Properly updating Drupal and maintenance

A Drupal website, like most large content management systems (CMS), has a regular maintenance requirement. In this article, you will learn what tasks are required after launching a Drupal website, how updates can be done manually as well as automated, and what costs to expect with a maintenance contract.

New: Since December 2022 is now also Drupal 10 officially released, ushering in the end of Drupal 9, which will expire in November 2023. We recommend switching in time to keep future maintenance efforts as low as possible.

Need for Drupal updates

The core system, called "Drupal Core", continuously receives changes, which then appear in a new Drupal version.

Which Drupal versions are available?

There are three categories of Drupal versions or updates:

• New core system (major version), e.g. a migration from Drupal 7 to Drupal 8
• Small feature enhancements (minor version), e.g. Drupal 9.3 to 9.4
• Security updates (patch), e.g. Drupal 10.0.8 to 10.0.9

While major and minor releases are announced in time and receive a guaranteed time of support, security updates are released directly when security vulnerabilities occur.

When should you update?

Neglecting security updates can result in serious website security vulnerabilities. So, for an existing Drupal installation, security updates must be applied immediately.

Minor and major versions receive security updates only as long as the versions are officially supported. So when the support of a Drupal version expires, it should be updated as well.

Implementation and procedure of the updates

Manage Drupal website with Composer

For the Drupal installation since version 9 only Composer for managing dependencies recommended. So in the following we assume that your Drupal installation as well as all modules have been set up with Composer.

If your website is not running Composer, we strongly recommend switching. We will be happy to assist you with this.

Sequence of manual updates

Before making any changes to the website, be sure to follow these principles:

1. Never work directly on the live website. Use a local copy or development instance to test updates and changes beforehand.
2. Make Backups of the database and directories, before changes go live.

For example, the typical process of updating the Drupal core system and all modules with Composer looks like this:

1. Turn on maintenance mode in the website
2. Create backup of the database and files
3. Perform Composer Update
4. Perform database updates: Either with drush or manually under /update.php
5. Switch off maintenance mode
6. Empty cache: Either with drush or manually under /config/development/performance

Automatic updates and custom script

There is Automatic Updates Initiative already for many years efforts to simplify and automate the updates of Drupal websites. Unfortunately, the Update module still only in beta and is not suitable for live websites.

Alternatively, however, you can use Composer and Drush the update process can be almost completely automated. A script that performs the above steps itself could therefore look like this:

# 1. Turn on maintenance mode in the website
drush sset system.maintenance_mode TRUE
# 2. Create backup of the database and files
BACKUP_PATH_DB="backups/database.sql"
BACKUP_PATH="backups/files.tar.gz"
drush sql-dump > $BACKUP_PATH_DB
gzip $BACKUP_PATH_DB
tar -czf $BACKUP_PATH $1
# 3. Perform Composer Update
composer update -d $1
# 4. Perform database updates with Drush
drush updb
# 5. Switch off maintenance mode
drush sset system.maintenance_mode FALSE
# 6. Clear cache with Drush
drush cr

Nevertheless, we recommend to start such a script only manually and to "supervise" it accordingly, as well as to test the website again extensively for its functionality after each update.

Advantages and costs of a Drupal maintenance contract

Due to the many Drupal updates, sometimes several times a month, a Drupal website requires continuous maintenance.

What are the advantages of a maintenance contract?

Many website owners decide to let experts take over the regularly occurring tasks of their website. Specifically, this offers the following advantages:

• Automatic and immediate import of security updates
• Updating the Drupal core system and modules
• Quick contact for questions and problems with the website
• Ensuring the security of the website
• Hosting/operation of the website, if applicable

Website maintenance prices

The cost of a maintenance contract depends, of course, on the scope of the website:

• How many modules are installed?
• Are there external dependencies on interfaces, e.g. payment processing, CRM systems, accounting, etc.?
• Does the website contain complex user management or user-created content that must not be lost during updates?
• What is the need for resilience?
• Should the hosting of the website be taken over as well?

Maintenance contracts are usually signed for at least one year. There are the following two possibilities for the price calculation:

• monthly or annual billing of a previously agreed lump sum price
• Billing on a time basis of the hours actually incurred with an agreed hourly wage

As a rule of thumb, annual maintenance costs can be considered to be about 5-10% of the original development costs of a website. For a Drupal web development in the range of 10,000 to 20,000 euros, running costs of 50-150 euros per month are therefore realistic.

Consulting, maintenance and support of your Drupal website

Are you interested in a maintenance contract or do you need a specific contact for your Drupal website? You are welcome to send us an email to info@lakdev.de to schedule a consultation or a free initial meeting. If desired, we will estimate and discuss the cost of your website project or possible maintenance costs.