Feed aggregator

AI traffic is not one thing, and a policy which treats it as one thing gets the answer wrong in both directions. Here the decision is written down, class by class: the crawlers which harvest sites to train models are turned away at the edge before a single line of Drupal or Backdrop runs, while AI search indexers, and the fetch a real person triggers by asking an assistant, stay open and rate-limited per vendor, not per address, because one prompt fans out across dozens of addresses. Every layer ships with the platform and runs on your own server; nothing is rented, and no rule lives somewhere you have no login for. Changing it for one site is one line in a file you own, live in about two minutes, deleted to restore the defaults; and your own policy goes out at /llms.txt straight from the site's files folder. The honest part is the best part: a user-agent can be forged, the maps fail open on purpose, and the docs say where each shield stops and the next one begins.

This post is adapted from the DA Insider, the Drupal Association's monthly newsletter. Subscribe here to get it in your inbox each month.

Straight from Ryan's desk

To the Drupal community,

As northern hemisphere summer winds down, DrupalCon Rotterdam is rapidly approaching — and if you haven't booked yet, today is your last chance at Regular pricing. Late Rate kicks in at midnight CEST, so this is my friendly nudge to save yourself €270 and register now.

Rotterdam isn't the only Con on the horizon. DrupalCon Orlando Early Bird registration opens 14 September, and paid Early Bird tickets come with a limited-edition DrupalCon elePHPant — once they're gone, they're gone.

Elsewhere in this edition: the 2026 Drupal Business Survey is open until 7 September (your answers shape where we focus next), the engineering teamhas completed the migration of Drupal's security issue tracking to GitLab, and we're delighted to welcome Janna Malikova to the Drupal Association Board.

As always, thanks for being part of it. See you in Rotterdam!

Ryan Witcombe, Director, Product Marketing

The 2026 Drupal Business Survey Is Open

Your input shapes an anonymized report that helps the whole community. You'll see how your pipelines, win rates, and revenues compare to global peer data, share what's actually working, and directly influence where the Drupal Association focuses next.

Take the survey by 7 September 2026 at 23:59 UTC. Responses are strictly confidential and fully anonymized. Everyone who completes the survey receives the full report by email.

Read more

Drupal Canvas hides most Metatag fields behind one SEO title box. Check out how Canvas Page Metatag restores them and fixes a Robots checkbox bug.

Every Drupal 7 to Drupal 11 migration we run follows the same 52 steps in the same order — audit, content model, module mapping, the 301 map, build, verification, and a cutover designed so rollback is one DNS change away. The full checklist, with the reasoning behind each step and a printable summary card.

Drupal Meets Matrix part 1: Setting up Matrix API John Locke Mon, 08/31/2026 - 14:30

I've been maintaining the matrix_api module on Drupal.org since 2016, nearly a decade of it doing one thing well: posting Drupal events into a Matrix room. This year that changed.

Dev Corner

• Read more about Drupal Meets Matrix part 1: Setting up Matrix API
• Add new comment

Reproducing a bug that only happens on the live Drupal site used to mean a hand-made dump, the uploads copied across one rsync at a time, and an hour of persuading the copy it is not production. On a BOA-hosted site it is one pull into the DDEV project you already have: a small add-on reads what the site reports about itself, sets the local project to the same PHP and Drupal version and the same docroot, then brings the database and the uploads down through the ordinary limited shell account you already use for SFTP, with the key you already have, and nothing new switched on server-side. It syncs one way only, on purpose, and the site's own Drush takes over once the copy is yours. Self-hosters get the other door: the whole stack on a spare VM at a private hostname, no public IP, no DNS, the same BOA as production. This post is the recipe, six commands from start to Pull succeeded, plus the small print neither door hides.

Drupal could be a great answer for vibe coding Imagen When you vibe an application, the AI picks the stack, and both projects I've looked at came back with the same one. I know Drupal and I contribute to it, so weigh everything here against that bias. But what a vibe-coded application ends up needing, Drupal already has, and the piece still missing is one this community could build. There may be better fits out there.

