Firstly, and foremost, IANAL/IANYL.
That said, as I understand this question, you have been asked by a third party to do some commercial website development, the website to be hosted on drupal, and the work to include some modifications to the drupal system itself (yes, I know you said ... or wordpress, but let's assume a stationary target).
According to the bottom of this page, drupal 8 (the current version) is distributed under GPLv2. This gives us three separate issues: content you create for publishing via your modified drupal system, your modifications to the drupal core itself, and drupal modules you create.
Firstly as I understand it, content you create for your client is not covered by drupal's licence. The basis on which this work is available to your client is up for agreement between the two of you. If you don't want your client to be able to sell it on, and you want to be able to reuse it yourself, you will need to ensure the agreement conveys only a non-exclusive, non-transferable right to use a single copy of this content. In some jurisdictions, you may need to address the issue of works for hire. Frankly, you should get a lawyer.
Secondly any modifications you make to the drupal core are pretty clearly covered by the core's licence. GPLv2 section 2b says that
You may modify your copy or copies of the Program or any portion of
it, thus forming a work based on the Program, and copy and distribute
such modifications or work under the terms of Section 1 above,
provided that you also meet all of these conditions: [...]
b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part
thereof, to be licensed as a whole at no charge to all third parties
under the terms of this License.
This distribution or publishing happens when you give your core modifications to the client. As I understand it, drupal is written in PHP, which is an interpreted, not a complied language. If you give your core modifications to the client, to run on his/her own server, you must license the new, modified drupal core under GPLv2, and (s)he may then modify, copy and distribute it as long as (s)he also obeys the obligations of GPLv2. If you can persuade the client to pay for modifications which you host in perpetuity, then I think you may keep them secret; but I also think your client would be an idiot for signing such a contract.
Thirdly, modifications you make to drupal by way of custom modules are difficult. Even if drupal were a compiled product, the licence status of code that is linked into GPLed code remains an open question; some say that it constitutes a derivative work, and therefore the GPL covers your modifications, while others say that it doesn't. That drupal is an interpreted, not a compiled, product certainly doesn't make things simpler, and may complicate them more. My personal feeling is that you are on safest ground assuming that your module is covered by drupal's licence; therefore you should treat it the same as modifications to the core, and either give it to the client under GPLv2, or host it yourself - but that is just my uninformed feeling on the matter.
