Drupal maintenance services exist because a Drupal site is never finished. Drupal core, the contributed modules your site depends on and the PHP version underneath all release updates on their own schedules, and some of those updates fix security holes that attackers start probing soon after they are announced. Maintenance means applying those updates safely, keeping backups you can restore, watching the site, and having developers available when something breaks. It is the ongoing side of our Drupal development services.
What you get from us: every update tested on a staging copy before it reaches production, deployments through Git and Composer rather than file uploads, daily backups, uptime monitoring and a monthly report. On higher plans, you also get development hours each month and critical security releases applied the same day they are published.
What Our Drupal Support and Maintenance Services Include
| Service | What we do | What it means for you |
|---|---|---|
| Core and module security updates | Track Drupal security advisories, update through Composer, run database updates and test on staging. | Known vulnerabilities are closed without breaking the site. |
| Staging-first testing | Apply each update to a staging copy, check key pages, forms and editor workflows, then deploy. | Updates do not surprise your editors or visitors. |
| Backups | Daily database and file backups, stored separately from the server, with periodic restore tests. | A known good copy exists when something goes wrong. |
| Uptime monitoring | External checks on key pages, with alerts to our team. | Outages are spotted and investigated quickly. |
| Log and error review | Review Drupal's recent log messages, PHP errors and failed cron runs. | Small problems are caught before they become outages. |
| PHP and hosting compatibility | Plan PHP version upgrades with your host and confirm modules support them. | No forced, untested PHP upgrade from your hosting company. |
| Minor and major upgrades | Minor version upgrades on the top plan; major upgrades scoped as projects. | Your site stays on a supported version of Drupal. |
| Development hours | Bug fixes, content type changes, new views, small features and editor support. | One team handles both upkeep and improvements. |
How Drupal Security Updates Work, and How We Apply Them
The Drupal Security Team coordinates fixes for core and for contributed projects that are covered by the security advisory policy. Releases are usually published on Wednesdays, in a regular security window, with an advisory that rates the risk. For the most serious issues, the team often posts a public service announcement days in advance so site owners can plan to update as soon as the release lands.
Two details matter for your site. First, only contributed modules that have opted into security coverage are covered by advisories; a module without coverage may have problems nobody announces. Second, a security update is still a code change. It can alter behavior your site relies on, so we never apply one straight to production.
Our update routine: update the code with Composer on a branch, run the database updates with Drush, export any configuration changes, deploy to staging, check the pages and workflows that matter most to you, then deploy to production and confirm. Critical releases go through the same steps, faster.
Our Drupal Website Maintenance Process
- Onboarding audit (1 to 2 weeks). We review your Drupal and PHP versions, outdated modules, modules without security coverage, patches applied to contributed code, custom modules, hosting and deployment setup. You receive a written report with a prioritized list.
- Environment setup (within the first month). If the site lacks a staging environment, version control or Composer-based dependency management, we set these up first. Updates without them are risky.
- Backups and monitoring (first week). Daily backups and uptime checks go live, and we test a restore so we know it works.
- Monthly cycle. Security and bug-fix updates are applied, logs reviewed, and development requests worked through within your plan hours.
- Reporting. A monthly report lists updates applied, issues found, hours used and recommendations, including upcoming end-of-life dates that affect you.
Drupal Maintenance Deliverables and What Good Looks Like
- An onboarding audit report with a prioritized issue list.
- A Git repository with Composer-managed dependencies and configuration exported to code.
- A staging environment that mirrors production.
- Daily backups, with restore tests recorded.
- A monthly report: updates applied, advisories reviewed, errors found, hours used and next steps.
- A record of every patch applied to contributed modules, with the reason and a link to the drupal.org issue.
Good Drupal maintenance is measurable: no open security advisories older than your plan allows, configuration in code that matches production, backups that have been restored successfully, and a short list of known issues instead of a growing one.
Drupal 7 End of Life and Major Version Upgrades
Drupal 7 reached end of life on January 5, 2025. Since then the Drupal Security Team no longer reviews or releases security fixes for it, and most contributed modules for Drupal 7 are no longer maintained. Drupal 8 and Drupal 9 reached end of life earlier, in 2021 and 2023. If your site still runs on any of these, you have three realistic options:
| Option | When it fits | Trade-off |
|---|---|---|
| Migrate to a current Drupal version | The site is important, content-rich and Drupal still fits how you work | A Drupal 7 to current move is a rebuild of theme and custom code, with content moved through the Migrate API |
| Paid extended support from a vendor | You need time to plan and budget a migration | Buys time; it does not modernize the site |
| Move to another platform | The site is simpler now and Drupal is more than you need | Content migration and redirects still need careful work |
For sites already on Drupal 10 or 11, upgrades are much smaller. Minor versions arrive regularly and are included on our top plan. Major upgrades, such as Drupal 10 to 11, are mostly about removing deprecated code; we use the Upgrade Status module and Drupal Rector to find and fix it, and scope the work before starting. Each major version has a published end-of-life date on drupal.org, and we plan your upgrade against it.
Drupal Maintenance Mode and the Drupal Maintenance Page
Drupal has a built-in maintenance mode that shows visitors a message while administrators keep working. You can switch it on under Configuration, then Development, then Maintenance mode, or with Drush by setting the system.maintenance_mode state to 1 and rebuilding caches. Users with the "Use the site in maintenance mode" permission can still browse and log in.
The message visitors see comes from the maintenance page template, maintenance-page.html.twig, which your theme can override so the page carries your branding. We use maintenance mode for short windows during database updates that would otherwise show errors, not for routine content or module changes. Most of our updates deploy without taking the site offline at all.
