Maintenance & security
Your site kept patched, monitored and backed up. Drupal security advisories are reviewed as they are published, and critical ones are applied first. That includes Drupal 7: official security support ended on 5 January 2025, and I can keep your site safe while you plan the move.
PHP2Shell (October 2026): critical flaws in PHP itself. Check whether your PHP version got a fix.Read the guide →engagement: Monthly plan covers: Drupal 7 to 11, Symfony, custom PHP hosting: Your current host, AWS or Pantheon reporting: Monthly, in plain English
Sounds familiar?
- Nobody is watching the Drupal security advisories
- Updates get skipped because they tend to break things
- Backups exist, but nobody has tried restoring one
- The site is still on Drupal 7 or an old PHP version
- You hear about downtime from your users before anyone else
The work, in detail.
Security advisory monitoring
Drupal core, contrib and Composer advisories checked as they're published, and critical ones applied first.
Drupal 7 security and long-term support
Drupal 7 kept supported with a Drupal Association-certified extended support provider such as HeroDevs or Tag1. I apply their patches and look after the custom code they don't cover, and plan your move to a supported version.
Core and contrib module updates
Tested on staging before release, and deployed with a way to roll back.
Composer dependency audits
Libraries checked for known vulnerabilities and abandoned packages, not just Drupal modules.
Uptime and error monitoring
Alerts when the site goes down or starts throwing errors, so problems are fixed before users report them.
Tested backups and restores
Backups restored to a test environment regularly, so you know they work before you need them.
Performance checks
Page speed, caching and slow queries reviewed, with fixes suggested before they become outages.
Monthly plain-English report
What was updated, what was found and what's coming up, written for people who don't read code.
From first call to finished work.
Every engagement starts with a free 30-minute discovery call and a written proposal. Nothing starts until the scope, price and terms are agreed in writing.
Onboarding check
I review versions, outstanding updates, backups, monitoring and access, and write up the current state.
Catch-up
Any backlog of updates is cleared first, as a fixed-price piece of work.
Monthly routine
Advisories, updates, dependency audits, monitoring and restore tests, on a regular schedule.
Report and review
A monthly report, and a short call when something needs a decision from you.
Frequently asked.
What happens when a critical security release comes out?
The Drupal security team announces highly critical releases in advance, so the update can be planned for the day it's published. Your plan sets out the response time for critical advisories in writing.
What if you're on holiday or unwell?
Holidays are agreed well in advance, urgent support times are written into our agreement, and the runbook means another developer can step in if needed.
Does the plan include new features?
The plan covers upkeep. It can include a set number of hours for small changes each month. Anything bigger is scoped and quoted separately.
Our site is still on Drupal 7. Can you keep it supported?
Yes. Official Drupal 7 support ended on 5 January 2025, so security fixes now come from extended support providers certified by the Drupal Association, such as HeroDevs (NES for Drupal) or Tag1 (D7ES). You subscribe with the provider. I apply and test their patches, maintain the custom modules and hosting they don't cover, and keep the records your auditors ask for. See the Drupal 7 options.
Will you have access to personal data?
If the work means handling personal data, such as user accounts, form submissions or a copy of a live database, we sign a UK GDPR data processing agreement alongside the contract before I get access. Where I can, I work on copies with personal data removed.
Tell me what your site needs.
The first conversation is free and comes with no obligation. Tell me about your site and I'll come back with a written proposal.