Drupal migration & upgrades
Move Drupal 6/7/8/9 to a supported Drupal 10 or 11.
Drupal security updates, done safely
Keep your Drupal site protected with timely core and contributed-module security patches — applied carefully, with compatibility checked first so nothing breaks.
What's included
Patching that won't break your site
Security updates are only safe if they don't take your site down. I review every update against your modules and theme before applying it, on a staging copy where possible.
- Drupal core security releases (SA-CORE advisories)
- Contributed & custom module security patches
- Compatibility check before applying anything
- Works across Drupal 7, 8, 9, 10 and 11
- Fixed price, clear scope — no open-ended hourly billing
- Optional ongoing maintenance so you never fall behind again
In depth
How Drupal security updates actually work
The Drupal Security Team publishes SA-CORE advisories on a regular schedule for supported major versions (Drupal 10 and 11 today). Contributed-module advisories appear when maintainers coordinate a fix. Applying those releases is necessary but not sufficient — your custom code and configuration determine whether an update is safe on your site.
Before any patch goes live, I compare the release notes against your module list, run update hooks on staging, and smoke-test critical paths: login, checkout, forms, search, and admin workflows. Skipping that step is how “just a security update” takes down production.
Sites on end-of-life Drupal 7, 8, or 9 no longer receive these community fixes. Patching the server or PHP without moving core leaves the CMS layer exposed — migration or a clearly bounded interim plan is the durable answer.
Questions
Drupal security updates — FAQ
How often does Drupal release security updates?
The Drupal Security Team publishes core security advisories (SA-CORE) on scheduled Wednesdays, and contributed-module advisories as needed. Supported versions — Drupal 10 and 11 — receive these updates; end-of-life versions like Drupal 7, 8 and 9 do not.
Can I apply Drupal security updates without breaking the site?
Yes — if each update is checked against your modules and theme and tested on a staging copy before going live. Applying updates blindly is what causes broken sites.
Do you patch contributed and custom modules too?
Yes. Security work covers Drupal core, contributed modules, and custom code — not just core releases.
Related Drupal services
Explore more
Drupal PHP upgrade
Move to a supported PHP version without breaking pages.
Drupal support & maintenance
Ongoing security updates and monitoring on a retainer.
Drupal 7 end of life
Your options now that Drupal 7 no longer gets patches.
Not sure what's out of date?
Get a free assessment of your site's Drupal version, PHP, and pending security updates.
Request your free assessment