AI Drupal GEO Security Audit

AI agents do not only read web pages: how to make a Drupal site understandable and safe for machines

AI agents do not browse the web in the same way people do. They look for structure, APIs, permissions, verifiable answers and trustworthy sources. Drupal has strong foundations for this, but only when the platform is deliberately maintained and structured.

# AI agents do not only read web pages: how to make a Drupal site understandable and safe for machines

In recent weeks, the Drupal community has been discussing a question many organisations are only beginning to formulate: how does the web change when it is used not only by people, but also by AI agents?

On July 23, 2026, the Drupal AI Initiative published "Outside AI - The State of Agent Experience in Drupal". The article describes how an agent may be asked to create a content model, configure permissions, modify a running system or verify the result. In that view, Drupal should not simply be the fastest way to generate individual pages. It should be a safe, governed and verifiable way to build long-lived digital platforms.

A day later, on July 24, 2026, the Drupal Association published an update on the first six weeks of the Drupal AI Security Initiative. The article highlights that AI-assisted analysis is making vulnerability discovery cheaper and faster, which also changes the pressure on security processes.

The same broader web shift appears in Dries Buytaert's July 22 and July 23 posts about API Catalog and Agentic Resource Discovery. These posts describe how websites may become discoverable to agents not only through HTML pages, but also through documented APIs, machine-readable catalogs and directly usable resources.

For a school, municipality, public-sector organisation, university or larger institution, this raises a practical question: is our Drupal site ready for a world where the user may not arrive through the homepage, but through an AI system or agent?

From SEO to GEO and Agent Readiness

SEO focuses on making content understandable to search engines so it can appear in relevant search results.

GEO, or generative engine optimization, adds another layer: can a generative search engine or language model understand, summarize and cite the organisation's content correctly?

AI agents make the question more operational. An agent may not only read. It may try to act:

  • find the right form;
  • locate a regulation, guide or service;
  • compare several services;
  • draft content for an editor;
  • request data through an API;
  • check whether a page meets requirements;
  • suggest changes to content structure or permissions.

If a site is built only for visual browsing by humans, an agent is forced to guess. If the site is structured, documented and verifiable, the agent can work with better context.

Why Drupal Has a Strong Starting Point

Drupal is well suited to this topic because its long-standing strengths are exactly where AI agents need support:

  • structured content types;
  • fields and taxonomies;
  • roles and permissions;
  • workflows and approval processes;
  • revisions and content history;
  • multilingual content;
  • APIs;
  • configuration management;
  • auditable development processes.

The Drupal AI Initiative's Outside AI article makes a similar point: Drupal has long experience with structured content, permissions, workflows, configuration, APIs and migration. These are not just developer conveniences. They are the foundations that allow an AI agent to do something verifiable, not merely something that looks roughly correct.

The question is not whether Drupal can work in the AI era. The question is whether a specific Drupal site is actually in good shape.

What Makes a Site Understandable to an AI Agent?

Making a site understandable to AI agents does not mean adding an "AI-friendly" text block to every page. In most cases, the work begins with something less glamorous and more useful: content modelling, metadata and logical structure.

For a Drupal site, it is worth checking whether:

  • content types describe real services, news, documents, people and events;
  • important information is stored in fields, not only in long free-text blocks;
  • taxonomies are consistent;
  • URLs and page titles are logical;
  • meta descriptions and structured data are used where relevant;
  • multilingual pages are connected correctly;
  • outdated content is archived or updated;
  • site search actually finds important information;
  • public data and private data are clearly separated.

A human may sometimes work around poor structure visually. An agent may not. If important information is hidden inside images, PDFs, unstructured text fields or manually repeated content blocks, reliable machine use becomes much harder.

APIs and Discoverability: The Next Practical Layer

On July 22, 2026, Dries Buytaert wrote about API Catalog as a way for a site to tell machines which APIs exist and how to use them. In his example, /.well-known/api-catalog points to an OpenAPI description explaining how the site's search API works.

In his July 23 post, he added the perspective of Agentic Resource Discovery, or ARD. If API Catalog helps an agent once it has already found the site, ARD tries to address the broader problem of discovery.

This is still an emerging area, not a finished standard every organisation needs to implement tomorrow. But the direction matters: the web is no longer only a collection of pages. It is increasingly a collection of described resources, APIs and actions.

