I've decided the Drupal experiment did not work out. I don't have enough time to absorb the complexity of Drupal, and it is irresponsible to tweak my security settings when I don't even understand how Drupal is interacting with them.
Wordpress is what I'm looking at now. It's a lot less complicated than Drupal and can do most of what I want it to. While I still have to tweak my security settings, the smaller number of files means that I can see why and understand what is going on between Apache and Wordpress when mod_sec throws an error (usually a 501).