Drupal Maintenance Tools and Hosting We Work With
| Category | Tools |
|---|---|
| Dependencies and deployment | Composer, composer-patches, Git, Drush, configuration export and import |
| Local and staging | DDEV, Lando, host-provided development and staging environments |
| Hosting platforms | Pantheon, Acquia, Upsun (formerly Platform.sh), AWS and managed VPS hosts |
| Upgrades and code quality | Upgrade Status, Drupal Rector, PHPStan with phpstan-drupal, PHP_CodeSniffer with Drupal coding standards |
| Monitoring | Uptime monitoring services, Sentry for error tracking, New Relic where the host provides it |
| Security | Drupal security advisories, the Security Review module, two-factor authentication modules for admin accounts |
Choosing a Drupal Maintenance and Support Company
The right Drupal maintenance and support company will tell you exactly how updates are tested and how fast critical releases are applied. Ask these questions before you sign:
- Update schedule. How soon after a security release do updates reach production, for critical and for routine releases?
- Testing. Is every update tested on staging first? Who checks it, and against what?
- Levels of support. What is included in the monthly fee, and what is billed as extra development?
- Turnaround times. How are urgent problems prioritized against routine requests?
- Dedicated or shared support. Will the same people work on your site each month?
- Access and ownership. Does the code live in your repository, on your hosting account?
| Route | Good for | Watch out for |
|---|---|---|
| In-house developer | Large sites with continuous development | Security releases still need covering during holidays and turnover |
| Freelancer | Small sites with few custom modules | One person, one point of failure when a critical release lands |
| Drupal support agency | Sites that need reliable updates plus regular development | Check that the plan states what is included and who does the work |
Drupal Maintenance Mistakes That Lead to Broken or Hacked Sites
- Editing core or contributed module files directly. The next update overwrites the change. Changes belong in custom modules or in documented patches applied by Composer.
- Skipping database updates. New code with an old database schema causes errors that look unrelated to the update.
- Configuration only in the database. Without exported configuration in Git, nobody can see what changed or roll it back.
- Running unsupported modules. Modules abandoned by their maintainers, or without security coverage, sitting on a public site.
- Old admin accounts. Former staff and agencies still holding administrator access years later.
- Letting the host upgrade PHP first. A forced PHP upgrade on an old site can take it offline in one step.
What Website Maintenance Means for a Drupal Site, Compared With Hosting
Website maintenance is the ongoing work of keeping a site secure, current and working after launch, and on Drupal it is a separate job from hosting. A managed Drupal host keeps the servers, PHP runtime and database engine running, and many provide backups and staging environments. The host does not update your Drupal core, contributed modules or custom code, test those updates against your content and workflows, or fix the bug an editor reports on Monday morning.
That gap is where most Drupal sites fall behind. The site stays online, so nobody notices that it is several security releases behind until something goes wrong. Our plans sit on top of whatever hosting you use, and we coordinate with your host on PHP upgrades, server changes and incidents.
Drupal Commerce and Multisite Maintenance
Some Drupal sites need extra care during updates. Drupal Commerce stores depend on payment gateway modules and checkout flows that must be tested with real transactions in a sandbox after every relevant update, because a broken checkout costs money immediately. We keep a checkout test script for each store and run it on staging before deploying, then place a low-value live test order where your gateway allows it.
Multisite installations, where several sites share one codebase, need every update tested against each site's configuration, since a module change can behave differently on a site with other settings. Multilingual sites need translation imports checked after updates as well. We scope these setups individually so the plan reflects the real testing effort.
Drupal Maintenance Services Pricing
Our Drupal maintenance plans are monthly retainers. The base plan covers security updates, staging tests, backups and monitoring; higher plans add development hours, same-day critical security releases and minor version upgrades. The right plan depends on how many contributed and custom modules your site runs, how often you need changes, and how quickly security releases must be applied for your organization.
Drupal Care
$199 /month
Billed monthly
- Core and contributed module security updates
- Updates tested on staging before going live
- Daily backups and uptime monitoring
- 1 hour of edits a month
- Monthly update report
- Minimum term
- Month to month
Drupal Care Plus
$449 /month
Billed monthly
- Everything in Drupal Care
- Up to 5 hours of development a month
- Critical security releases applied the same day
- Quarterly speed and accessibility check
- Response within 8 business hours
- Minimum term
- Month to month
Drupal Care Pro
$899 /month
Billed monthly
- Everything in Drupal Care Plus
- Up to 15 hours of development a month
- Minor version upgrades included
- Major version upgrade readiness reports
- Monthly call
- Same-day response on business days
- Minimum term
- Month to month
- Add-on
- Extra hours: $45/hour. Drupal major version upgrade: quoted after a free check
All prices in USD. Need something different? Ask for a custom quote.
If you run several Drupal sites or a multisite installation, ask us for a custom maintenance quote.
Who Our Drupal Website Maintenance Suits
A good fit if you:
- Run a Drupal 10 or 11 site for a business, nonprofit, school or public body and need updates handled reliably.
- Inherited a Drupal site from another agency and are not sure what state it is in.
- Need a few hours of Drupal development each month without a full-time hire.
- Must plan a Drupal 7 migration and want maintenance in place while you do.
Probably not a fit if you:
- Need support staff available around the clock with formal response-time contracts; our hours overlap the US and UK business day.
- Want to stay on Drupal 7 indefinitely without a migration plan.
- Have a full in-house Drupal team that already handles updates.
Related Drupal and CMS Services
When your site needs new functionality, our Drupal module development team builds custom modules and integrations, and our Drupal theme development team handles redesigns and theme upgrades. For other content management systems, see our CMS maintenance service.