CS

Drupal Maintenance, Audit and Security

A Drupal site is not finished on launch day. Security releases come out, modules age, PHP versions reach end of life and take support with them. I take over Drupal maintenance — whether I built the site or someone else did — and keep it up to date, secure, and safe to change.

I have worked with Drupal for 15 years, so code written by someone before me is familiar ground.

Drupal maintenance and updates

Regular Drupal maintenance mostly means that updates stop being an event everyone dreads:

  • Security updates for core and contrib modules shortly after release
  • Ongoing updates of modules, libraries, and PHP, so technical debt does not pile up
  • Major version upgrades (Drupal 9 → 10 → 11), including changes to custom modules and themes
  • Composer workflow – dependencies in version control, no files uploaded to the server by hand
  • Post-update checks – automated tests and verification of the key parts of the site before release

Every change goes to a staging environment first and only then to production.

Drupal site audit

Taking a site over from another vendor, planning a larger build-out, or simply unsure what state the site is in? A Drupal site audit gives you the answer before you decide what comes next:

  • Core and modules – what is outdated, what is unsupported, and what is waiting for a security fix
  • Custom code – review of custom modules and themes: quality, maintainability, and readiness for the next Drupal version
  • Configuration – roles and permissions, text formats, cache and error-reporting settings
  • Performance – caching, slow queries, and slow pages
  • Operations – how the site is deployed, backed up, and monitored

You get a list of findings ordered by severity, each with a recommendation and an effort estimate. What you fix and when is your call.

Drupal security

A security audit goes deep where the real problems usually are — in custom code and configuration:

  • Review of custom modules and themes for XSS, SQL injection, CSRF, and access-control gaps
  • A check of permissions, roles, and what an anonymous visitor can see
  • Vulnerability scanning of dependencies
  • Secrets, keys, and access managed outside the repository
  • An incident procedure and recovery from a backup that has actually been tested

I fix the findings and add checks to CI so the same mistake does not come back.

Drupal hosting on a VPS or in the cloud

I run Drupal on infrastructure you control — your own VPS or AWS. I build the environment in Docker, so it is identical in development and production and can be rebuilt at any time. Operations include uptime monitoring, backups with regular restore verification, and incident response. I move an existing site with no noticeable downtime.

Infrastructure details are in DevOps & Cloud Services .

Deployments through CI/CD

Uploading changes to a server by hand is the most common cause of outages. I set up a CI/CD pipeline (GitLab CI, GitHub Actions) that runs code checks and tests on every change and deploys the site the same way every time. An update can go out quickly and be rolled back if something goes wrong.

How we work together

  1. Initial audit – I go through the site, the code, and the operations and write down what is needed.
  2. Getting it in shape – updates, fixes for the findings, backups, and monitoring.
  3. Regular maintenance – updates, monitoring, and small improvements as needed.

We size the scope to the site. I track my time and invoice the hours worked, so you pay exactly for what needed doing.

Frequently Asked Questions

Will you take over a site someone else built?
Yes. I start with an audit so I know what state the site is in and you get a realistic estimate of the work ahead.

How fast do you apply security updates?
I follow Drupal security releases and apply them with priority. Critical fixes go out within hours to days, depending on the agreed arrangement.

We are on an older Drupal version. Can anything be done?
Yes. I propose an upgrade path to a supported version, including changes to custom modules and themes, split into steps that can be released as they are finished.

Do we have to move our hosting to you?
No. The site can stay where it is, as long as that environment allows it to be run safely. If it does not, I propose a move to your own VPS or the cloud.

I look after Drupal so it stays up to date, secure, and ready for what comes next. Contact me on LinkedIn or use the form below.

Ask for Service →