I did not expect to happen this fast.

First, the governance half became law. The EU AI Act’s transparency obligations bind from August 2, 2026: providers must mark synthetic content in machine-readable form, and deployers must disclose when AI-generated text is published to inform the public. Then comes the clause that should reorganize every CMS roadmap. The text-disclosure obligation falls away where the content “has undergone a process of human review or editorial control” with clear editorial responsibility. Read that again as an architect: an approval workflow with a named responsible editor isn’t just good governance under this law, it is the exemption mechanism. Everyone can generate content. The platforms that can prove a human reviewed it just became the compliance path, and that proof machinery, moderation states, revisions, audit trails, is exactly the muscle mature CMS platforms have that prompt-to-page tools don’t.

Second, the distribution half got a wire format. In about eighteen months, MCP went from an Anthropic spec to the de facto CMS-to-agent interface; essentially every major platform now ships or hosts an MCP server. “Agent-ready” stopped being a slide and became a checkable claim: does the agent get a permission-scoped, auditable path into your content model, or a demo? (Meanwhile llms.txt, which I’ve shipped myself, turns out to be widely deployed and almost entirely unread. Adoption is real; consumption is near zero. Ship one, it costs nothing, but nobody should be sold a text file as an AI strategy.)

The map

Five segments, one honest sentence of trajectory each.

The consolidation pattern deserves its own sentence, because it’s one pattern, not several events: platforms with an adjacent surface are buying the content layer. Salesforce bought Contentful for its agents. Figma bought Payload for design-to-production. Wix bought Base44 for AI generation. Progress bought Nuclia for AI search. Headless vendors aren’t buying each other; the layers above them are buying the shelf they sit on. If your content platform is a VC-backed independent, its roadmap now has an implicit acquirer in it, and pricing that risk is part of platform selection whether procurement writes it down or not.

(A footnote for readers of the FedRAMP piece: no, the acquisition doesn’t hand Contentful a federal path. Authorizations attach to system boundaries, not owners, and the deal hasn’t even closed. If Salesforce follows its own precedent with MuleSoft and Slack, a government edition is a multi-year maybe, not a status change. Watch item.)

The open-source audit

My lean is open source, and this survey is exactly why the lean needs an audit rather than a slogan. “Open source” in the 2026 CMS market describes at least four different arrangements, and they fail differently.

Open source, open governance. Drupal (GPL, foundation plus elected leadership, no paid edition of core anything) and Wagtail (BSD, stewarded by an employee-owned agency, with a public-sector track record you can literally read in US federal GitHub repos). TYPO3 and Joomla live here too, with narrower futures.

Open source, single throat. WordPress’s license is as free as ever, and 2024–2026 demonstrated that one person controls wordpress.org, the update pipeline, and the trademark, and will use that control in a commercial dispute. The litigation runs into 2027. The project ships; 7.0 landed on time and its core AI plumbing is real. The risk isn’t dysfunction, it’s tail risk, and it’s now citable rather than hypothetical. Ghost and Umbraco are healthier versions of the same shape: genuinely MIT, roadmap controlled by one company (a nonprofit and a PE-majority-owned firm, respectively). Payload is MIT and moving fast, and its roadmap now serves Figma’s product strategy; that’s not an accusation, it’s a line item.

Open core, moving boundary. Strapi is the most-starred open-source headless CMS and its free tier still lacks content history, audit logs, and SSO, which is to say: the things a governance-minded buyer needs are the things behind the paywall. Sound familiar? It’s the FedRAMP filter again wearing a different badge.

Formerly open source. Directus has had three licenses in three years and now ships in-product activation keys with hard caps below the paid tier. Craft’s license has never been OSI anything. Both are fine products; neither should appear in your “open source” column, and a fair post says so plainly.

The audit matters because the license question and the governance question turned out to be the same question. The reason to lean open source in 2026 is not price and was never really price. It’s that nobody can buy your roadmap, relicense your install, or throttle your updates in a business dispute. This year provided worked examples of all three.

