Drupal

Views is the most used module in the Drupal ecosystem and also the most underused — most developers barely scratch the surface of what it can do programmatically.

Decoupled Drupal separates the content management backend from the presentation layer. Drupal handles content modelling, editorial workflows, and permissions; Next.js handles rendering, routing, and performance. The bridge between them is Drupal's JSON:API module, which ships in core and exposes every entity type as a standardised REST API with zero configuration.

The Migrate API is the canonical way to move data into Drupal 11 — whether that means a one-off CSV import, a recurring feed from a legacy database, or a full Drupal 7 upgrade. It implements an ETL (Extract–Transform–Load) pipeline via plugins, and every step is swappable.

Drupal 11's theming system uses Twig 3, a modern templating engine that keeps logic out of templates and makes overriding core HTML straightforward. The recommended starting point is the Starterkit — a generator that scaffolds a fully functional sub-theme from Drupal core's stable base, so you own all the HTML from day one without inheriting any styles you did not choose.

Drupal's testing infrastructure is built on PHPUnit, but it layers three distinct test types on top of it — each with different bootstrapping, speed, and fidelity trade-offs. Most Drupal developers have run tests but haven't written them deliberately.

The Drupal Entity API is the backbone of every non-trivial Drupal project. Nodes, users, taxonomy terms, and media items are all content entities. When you need structured data that does not map neatly to a Node — say, a service ticket, a product, an event log entry — you build a custom content entity.

Drupal has an excellent security track record at the core level, but production breaches consistently come from misconfigurations, outdated contributed modules, overly permissive file system settings, and missing server-level controls. This checklist covers every layer: Drupal application, file system, database, Nginx/PHP-FPM, and monitoring.

Drupal's performance story depends almost entirely on caching. A Drupal site without caching tuned correctly will struggle to serve a few dozen concurrent users. The same site with all three cache layers configured properly can handle hundreds.

Running Drupal locally with a Docker Compose stack gives you a reproducible environment that matches production. Every team member gets the same PHP version, the same MariaDB version, and the same Nginx configuration — no more "works on my machine" debugging sessions.

For years Drupal used docblock annotations — special comments parsed at runtime by the Doctrine Annotations library — to declare plugins, entity types, and field formatters. PHP 8.0 introduced native attributes as a first-class language feature, and Drupal 11 now supports them everywhere annotations were used.