For a Drupal site owner, this means future development should consider:

  • which data could reasonably be available through an API;
  • which actions should never be available to an agent;
  • which APIs require authentication;
  • how permissions are checked;
  • whether API documentation exists;
  • whether external tools can verify responses;
  • whether logs show who or what performed an action.

Not everything should be opened. In fact, the first rule of good agent readiness is the opposite: only open what has been deliberately decided.

Security Becomes Even More Important

AI agents and AI tools do not reduce security risk. In some cases, they make risks faster.

The Drupal AI Security Initiative's July 24, 2026 update says AI-assisted analysis has made vulnerability discovery cheaper and may increase report volume faster than a volunteer security team can process manually. The article also describes an initiative that adds funded security capacity to Drupal while working alongside the existing Security Team.

For organisations, the conclusion is straightforward: if AI helps defenders find problems faster, it can also help attackers find problems faster.

That makes ordinary maintenance questions even more important:

  • are Drupal core and contributed modules on supported versions;
  • do security updates reach production within a controlled timeframe;
  • are user permissions minimal and justified;
  • are admin permissions too broad;
  • are APIs documented and restricted;
  • are logs actually usable;
  • do backups and restore tests work;
  • is there a security incident plan.

AI readiness without maintenance is decoration. Real readiness starts with a healthy platform.

What Should an Organisation Audit on Its Drupal Site?

If the goal is LLM/GEO and agent readiness, a standard SEO audit is not enough. Content, technical architecture, permissions and workflows need to be reviewed together.

A practical audit scope could include the following areas.

1. Content and Structure

Does the site have clear content types, fields and taxonomies? Are services, documents, news, contacts and FAQs machine-readable as distinct content? Is important information available in HTML, not only in PDFs or images?

2. Search and Findability

Does site search find key services and documents? Are search results usable by machines as well as humans? Are results sorted and filterable in a meaningful way?

3. Metadata and Structured Data

Do pages have clear titles, descriptions, language relationships and, where appropriate, Schema.org markup? Does public content provide enough context for search engines and AI systems?

4. APIs and Integrations

Are existing APIs documented? Are permissions role-based and tested? Could an API accidentally expose information that should remain internal?

5. Permissions and Workflows

Are editor, administrator and technical user permissions justified? Could an agent or external system operate only through a limited role? Does every important change leave a trace?

6. Maintenance and Security

Are updates, logs, backups, staging environments and restore processes in good shape? If they are not, it is too early to talk about mature agent readiness.

An Agent Does Not Replace Content Strategy

It is important not to confuse AI readiness with AI-generated content.

An organisation may use AI to produce text faster, but if the underlying content is outdated, contradictory or poorly structured, AI will amplify the problem. An agent may rephrase inaccurate information more elegantly, but that does not make the information correct.

This is where Drupal's value becomes practical. It can turn content governance into a working system:

  • who can create content;
  • who can approve it;
  • which fields are required;
  • how content expires;
  • how translations are managed;
  • how changes are logged;
  • how incorrect or outdated information is fixed.

AI can help speed up the workflow. Governance must remain with the organisation.

What Should You Do First?

If an organisation wants to understand whether its Drupal site is ready for AI agents and generative search, it should start with three simple questions:

  1. Is our important public information structured, up to date and machine-readable?
  2. Are our permissions, APIs and workflows controlled well enough?
  3. Can our maintenance process respond quickly to security and quality issues?

If the answer to any of these is uncertain, a Drupal audit is a sensible first step. It does not have to mean a large rebuild. Often, an audit simply clarifies what can be fixed quickly, what should be planned into the next development phase and which risks require a management decision.

Summary

AI agents are changing how the web is used. They do not only look at how a page appears on screen. They need structure, permissions, verifiable answers, APIs and trustworthy context.

Drupal has strong foundations for this: content models, roles, workflows, APIs, multilingual support, configuration management and auditable development practices. But those strengths only matter when the specific site is deliberately planned and maintained.

WebPro helps with Drupal audits, maintenance, admin interface planning, new feature development and AI and LLM/GEO readiness assessment. The goal is not to turn a website into an "AI buzzword". The goal is to create a platform that people, search engines and AI agents can use accurately, safely and in a controlled way.

Subscribe via RSS
Kaido Toomingas Kaido Toomingas WebPro Company OÜ

Need Drupal help?

If the article describes your situation, you do not have to read everything first. A real person will help you choose the next step.

Contact us