Government CMS Census: What 8,827 .gov Websites Run

WordPress is the most common government CMS in the United States, but it does not lead at every level. We requested the homepage of all 16,999 domains in the official .gov registry and identified the platform behind the 8,827 that opened on a live website. WordPress runs 28% of them. CivicPlus, a company that builds city and county websites, runs 23%. Drupal runs only 5% overall, yet it leads among federal sites with 33% of the 503 we could read.

The pattern follows the level of government. Federal and state sites run open-source platforms or custom builds. Counties and cities mostly buy from government website vendors or use WordPress and site builders such as Wix and Webflow. Below are the numbers by level and by state, the Drupal versions government sites run (83 are past end of life), and what the census suggests if you are choosing a CMS for government.

How we checked 16,999 .gov domains

The frame is CISA’s official list of registered .gov domains, the current-full.csv file as updated on 1 November 2026. It gives each domain’s type (federal, state, county, city, tribal and others), owner, city and state.

On 2 November 2026, a script requested each domain’s homepage the way a browser would, trying https:// on the bare domain, then on www, then http://. We identified the platform from response headers and page code and hand-checked a random sample of every platform’s matches. The methodology section has the details.

Half the registry is a live website. CISA notes that not every registered domain offers a website, and the census bears that out. 2,342 domains have no address record for either the bare domain or its www host, 685 more timed out, and 57 refused the connection or failed in other ways. Another 733 forward to a different site: 675 to another .gov domain (vets.gov forwards to va.gov, for example) and 58 to a site we had already counted or could not follow.

One domain in five refused us. 3,194 domains returned a bot challenge, a login or an access-denied page, most often from Cloudflare (1,407) or Akamai (554). We ran the check from a server outside the United States, and many government sites block or challenge foreign traffic. We did not try to get past any of them, so these are counted as not checked, never guessed.

Some .gov addresses are parked. 495 domains, mostly city (324) and county (104) domains, sent us to an ad-filled domain-parking page. Others showed a web host’s default page or an “under construction” notice. Three served content that had nothing to do with the government that owns the domain, two of them gambling spam.

Government CMS market share by level of government

Federal: Drupal leads, custom builds close behind

Drupal runs 167 of the 503 live federal sites we could read (33%). They include usa.gov, irs.gov, ssa.gov, justice.gov, epa.gov, house.gov and uscourts.gov. WordPress runs 49 (10%), among them whitehouse.gov, nasa.gov, state.gov and sba.gov.

Another 49 federal sites (10%) are static builds or JavaScript front ends. Treasury.gov is built with Hugo, tsp.gov with Jekyll and va.gov with Next.js. Census.gov runs Adobe Experience Manager. Forty percent show no CMS fingerprint, and many of those are applications rather than content sites: sign-in pages, search tools and data portals.

The federal figures rest on the sites that let us in. Several large departments, including hhs.gov, usda.gov, dhs.gov, defense.gov, transportation.gov and nih.gov, blocked the request, so their platforms are not in the count.

State: WordPress first, Drupal second

WordPress runs 118 of 440 live state and territory sites (27%) and Drupal 65 (15%), including georgia.gov and dc.gov. Commercial platforms take 9%: Adobe Experience Manager runs pa.gov and illinois.gov, several Ohio agency sites run on WebSphere Portal (now HCL Digital Experience), and oregon.gov runs on SharePoint. A third show no fingerprint.

Counties and cities: the vendors take over

At county level, WordPress runs 29% of 1,408 live sites and CivicPlus 25%. Among 5,641 city, town and village sites, CivicPlus and WordPress are level at 28% each. Government website vendors as a group run 43% of city sites, and consumer site builders run another 15%. Drupal runs 3.6% of county sites and 2.4% of city sites.

Districts, tribes and other bodies

Special districts, tribal governments, school districts and interstate bodies account for 835 live sites. WordPress runs 35% of them. Streamline, a platform built for special districts such as water, fire and mosquito-control districts, runs 22%.

Who builds local government websites

Below the two leaders sits a long list of smaller vendors, most of them regional. These are the government website vendors with 30 or more live .gov sites, counted from code each vendor’s platform leaves in the page.

Platform	Live .gov sites	Where it shows up
CivicPlus (CivicEngage and HCMS)	1,991	1,593 city and 351 county sites; 73% of state and local sites in Massachusetts
Munibit	205	Cities and towns (193); New York (43), Wisconsin (24)
Streamline	191	Special districts (183); California (62), Utah (37)
Revize	182	Cities (126) and counties (50)
Catalis GovOffice	180	Cities; Minnesota (62)
MunicipalImpact	136	Cities (134)
ezTask	51	Texas counties and cities (46 of 51)
EvoGov	45	Cities and counties in many states
TownCloud	37	Towns; New Hampshire (12)
CivicLive	34	Cities

Site builders fill much of the rest. Wix runs 350 live .gov sites, Webflow 227, Squarespace and Weebly 148 each, GoDaddy’s builder 110 and Duda 56. Most Webflow sites carry a credit to Town Web, which builds town websites on it, and that is why Webflow runs 23% of state and local sites in Wisconsin. Granicus, a large government technology vendor, matched only four sites. Its customers may be among the blocked domains, so treat it as undercounted rather than rare.

