Patch tonight. Migrate to modern, AI-improved.
Drupal vs Next.js + Supabase: which should run your site?
Last updated: 2026-10-23 · Shawn Gants
Stay
Stay on Drupal
A mature editor and module ecosystem. You still run PHP and take major upgrades on Drupal's calendar.
Leave
Migrate
Next.js, Supabase, and Netlify. No PHP server. You still update npm packages.
Answer: Drupal is a mature PHP CMS with a strong editor, permissions and module ecosystem. In exchange, you maintain a PHP server and do major-version upgrades on Drupal's schedule. Next.js + Supabase on Netlify replaces that with a React front end, a managed Postgres database that enforces access rules in the database itself, and Git-driven deploys. There's no PHP runtime to patch, but you still keep JavaScript dependencies updated. Choose Drupal if your editors live in Drupal and upgrades are cheap. Choose the migration if PHP and Drupal upgrade cycles are costing you more than they're worth.
WordPress is the same kind of choice. The WordPress vs Next.js table covers plugins, custom post types, and WooCommerce. The glossary defines the terms used on both pages.
Side by side
| Topic | Drupal (10/11) | Next.js 16 + Supabase + Netlify |
|---|---|---|
| Runtime you're responsible for | PHP (e.g. PHP2Shell, php.net) + web server, unless managed hosting covers it | No PHP runtime. Node/React code runs on Netlify (Netlify) |
| Recent critical runtime CVE | PHP2Shell, CVSS 9.2, Oct 2026 (php.net) | React2Shell (CVE-2025-55182), Dec 2025 (React) |
| How fixes ship | Patch PHP on the server, update Drupal core and modules (Composer) | Update npm packages, commit, Netlify redeploys |
| Major-version cadence | D10 EOL Dec 9, 2026. D12 releases that week (Drupal.org) | Next.js majors ship codemods. Effort varies by app |
| Permissions | Roles/permissions in PHP application code + node access modules | Row-level security: SQL policies run inside Postgres on every query (Supabase) |
| Member logins | Drupal user system (PHP sessions) | Supabase Auth |
| Files | Drupal public/private file system | Supabase Storage with access policies |
| Content editing | Rich built-in admin, Layout Builder, revisions | Chosen at audit: app-built admin or headless CMS |
| Extensibility | Thousands of PHP modules | npm ecosystem + custom code |
| Deploys | Varies (FTP/SSH/CI) | Every push to GitHub main builds and deploys |
| Data portability | MySQL/Postgres with Drupal's schema | Plain Postgres tables you design |
| PHP version coupling | Drupal 11 needs PHP 8.3+. D12.0 lists PHP 8.5 (Drupal.org) | None |
A key security difference: where access rules live
In Drupal, "who can see this page" is decided by PHP code before a query runs. If the PHP layer is compromised, as PHP2Shell allows, those checks can be bypassed. With Supabase, policies are attached to the tables. Supabase calls this "defense in depth": the rules apply even when data is reached through third-party tools (Supabase).
Caveat: RLS only protects tables where it's enabled and correctly written. Supabase warns that an exposed table without RLS is readable and writable by any role with a grant (Supabase). We test every policy.
When to stay on Drupal
- The Drupal 11 upgrade is small and your editors depend on Layout Builder or complex editorial workflows.
- You rely on Drupal Commerce or many contributed modules with no simple equivalent.
- You have an in-house Drupal team.
When to migrate
- You're on Drupal 7, 8 or 9 (already EOL), or facing a large D10 → D11 job before Dec 9, 2026.
- You want member areas, gated content or video libraries with database-enforced access.
- You'd rather update dependencies through Git than patch a PHP server.
- You want the cited list of Drupal to Next.js benefits, including the tradeoffs.
- You want the move to include an AI improvement pass — content cleanup, clearer copy, schema, accessibility fixes — with a person reviewing every change.
Headless Drupal: the middle option
Some agencies keep Drupal as the back end and put Next.js in front (Chapter Three, topcms). That improves the front end, but you still run Drupal and PHP, so PHP2Shell-type patching remains. Headless vs full migration →
FAQ
Is Next.js more secure than Drupal? Neither is "secure" by default. The difference is what you maintain. Next.js removes the PHP server from your responsibilities. It still needs updates (Next.js security update).
What replaces Drupal Views? SQL queries (or Supabase client queries) rendered by React server components.
What replaces Drupal roles? Supabase Auth plus RLS policies.
Can non-developers edit content? Yes, through the editing setup chosen at audit.
Does it cost more to host? It depends on traffic and plan. We'll estimate this in your audit. <!-- No unsourced hosting price claims. -->
Sources on this page
- S02: php.net News Archive 2026: Security advisory + 8.5.12/8.4.27/8.3.36/8.2.35 release notes
- S15: Drupal core release schedule (Drupal 10 EOL Dec 9, 2026; Drupal 12 week of Dec 7, 2026) — verified (search extract)
- S18: Drupal.org: PHP requirements (version matrix)
- S22: React blog: Critical Security Vulnerability in React Server Components (CVE-2025-55182) — snippet
- S23: Next.js Security Update: December 11, 2025 — snippet
- S24: Supabase Docs: Row Level Security
- S26: Netlify Docs: Next.js on Netlify — snippet
- S34: topcms.space: Headless Drupal Package
- S37: Chapter Three: Next.js for Drupal (Next-Drupal)