Drupal 11 is the newest major chapter in one of the web's most enduring open-source content management systems. Since its initial release in August 2024, it has moved through a steady stream of minor releases — 11.1, 11.2, 11.3, and now 11.4 — each one layering on new capabilities while quietly making the platform faster and more secure. This post breaks down what actually changed, why it matters, and where Drupal is headed next.
A Quick Recap: Why Drupal 11 Exists
Drupal follows a predictable two-year major-version cadence. Drupal 10 shipped at the end of 2022, Drupal 11 arrived in August 2024, and Drupal 12 is slated for the second half of 2026. Each major version mainly exists to clear out deprecated code and move onto fresh, long-supported dependencies — this time that means PHP 8.3/8.4, Symfony 7, jQuery 4, and PHPUnit 10. Because Drupal 11 is a continuation of Drupal 10 rather than a ground-up rewrite, sites already on Drupal 10.3 can upgrade with minimal friction.
Drupal 7 officially reached end of life in January 2025, which makes Drupal 11 (or, at minimum, a current Drupal 10 release) the only responsible place for a production site to be today.
Key Features in Drupal 11
1. Recipes
Recipes are predefined bundles of modules, configuration, and content types that can be applied — not installed — to a site to deliver a specific feature, such as a blog, a forum, or an editorial workflow. Because recipes don't create a permanent dependency on themselves, you can apply one, tweak the result freely, and never get locked into the recipe's original definition. This is one of the clearest wins for site builders who want functionality without hand-configuring every module and view.
2. Single Directory Components (SDC)
SDC lets developers package a component's Twig template, JavaScript, CSS, and metadata into one self-contained folder. It moved from a contributed module into stable Drupal core with 11.0, and it's rapidly becoming the standard way to build reusable front-end components — front-end developers can work on a component without needing deep Drupal back-end knowledge.
3. CKEditor 5 Enhancements
Drupal 10 introduced CKEditor 5, and Drupal 11 keeps refining it: autoformatting that recognizes lists and headings as you type, Markdown-style shortcuts (like typing 1. for a numbered list), and more configurable code-block language options. Editors get an experience closer to Slack or Google Docs than a classic CMS textarea.
4. A Modernized Admin Experience
The classic administration toolbar renders faster, and an experimental Navigation module replaces it with a collapsible, left-aligned sidebar familiar to anyone who's used the popular Gin admin theme. Field UI also got a revamp, permissions gained a quick-filter search, and a new Announcements Feed module keeps administrators aware of core news out of the box.
5. Decoupled Menus and APIs
For headless and decoupled builds, Drupal 11 adds dedicated Linkset-standard endpoints, so front-end frameworks like React or Vue can consume menu data without hardcoding navigation structures.
6. Workspaces and Experience Builder
Workspaces (staging content before publishing) moved toward stability, and the in-progress Experience Builder module aims to let site builders visually assemble pages using drag-and-drop tools and basic HTML/CSS — no deep Drupal expertise required.
7. Drupal 11.4: This Year's Feature Release
The most recent minor release, 11.4.0, layered on top of everything above:
- Modernized translation APIs — legacy .inc files in locale.module were converted to object-oriented code.
- Brotli compression support for aggregated CSS/JS, alongside existing gzip support.
- New Twig functions (html_cva, html_attr, html_classes) via the twig/html-extra package.
- Standard installations no longer auto-create the Article and Page content types — new sites configure only what they need.
Security Updates You Should Know About
Security in Drupal isn't a single feature — it's a process, and Drupal 11 changed a few important parts of it:
- Drupal 7 end of life (January 2025): if you're still on Drupal 7, there is no more official security coverage. Migrating (typically via 9 → 10 → 11) is no longer optional from a risk standpoint.
- Improved password hashing: recent core releases have strengthened the algorithms used to store user credentials, reducing exposure if a database is ever compromised.
- More flexible dependency pinning: starting in 11.4, the drupal/core-recommended metapackage no longer locks Guzzle, Twig, or Symfony polyfills to narrow version ranges. Previously, strict pins combined with Composer 2.9's stricter dependency resolution could force a site to wait for an entire new Drupal core release just to receive a security patch in an upstream library. Now those patches can reach sites immediately.
- Active security-coverage windows: Drupal maintains overlapping supported branches so sites always have a safe upgrade path. As of this release cycle: Drupal 11.3.x and Drupal 10 both lose security coverage in December 2026 (when Drupal 12 and the Drupal 11.5 LTS release ship), while Drupal 11.4.x is covered until June 2027.
- Rapid regression patching: when three regressions were discovered shortly after 11.4.0 shipped, the community turned around Drupal 11.4.1 as a same-cycle bugfix release — including a fix for a data-loading bug that could cause a "Cartesian multiplication" issue in entity field loading, and a fix for JSON:API route discovery in contributed modules.
Takeaway for site owners: always track the latest supported minor release of your major version. Security advisories, hardening changes, and regression fixes only reach sites that stay current — falling behind even by one minor version can mean missing a fix.
Performance Changes: The Real Headline
If there's one theme connecting every Drupal 11 release so far, it's performance. The improvements compound release over release:
- Drupal 11.3 was described by the Drupal team as arguably the biggest performance improvement of the decade, driven by deep optimizations in caching and query handling.
- Drupal 11.4 matched that bar again, cutting database queries in half compared to 11.3 for the same requests, thanks to optimizations in how entity fields are loaded. On a cold cache, Drupal 11.4 now executes just over a third of the database and cache lookups that Drupal 11.0 or 10.6 needed for equivalent requests — representing hundreds of milliseconds saved per page load.
- Translation performance jumped 87%: in an internal test with 66 projects and 38 languages, checking for translation updates was 87% faster on Drupal 11.4 than on 11.3, following an extensive modernization of the locale and translation-import APIs.
- Brotli compression: aggregated CSS and JavaScript can now use Brotli instead of (or alongside) gzip, typically delivering 15–25% better compression ratios and faster downloads for supporting browsers — though it does require the ext-brotli PHP extension on the server.
- Smarter caching controls: developers can now disable Render Cache, Dynamic Page Cache, and Drupal Page Cache together with a single "Do Not Cache Markup" option, making it much easier to see a true, uncached view of in-progress work.
Should You Upgrade Now?
If you're on Drupal 10.3 or later, the path to Drupal 11 is short — the two versions share nearly identical public APIs, so most contributed modules and themes need little more than a compatibility check (the Upgrade Status module can help confirm this). If you're still on Drupal 9 or 7, plan a staged migration rather than a single leap, and prioritize it: Drupal 7 no longer receives security support, and Drupal 9 support ended back in November 2023.
Looking ahead, Drupal 12 and the long-term-support release Drupal 11.5 are both expected in the second half of 2026, with Drupal 11.5 offering support through the end of 2028 — a natural landing point for teams that want a stable base for the next few years.
Thoughts
Drupal 11 isn't a single dramatic leap so much as a steady compounding of wins: Recipes and SDC make building sites faster, CKEditor and admin UI refinements make managing them nicer, and — release after release — the platform keeps getting measurably quicker and more secure under the hood. If you manage a Drupal site, staying on the current minor release (11.4.x, as of this writing) is the simplest way to benefit from all of it at once.