One more local habit: 585 live sites sit on a non-.gov address. The .gov domain forwards to a .com, .org or .us address where the site actually lives.

Drupal government sites: versions and end of life

We found 433 live .gov sites on Drupal: 167 federal, 65 state, 51 county, 136 city and 14 others. For 389 of them the headers or page code show the major version. 141 run Drupal 11 and 165 run Drupal 10. Another 36 use asset URLs that Drupal introduced in version 10.1, so they run Drupal 10 or 11. Eight show no version number.

83 run a version past end of life: 70 on Drupal 7 (three of them could be Drupal 6), nine on Drupal 9 and four on Drupal 8. Under the drupal.org release schedule (checked November 2026), Drupal 8 lost support in November 2021, Drupal 9 in November 2023 and Drupal 7 in January 2025.

The problem sits in cities. 55 of 136 city Drupal sites (40%) run an end-of-life version, against 6 of 167 federal sites (4%). A cluster explains part of it: 33 Drupal sites carry a “municode design” footer credit, and all 33 run Drupal 7. CivicPlus is credited on 34 Drupal sites, 21 of them on Drupal 11 and 13 on Drupal 7.

The federal end-of-life sites are few but visible. The National Archives homepage at archives.gov serves Drupal 7 code, fjc.gov announces Drupal 7 in its headers, and usadf.gov reports Drupal 8.9.15. Our Drupal 7 statistics page tracks how many Drupal 7 sites remain on the wider web.

The next deadline is close. Drupal 10 reaches end of life on 9 December 2026, five weeks after this census, and 165 government sites still report it. Of the Drupal 10 sites that expose an exact version number, seven are on minor releases older than 10.6, which the schedule shows are already out of security support. Our Drupal 11 adoption tracker shows the same lag across all Drupal sites, and our Drupal security guide covers what to do while an upgrade is pending.

Hosting shows for some: 110 of the 433 Drupal sites carry Acquia headers and 15 carry Pantheon headers. Another 104 sites that blocked us also answered from Pantheon, a host for Drupal and WordPress, so both are probably undercounted here. Our .gov Drupal hosting study compares how fast those hosts answer.

A check against our September study

In September we found 424 Drupal sites among 1,347 federal and state domains that answered with HTTP 200 (31.5%). Counted the same way, including domains that forward to another agency’s site, this census finds 413 among 1,518 (27.2%). The Drupal count agrees within 3%; the share is lower mainly because this check also tried www and plain HTTP addresses and so reached more domains. But 181 of the 413 simply forward to another .gov site on Drupal. Counted as distinct live websites, as every other figure here is, Drupal runs 232 of 943 federal and state sites (24.6%).

Some sites have moved on since September. That study found dc.gov on Drupal 7; it now reports Drupal 10.

Government CMS by state

State and local sites only (federal domains are excluded), for the ten states with the most live .gov sites.

State	Live sites	Leading platform	Second	Drupal
New York	958	WordPress 32%	CivicPlus 15%	20
Wisconsin	521	WordPress 26%	Webflow 23%	4
Texas	424	CivicPlus 40%	WordPress 13%	8
Minnesota	417	CivicPlus 24%	WordPress 21%	7
California	404	CivicPlus 29%	WordPress 21%	26
Michigan	404	WordPress 64%	CivicPlus 12%	2
Ohio	366	WordPress 42%	CivicPlus 19%	3
Utah	289	WordPress 30%	CivicPlus 14%	4
Florida	256	WordPress 30%	CivicPlus 30%	10
Illinois	229	WordPress 38%	CivicPlus 18%	9

Two states stand out. In Massachusetts, CivicPlus runs 166 of 227 state and local sites (73%). In Michigan, WordPress runs 260 of 404 (64%). Among states with 40 or more live sites, Drupal’s highest shares are in North Dakota (7 of 41) and North Carolina (31 of 187), 17% each.

Choosing a CMS for government: what the census suggests

A census shows what governments run, not what they should run, but the split by level follows the shape of the work.

Large agencies with many editors lean toward Drupal or a custom build. A federal or state site usually has dozens of contributors, approval steps, structured content and an audit trail to keep. That is the pattern behind Drupal’s 33% federal share, and our guide to Drupal for government websites covers why it fits and how to buy it.

Small governments buy a service. A town with one clerk updating the site wants hosting, templates, meeting agendas and support in one contract, and that is what CivicPlus and the smaller vendors sell. WordPress is the open-source alternative at that size. Our comparison of Drupal and WordPress for government and higher education sets out where each one earns its cost.

