I loved Drupal back in the day, but at some point (D8+, part of it moving to Symfony), it became too difficult to manage and for me personally to keep up with.<p>But I believe that, in the early days, Drupal made excellent foundational design choices as a framework, and if you used it's APIs in your custom module development, then, generally speaking, you would have a secure website.<p>But now, D7 is approaching EOL, and I absolutely don't want to migrate to the latest flavor. D7 has been rock solid for a decade, and I have no desire to chase the latest fad.<p>I wish that there were a stable, monolithic solution that is simpler to setup (as in including everything, including database, webserver, SSL certs, etc.) that just worked and was extendable and overridable programmatically, in the same way that Drupal was.<p>Modern web stacks have become a bucket of Lego pieces that seems ok if you are an expert in everything and know how to put everything together exactly. The problem is, most people aren't experts in form handling, login and authentication, media handling, caching, etc.