Read more

AI assistants increasingly sit between people and websites, retrieving and interpreting information on their behalf. That shifts the problem beyond whether software can connect to a site at all. The system also has to make clear what information means, what software may access, and which rules govern what happens next.

The Drupal AI Initiative made the first part of that problem explicit on 24 August 2026. Fields, taxonomy, relationships, metadata, and other forms of structured content can give software information that is easier to identify and interpret than meaning conveyed mainly through page design. Permissions and workflows add another layer by distinguishing what is public, restricted, current, or subject to editorial control.

A more concrete access boundary appeared this week in Acquia DAM's MCP Server. Compatible AI assistants can search assets, retrieve metadata, and obtain links through an authenticated connection that follows the user's existing DAM permissions. The initial implementation is read-only: an assistant can retrieve permitted information but cannot edit metadata or upload files. The interface therefore exposes capability without giving the software unrestricted authority over the system behind it.

Read more

Two Drupal GovCon keynotes on building through disruption: the courage to lead change, and the care to keep people from being left behind.

The Drupal Association is excited to announce the winner of 2026 Community At-Large Board Elections.

We extend a sincere thank you to Alejandro Moreno for his service and dedication, not only to Drupal, but to the Drupal community. Your time spent on the board made such a difference to the future of the Drupal project, and we thank you all for participating with grace, thoughtfulness, and insightful contributions.

We would like to congratulate and welcome our newest board member, Janna Malikova, for winning the community-elected seat during our 2026 At-Large Board Elections.

We cannot wait to see all the amazing things Janna will accomplish while on the Drupal Association Board.

Detailed Voting Results

There were 8 candidates in this year’s At-Large board member election. 307 voters cast their ballots out of a pool of 1274 eligible voters. Eligible voters are active Drupal Association members, known as Ripple Makers, whose membership must have been active at least 24 hours before voting opened.

Under Approval Voting, each eligible voter can give a vote to one or more candidates. 

The final total of votes were as follows:

Candidate

Votes

Scott Falconer

74

James Abrahams

131

Bert Boerland

120

Chris Kelly

26

Darren Oh

57

Janna Malikova

141

Helge Notø

74

Matthew Saunders

128

Read more

Specbee has joined the Drupal AI Initiative as a Certified Partner. See what Drupal AI initiative is about, how it's governed, and what it means for your enterprise site.

Drupal 11: Migrating From Jadu Into LocalGov Drupal: Part 3

This is the second article in a series looking at migrating from Jadu into a LocalGov Drupal (LGD) site for the Central Bedfordshire site. In the first article we looked at the Jadu API and setting things up so that we could make calls to the API and parse the XML data using the migration systems available.

In the second article we looked at reproducing Jadu URLs to create redirects for migrated content, even though the Jadu API doesn't contain any URL information.

Now that we have a the Jadu connection created and redirects working we can start tackling other aspects of the migration, so let's look at migrating the main content of the site from Jadu. We can pull structured pages of content out of the Jadu API and apply them to the structure of a LGD site, maintaining the same hierarchical structure and order of pages.

Much of the content of a LGD site is built using just a handful of content types, and Central Bedfordshire was built in the same way. LGD comes with a number of content types that allow content editors to add content in different ways, which allows for some decent customisation in the structure and layout of a site. Not only that, but as we are using Drupal it is possible to customise this structure as much as we need to suit the needs of the site.

Read more

Four version control systems in three files, a hardcoded root password we decided not to airbrush, and a surprising amount of today's stack already in place. In the oldest corner of our static file mirrors sits a directory called alpha3, and in it three shell scripts dated 20 November 2009 – older than the public BOA repository itself, whose GitHub history only starts in January 2010. These are the scripts Barracuda & Octopus grew from: one installs the Ægir layer on a VPS, one upgrades it with cron stopped and a backup taken first, and one builds a whole menu of 2009-era Drupal platforms, from Open Atrium to ManagingNews. Now published byte for byte on our docs site, with a guided tour of what survived, from the /data/disk tree to the /dev/ delivery path.