What I’d actually shortlist

For the ambitious-site segment where structured content, workflow, translation, and permissions are the job (the segment where, per the FedRAMP piece, the real value lives):

• Drupal, still, and I say that having read its numbers honestly: 1% share and sliding, initiatives that are a response to decline rather than yet a reversal of it. But entity/field modeling, core revisions and moderation, core i18n, config management, and a real security team remain the deepest free governance stack in the field, and the AI module suite is unusually mature for open source (stable, security-covered, ~18k reporting sites). The bet that needs watching is Canvas: visual editing is table stakes now, and the question I’d put to any platform, Drupal included, is whether the visual editor respects structured content and design-system contracts or quietly reintroduces page soup.
• Wagtail, the credible second opinion. Python instead of PHP, disciplined quarterly releases, verifiable government deployments, a conservative provider-agnostic AI posture. It’s a developer framework rather than a product, and its ecosystem is thin, but nothing else outside PHP comes as close to Drupal’s governance depth.
• Payload, if your team is TypeScript-native and you price the Figma question honestly. Config-as-code governance a reviewer can read, real momentum, weekly releases a year after acquisition.
• WordPress, when the job is publishing at ecosystem scale and you’ve priced the governance tail risk. The core AI client and MCP adapter work is genuinely ahead of its reputation.
• Ghost, for the specific job of owned publishing with memberships; it will tell you itself it’s not a general CMS.

And the honest negative space: for a content model of real depth, no site builder survives contact (fixed content types, item caps, per-locale surcharges, workflow behind four-figure tiers), and the headless SaaS shortlist now starts with “who will own this vendor in three years.”

The clear-eyed part

Three things I’d want any reader, or any interviewer, to hear me say without flinching.

The volume era of open-source CMS is over. WordPress’s plateau broke, Drupal’s share halved over three years, and the growth went to proprietary builders and to no-CMS-at-all. Market-share arguments for open source no longer land, and making them reads as nostalgia. The defensible ground is the governed, structured, multi-channel segment, which measurement surveys are mostly blind to anyway.

The CMS-is-dead framing half-holds, and precision about which half is the credibility play. “Agent-ready structured content platform” is the acquisition-grade narrative, and it’s real: it’s why Contentful is becoming a Salesforce subsystem. But page-centric CMSes still run the overwhelming majority of the measurable web, and analyses that pronounce them dead are refuted by deployment data in one paragraph.

And the composable pendulum found its resting point. The MACH insurgency produced enough integration pain to earn a vendor-coined backlash term (“composable regret”), and the resolution isn’t a return to monoliths, it’s hybrid: composable where it pays, integrated where it doesn’t. I’d note, with the appropriate conflict-of-interest disclosure that I’ve spent my career here, that a monolith with first-class APIs, which is what Drupal has been since 2019, is the original hybrid, and the market spent five years and a lot of venture capital arriving back at it.

Generation got cheap. Governance became law, distribution grew an agent protocol, and the content layer became something bigger platforms acquire. The job postings called it; the market spent 2026 confirming it. The book I’ve been writing on Drupal site architecture in the age of AI argues the same thing at architecture depth, and the next post in this series will pick one of these threads, probably the visual-editing-versus-structured-content question, and pull.

Sources & snapshot

Survey checked 2026-07-07 against primary sources; load-bearing claims re-verified 2026-07-08. Key citations:

• W3Techs CMS usage survey (2026-07-08 figures: WordPress 41.5% of all sites / 59.2% of known-CMS; Drupal 0.7% / 1.0%; no detectable CMS 29.9%): https://w3techs.com/technologies/overview/content_management
• EU AI Act, Article 50 (transparency obligations; applies from 2026-08-02; editorial-control exception): https://artificialintelligenceact.eu/article/50/
• Salesforce–Contentful definitive agreement (announced 2026-06-01; close expected Salesforce FY27 Q3; price per The Information, not company-confirmed): https://www.salesforce.com/news/stories/salesforce-signs-definitive-agreement-to-acquire-contentful/
• Drupal AI module (usage and release cadence): https://www.drupal.org/project/ai · Drupal CMS 2.0: https://new.drupal.org/blog/drupal-cms-2
• Strapi self-hosted pricing (free-tier feature gaps): https://strapi.io/pricing-self-hosted
• Directus licensing and tiers (Core caps, grant thresholds): https://directus.com/pricing · license: https://directus.com/mscl
• Payload joining Figma (2025-06-17): https://payloadcms.com/posts/blog/payload-is-joining-figma
• Wagtail roadmap and public-sector deployments: https://wagtail.org/roadmap/ · https://github.com/fecgov/fec-cms
• Model Context Protocol: https://modelcontextprotocol.io/
• Gartner Magic Quadrant for DXP, Feb 2025 edition (the latest confirmable from outside the paywall as of the snapshot)

FedRAMP-style honesty note: market statuses, prices, and licenses change; this is a snapshot, dated above, not a promise.