Does Drupal work in China?
Whether Drupal works in China comes down to where and how you host it — an ICP and data-residency question, not whether Drupal is "blocked." Drupal is open-source software you run on a server you choose, so that one decision sets both answers that matter in the mainland.
In its own install guide Drupal tells you to "Meet Drupal's system requirements on either a local or remote server" — you supply the server, Drupal runs on it, and it is software rather than a hosted service with a single endpoint the mainland can allow or block. Two things follow for a China audience. A public site served to the mainland needs an ICP filing tied to a licensed in-country host, which an offshore server has nothing to attach to; and because Drupal keeps user accounts, comments and form submissions in its own database, an offshore database turns the personal data of people in China into a cross-border transfer PIPL governs. The table below sets Drupal's own wording against the rule each door triggers.
This is a risk picture, not a verdict — what applies turns on whether you serve the public in China and the data your site collects. Our China team can map your Drupal hosting and data exposure with you →
Compliance snapshot
- ✓ Drupal is self-hosted open-source software — you choose where it runs, including inside mainland China
- ✕ Hosted offshore, a public mainland site has no ICP-filing path — the filing needs a licensed in-country host
- ! User accounts, comments and form data live in Drupal's database — offshore, that's a cross-border PI transfer under PIPL
- ! "Is Drupal blocked?" is the wrong question — it's software you run, not a SaaS; where you host it decides the answer
- ✓ Compliant path: run Drupal on ICP-filed infrastructure inside the mainland — an overlay, not a rebuild
What actually decides whether you can run Drupal in China
| Fact | Primary source |
|---|---|
| In Drupal's own words, it is software you host yourself. Drupal's install guide directs you to "Meet Drupal's system requirements on either a local or remote server" — you provide the server and Drupal runs on it. It is a free, open-source PHP content management system you download and operate, not a hosted service at a fixed address, so where you run it is your decision and it sets every answer below. | Drupal.org — Installing Drupal, retrieved 2026-10-07 |
| A public mainland site needs an ICP filing, and an offshore Drupal host has nothing to file against. Under State Council Order No. 292 (Article 4) and MIIT Order No. 33, an ICP filing (备案) attaches to a hosting resource physically inside mainland China and to a mainland legal entity. Run Drupal on an offshore server and there is no in-country resource for the filing; run it on licensed infrastructure inside the mainland and the same site becomes filable. The door is the hosting location, not Drupal. | State Council Order No. 292 (Measures for the Administration of Internet Information Services), Article 4; MIIT Order No. 33 |
| Drupal's database holds personal information, and offshore that is a cross-border transfer under PIPL. User accounts, comments, and contact or webform submissions live in Drupal's own database, which sits wherever your server sits. Keep it offshore and the personal data of people in China leaves the country — PIPL governs it (Chapter III, Articles 38–43: notice, separate consent, and one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification). For a CIIO or large-volume handler, data collected in China must be stored inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). | PIPL Chapter III, Articles 38–43 and Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
| The weight of that duty scales with volume and role, not with using Drupal. Under the CAC's March 2024 Regulations on Promoting and Regulating Cross-border Data Flows, a non-CIIO transferring fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, the standard contract and certification. | CAC — Regulations on Promoting and Regulating Cross-border Data Flows, March 2024 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
Drupal is one of the most widely used open-source content management systems in the world, and “does Drupal work in China” has an unusual answer: it depends almost entirely on where you host it. Drupal is not a hosted service with a single endpoint the mainland can allow or block — it is software you download and run on a server of your choosing. So the honest version of the question is not “is Drupal blocked,” but “is the place you run Drupal licensed to serve the public in mainland China, and is the data it collects allowed to live there.”
Those are two compliance questions, and they are the half of “does Drupal work in China” that no amount of theme, module or caching work answers. Below is what Drupal documents about being self-hosted, the ICP filing a public mainland site turns on, and how China’s Personal Information Protection Law treats the data your Drupal database holds — in Drupal’s own words and China’s own law, so you can take it to counsel rather than to a benchmark.
Drupal in China at a glance
| What decides it | In Drupal's own words — and China's own law |
|---|---|
| What Drupal is | A free, open-source PHP content management system you host yourself. Drupal's install guide tells you to “Meet Drupal's system requirements on either a local or remote server” — you provide the server and Drupal runs on it. It is software, not a hosted service at a fixed address. |
| Is it blocked? | That is the wrong question. Because Drupal runs on a server you control rather than at one SaaS endpoint, there is nothing for the mainland to switch on or off. Where you host it — offshore or inside the mainland — is what decides reachability and both compliance doors. |
| Serving the public in China | A public site shown to mainland visitors needs an ICP filing (备案) tied to a licensed mainland host and a mainland legal entity (State Council Order 292, Article 4; MIIT Order 33). An offshore Drupal host has no in-country resource for the filing to attach to. |
| Data in the database | User accounts, comments and contact or webform submissions are personal information, and they live wherever your Drupal database lives. An offshore database is a cross-border transfer PIPL governs; a CIIO or large-volume handler must keep personal information collected in China inside the mainland. |
| The working design | Keep your Drupal origin; add ICP-filed, in-country delivery in front of it for mainland visitors — and where the law requires, run the Drupal instance and its database inside the mainland. An overlay, not a re-platform. |
What Drupal actually is — software you host, not a service that can be blocked
Drupal’s own install guide is the place to start, because it answers the question most “does it work in China” articles skip: who provides the server. The guide directs you to “Meet Drupal’s system requirements on either a local or remote server” — in other words, you supply the hosting and Drupal runs on top of it. It is free, open-source PHP software you download and operate, not a managed service sitting at one address that the mainland can permit or refuse.