It’s time to prepare your Drupal modules for Admin’s dark mode mherchel Fri, 08/28/2026 - 12:04

WebMCP is an emerging proposal for cooperation between a web page and a browser agent. It is not a new name for MCP and it is not a replacement. A practical rule is simple: MCP belongs near servers and data; WebMCP belongs near the live page and the workflow the user can see. At the end of August 2026, WebMCP is not something every production website should rush into every form. But it is worth understanding now, because the direction is right: an AI agent should not have to guess buttons and click through a website like a brittle automation script. A web application can declare which actions an agent may use and what structured inputs those actions expect. That distinction matters. A normal browser agent sees a page roughly as a user or automation tool sees it: headings, form fields,…

Today we are talking about Security, Vulnerabilities, and how to avoid exposure with guest Dave Welch. We'll also cover Security Scanner as our module of the week.

For show notes visit: https://www.talkingDrupal.com/567

Read more

Open Source is usually described as a licensing model, a development model, or a production model. All three descriptions are useful, but they leave something out. Every Open Source ecosystem is also a cost-allocation system.

Keeping software relevant and dependable requires people to write code, review contributions, prepare releases, investigate security reports, operate infrastructure, write documentation, answer questions, and support upgrades and migrations. Someone always bears those costs.

A proprietary vendor can tie access to payment: every license or subscription sold helps fund developers, security work, infrastructure, and releases.

Open Source breaks the link between access and payment. Anyone can redistribute the software at any price, including zero. Payment is therefore not a condition of using or redistributing it, and those rights do not themselves provide a durable mechanism for funding production and maintenance.

But separating payment from access does not make the costs disappear. Costs are distributed across maintainers, employers, foundations, sponsors, and users. A maintainer may volunteer their time. An employer may pay a developer to contribute. A foundation may operate infrastructure.

Because these costs are distributed rather than collected through a single transaction, they are harder to see and harder to fund.

Technical choices often shape where those costs fall. That allocation is not always deliberate; it can emerge slowly from decisions that were individually reasonable and become visible only years later.

Drupal's update service recently gave me a good example. Drupal sites periodically contact updates.drupal.org to ask whether new versions of Drupal or any installed add-ons are available. Drupal calls these add-ons "contributed projects", such as modules and themes maintained by members of the community.

Read more

Six Small ECA Models That Make Drupal Editors Happy Jürgen Haas Thu 27 Aug 2026 - 17:30

This article introduces six new ECA Guide library recipes that improve the Drupal content editing experience through small, focused changes. They can draft metadata on first save, add access-aware edit links to teasers, prevent invalid dependent select values, offer field-level actions, fill several form fields without saving, and show contextual guidance beside a form. The point is not to apply all six recipes unchanged. They are well-architected starting points for a real editorial irritation. For editors, that means less repeated work and fewer avoidable mistakes. For organisations, it means more consistent content and a practical route to improving the CMS without turning every detail into a custom development project. The article also gives a simple choice: Field Widget Actions for one field, Form API Ajax for several form fields, and HTMX endpoints for nearby content. Production concerns still matter, especially permissions, validation, managed data, and AI review.

Rebuilding a data-driven Drupal site: From ctools plugins to Layout Builder blocks

In the previous post, I described why we chose Layout Builder and how Layout Builder IPE restored the frontend editing workflow we had used with Panels IPE.

With the editing workflow in place, we still had to rebuild the elements that editors placed on their pages.

The Drupal 7 site used custom ctools content type plugins for maps, charts, figures, lists and tables. Editors placed and configured these plugins, while the plugins retrieved the information and rendered the result. I will call both these ctools plugins and the block plugins that replaced them page elements.

berliner Thu, 08/27/2026 - 15:06

Tags

• layout builder
• blocks
• plugins
• architecture

We rounded up 16 Drupal AI modules and sorted them for you. Deploy now, pilot on staging, or just keep an eye on it. Check it out!