Whatever you pick, check four things the census made visible:

1. The support calendar. 83 Drupal sites run versions without security fixes. Ask any vendor or agency for the end-of-support date of the version they will install, and budget for the upgrade before it arrives.
2. Who can reach the site. 19% of .gov domains refused a plain request from outside the US. If residents, service members or partners abroad need your site, test it from where they are.
3. Your domain. 495 .gov domains point at parking pages and 2,342 have no web address at all. Keep DNS for every registered domain under someone’s care, or retire the domain.
4. The exit. On a vendor platform, confirm in the contract that you can export pages, documents and URLs if you leave.

Key statistics

• 8,827 of the 16,999 domains in the .gov registry (52%) opened on a live website on 2 November 2026 (Gspikes, November 2026).
• WordPress is the most common government CMS, running 2,433 of 8,827 live .gov websites (27.6%) (Gspikes, November 2026).
• CivicPlus runs 1,991 live .gov websites (22.6%), including 28% of city sites and 25% of county sites (Gspikes, November 2026).
• Drupal runs 33% of live federal .gov websites (167 of 503) and 15% of state sites, but 4.9% of all live .gov sites (Gspikes, November 2026).
• 83 of 433 government Drupal sites (19%) run Drupal 7, 8 or 9, all past end of life, and 165 more run Drupal 10, which reaches end of life on 9 December 2026 (Gspikes, November 2026).
• 40% of city Drupal sites (55 of 136) run an end-of-life version, against 4% of federal Drupal sites (Gspikes, November 2026).
• 3,194 .gov domains (19%) blocked or challenged a plain request from outside the US (Gspikes, November 2026).
• 495 .gov domains, most of them city and county domains, point at a domain-parking page (Gspikes, November 2026).

Methodology and data

Frame. All 16,999 domains in CISA’s current-full.csv (dotgov-data repository, updated 1 November 2026). We grouped domain types into five levels: federal (executive, legislative and judicial; 1,321 domains), state or territory (1,485), county (3,052), city (9,611), and other (1,530: special districts, tribal governments, school districts and interstate bodies).

Requests. One run on 2 November 2026 between 00:28 and 01:25 UTC, from a server in Amman, Jordan. For each domain: https://domain, then https://www.domain, then plain HTTP for hosts that had not failed DNS or timed out. Browser user agent, at most 20 concurrent connections, 15-second timeout, redirects followed, plus up to two meta-refresh redirects (and script redirects on near-empty pages). When a certificate failed validation we retried without validation, so an expired certificate did not hide a site. Bot challenges, logins and firewalls were not bypassed; those 3,194 domains are reported as not checked.

Outcomes. A live website is a final page that returned 2xx and was not a challenge, parking, default, placeholder or error page. Domains forwarding to another .gov domain are reported separately, a site reached from several domains is counted once, and sites on a non-.gov address (585) count as the government’s live site.

Platform detection. From headers and homepage code: Drupal’s X-Generator and X-Drupal headers, generator tag and settings scripts; WordPress’s generator tag, emoji script, REST API link and /wp-content/ paths; each vendor’s own paths and scripts (CivicPlus’s /ImageRepository/ path, for example); and the asset hosts, headers or generator tags of site builders, enterprise CMSs and static generators. Path rules count only paths on the site’s own domain, and a footer credit never sets the platform on its own. Drupal versions come only from headers, generator tags, versioned core asset URLs and version-specific scripts or URLs; where a site printed two conflicting generator tags, we used the one in core’s format.

Verification. We hand-checked five random sites per platform (all of them where there were fewer), 312 sites in all, plus samples of every outcome and recurring patterns among unidentified sites. That first review found errors: links to other sites’ media folders had matched Sitecore, Adobe Experience Manager and Optimizely, the word “percussion” had matched Percussion CMS, a hotel name had matched Edlio, and more than 100 pages first counted as live sites were really host default pages, error pages, webmail logins or challenges. We tightened those rules, re-ran all 16,999 rows, and drew a fresh sample of 310 sites, which turned up no wrong platform. Three domains serving unrelated content were moved out of the live count by hand.

Limits. “No CMS fingerprint” is a ceiling for custom builds, not a count of them: a CMS behind a CDN or a decoupled front end can hide. Blocked domains skew toward sites behind Cloudflare, Akamai and Pantheon, so the platforms those sites use are undercounted. A homepage shows what serves the homepage, not every subsite an agency runs.

Data. Download the full census (one row per domain, with the outcome, platform, evidence, Drupal version and hosting hints) as a CSV file. It is free to reuse with attribution to Gspikes.

Running a government site on Drupal 7, 8, 9 or 10, or weighing a move to Drupal 11? Our Drupal migration service moves government sites without losing their URLs or search traffic, and our Drupal development team builds and supports multi-editor public-sector platforms. If you would like a second opinion on your current platform, ask us for a free review.

Field Notes

Get the next one by email

Research on Drupal, WordPress and search. Measured, not guessed. New pieces straight to your inbox.

Company website

Email address Subscribe

Confirmed opt-in. One click to leave, any time.