Drupal’s Funding Crisis: What It Means for Open Source Sites

Open source software feels free until the people maintaining it run out of money to keep doing it — and that’s exactly the warning Tiffany Farriss, interim CEO of the Drupal Association, laid out in a recent episode of the WP Tavern podcast. Her numbers matter beyond Drupal: they describe a structural problem that touches every site owner who depends on open source code, WordPress included.

Who is Tiffany Farriss and why her warning carries weight

According to WP Tavern, Farriss has spent 30 years in web design and development, 20 of them inside the Drupal community, and she is the organization’s longest-serving board member after founder Dries Buytaert. She stepped into the interim CEO role this year after Tim Doyle departed, resigning her board seat and treasurer position first, as reported by the Drop Times. She remains the owner of Palantir.net, a Chicago-based Drupal agency, but says she has stepped back from day-to-day operations there under a formal conflict-of-interest framework while she runs the Association.

The "maker-taker" problem, in numbers

Farriss described the imbalance bluntly on the podcast: the Drupal Association delivers roughly $10 worth of services to every site every year but only collects about $7.50 for it, a gap she calls unsustainable technical debt. The concentration of who actually pays is just as stark — of 2,800 organizations that contribute annually, fewer than 5% account for two-thirds of all contributions, and that same small slice generates 94% of the financial support keeping the infrastructure running, per WP Tavern’s reporting.

Her response isn’t a plea for charity. As the Drop Times reported, Farriss is pushing for programme-level cost accounting, usage-based contributions from enterprise users of infrastructure services, and — at the policy level — government procurement rules that would require upstream patch contributions within 30 days and set a standard 2-5% allocation of public contracts toward the open source projects they depend on. The Drupal Association is also running a six-month pilot of a Certified Partner Program that credits organizations across three pillars: making (code), patronage (money), and advocacy.

Why this matters even if you run WordPress, not Drupal

WordPress and Drupal solve the funding problem differently. Drupal’s GPL requirement means modules stay free, so the Association has to fund infrastructure directly through sponsorship and association membership. WordPress instead relies on a distributed ecosystem of paid plugins, themes, and hosting partners — which spreads revenue around the community but doesn’t eliminate the underlying dependency: a small number of committed maintainers and companies carry a disproportionate share of security patching, core development, and infrastructure costs.

For anyone running a business on open source CMS software, the practical lesson is the same regardless of platform: don’t treat your stack as a free, self-sustaining utility. Delayed security patches, under-resourced core teams, and volunteer burnout are downstream effects of exactly the funding gap Farriss is describing. That’s one more reason to take technical hygiene seriously on your own end — staying current matters more when the ecosystem around you is financially stretched. If you’re still running outdated software versions, the risks of outdated PHP versions are a good place to start auditing your own exposure.

What site owners can actually do

You can’t fix Drupal’s or WordPress’s funding model from your dashboard, but you can reduce how much your own site depends on an overstretched volunteer base reacting to emergencies. A solid security checklist and sensible hosting choices absorb a lot of the risk that comes from slower community response times. Reviewing your own setup against a WordPress security checklist is a quick way to see where you’re exposed, and if your hosting plan hasn’t been reassessed in a while, comparing shared vs managed WordPress hosting can clarify whether you’re paying for the operational buffer a stretched ecosystem increasingly requires.

The bigger picture

Farriss’s framing — that shared digital infrastructure should be billed as a transparent utility rather than donated as charity — is a direct challenge to how most organizations currently budget for open source. Whether Drupal’s enterprise members adopt usage-based contributions, and whether governments actually write open source allocations into procurement rules, will take months or years to play out. But the underlying math she presented — a handful of contributors covering the gap for everyone else — isn’t unique to Drupal. It’s the quiet reality behind most of the software millions of small business sites run on every day.

Priya Nair

Priya covers hosting, performance, security and backups. She reads changelogs and pricing pages so readers don't have to, and flags what changed since the last update.

Updated on November 12, 2026