That single fact reframes the whole question. There is no “Drupal service” with a fixed endpoint for China’s network controls to allow or deny, so “is Drupal blocked in China” is the wrong lens. Reachability still matters at the edges — a Drupal site hosted offshore can be slow for mainland visitors, and themes or modules that pull in third-party fonts, analytics or map libraries can load assets that are themselves degraded inside the mainland — but that is a delivery matter, not what decides whether you may run Drupal for a Chinese audience. What decides that are the two doors below, and both of them turn on where you put the server.
The first door: an ICP filing for a public mainland site
Serving a public website to people in mainland China turns on a permission that has nothing to do with Drupal’s code: an ICP filing (备案). Under State Council Order No. 292 (Article 4) and MIIT Order No. 33, that filing attaches to a hosting resource physically inside the mainland and to a mainland legal entity — a site served from offshore has nothing in-country for it to bind to.
This is exactly where “where you host it” becomes decisive. Run your Drupal instance on an offshore server and the filing has no resource to sit on; move the same Drupal site onto licensed infrastructure inside the mainland and it becomes filable without changing a line of your code. The filing follows the hosting, and the hosting is your choice — which is why the ICP question is about your deployment, not about Drupal.
The second door: the personal data in your Drupal database
A Drupal site rarely just displays pages. User accounts, comments, contact and webform submissions, and anything a commerce or membership module records all land in Drupal’s own database — and that database lives wherever your server lives. For a mainland audience, that makes data residency the second door.
A visitor in China’s account details and form submissions are personal information. Keep the database offshore and you are carrying that personal information out of the mainland, which China’s Personal Information Protection Law governs as a cross-border transfer (Chapter III, Articles 38–43: notice, separate consent, and one permitted transfer mechanism — a CAC security assessment, the CAC standard contract, or certification). The weight scales with volume and role rather than with using Drupal at all: under the CAC’s March 2024 cross-border rules, a non-CIIO moving fewer than 100,000 individuals’ non-sensitive personal information in a calendar year is exempt from those mechanisms, while a CIIO or large-volume handler must keep personal information collected in China inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Which of these applies to you is a question for counsel, so treat the specifics as a risk picture rather than a default.
Where 21YunBox fits — a compliant overlay, not a migration
You keep Drupal exactly as you build it today — same core, same modules, same themes, same workflow. What a mainland-China audience adds is the one thing a server’s location dictates and tuning cannot: ICP-filed delivery from inside the mainland, placed in front of your existing Drupal origin, with a fixed in-country entry so each visitor’s real IP is not carried across the border. Our China team maps which obligations apply to your entity and the data your Drupal database holds, handles the ICP filing, and stands up the in-country entry — and where the law requires your users’ data to stay on Chinese soil, helps you run the Drupal instance and its database inside the mainland. No rebuild, no second codebase, no re-platform.
Related reading:
Frequently Asked Questions
Is Drupal blocked in China?
No — and that is the wrong question for Drupal. Drupal is open-source software you run on your own server, not a hosted service with a single endpoint the mainland can allow or block. What decides whether it "works" is where you host it: a public mainland site needs an ICP filing an offshore host can't hold, and the personal data in your Drupal database sits wherever the server sits. An offshore-hosted site can also be slow for mainland visitors or load third-party assets that fail there, but that is delivery, not a block.
Can we run Drupal in China?
Yes — host it on infrastructure inside mainland China. Because Drupal runs on "either a local or remote server" you choose, an in-country instance is entirely possible, and that is what lets a public site complete an ICP filing and keeps your users' data on Chinese soil. What is not compliant by default is serving a mainland audience from an offshore Drupal host. Treat the specifics as a risk to confirm with counsel.
Can 21YunBox help make our Drupal site compliant in China?
Yes. Our China team can assess your ICP and data-residency exposure for your entity and the data your Drupal database holds, handle the ICP filing, and stand up ICP-filed, in-country delivery in front of your Drupal origin — and, where the law requires your users' data to stay on the mainland, help you run the Drupal instance and its database inside the country. Get in touch to work through your specific setup.
