Drupal maintenance and support: Why “not updating” is the biggest risk

Many organizations pay a monthly maintenance fee, yet when asked, “What exactly is being done with that budget?”, they are often unable to provide a clear answer. In many cases, the maintenance contract is described as “insurance for when something goes wrong.”
However, when it comes to Drupal websites, maintenance that follows a “do nothing unless something happens” approach is not really insurance. This is because Drupal is a platform where failing to keep the system updated is itself a risk.
In this article, we outline the maintenance activities that are essential in day-to-day Drupal operations and prioritize them based on their practical importance.

Why doesn’t Drupal’s ‘leave it unattended’ work?
Drupal has a dedicated security team, and when vulnerabilities are found, they are published as **Security Advisory (SA)**.
This is where things become critical. Security Advisories do not simply announce that vulnerability exists. They also disclose the details of the vulnerability. Once a patch is released, information about “where vulnerability exists and how it can be exploited” becomes publicly available. As a result, websites that are not updated effectively become easy targets. Attackers can use publicly available information to identify and target websites that have not applied the necessary updates.
The numbers speak for themselves. Drupal 7 officially reached end of life (EOL) on January 5, 2025, yet approximately 291,000 websites, representing nearly 40% of all Drupal sites, were still running Drupal 7 before support ended. Websites that continue to operate without updates simply because “they are still working” now face some of the highest security risks.
> Source: webtechsurvey、Drupal 7 EOL PSA-2025-01-06

Top 4 Priorities
Four maintenance activities that directly affect system stability
① Monitor and apply Security Advisories (SA) for both Drupal core and all modules: The scope includes not only Drupal core but also every active Contrib module. In practice, vulnerabilities are often discovered in modules rather than in the core platform. Many organizations follow service-level targets such as applying Critical vulnerabilities within 24 hours and High vulnerabilities within one week, with all updates first validated in a staging environment.
② Backups and “restore testing”
Many organizations perform backups, but far fewer have verified that those backups can actually be restored. A complete backup strategy should include the database, files, and configuration, stored separately from the production environment, with restoration tests performed at least annually.
③ Keep up with Drupal core minor releases
Drupal 10 and Drupal 11 receive regular minor releases, and each version has its own support lifecycle. Falling behind on updates can eventually leave the platform outside the scope of security support.
④ Manage PHP version compatibility:
Each Drupal version supports specific PHP versions, and PHP itself also reaches end of life (EOL) over time. Any planned server upgrades or infrastructure changes should be coordinated closely with the maintenance team to avoid compatibility issues.

Key risks to consider
There are several maintenance risks that are often overlooked but can have serious consequences.
⁃ “Having backups” and “being able to restore backups” are not the same thing. One of the most critical failure scenarios occurs when a system outage happens and the backup files turn out to be corrupted or unusable.
⁃ Unused modules should be uninstalled, not simply disabled. Leaving unnecessary modules installed expands the system’s attack surface and increases security risks.
⁃ User permissions also tend to accumulate overtime. Organizations should regularly review the permissions assigned to anonymous users and authenticated users to ensure that unnecessary access rights have not been granted. This is one of the most common causes of data exposure and privacy incidents.
⁃ Cron failures progress silently. They can result in outdated search indexes, uncleared caches, and unsent emails, even though nothing appears to be wrong on the website itself. Without log monitoring, these issues are unlikely to be detected during routine maintenance.

Market trends in Japan
Maintenance and support are becoming increasingly important from both security and compliance perspectives.
⁃ Since Drupal 7 reached end of life (EOL) on January 5, 2025, nearly 40% of Drupal sites have continued to operate without completing their migration, leaving them exposed to publicly disclosed Security Advisories (SA) and known vulnerabilities.
⁃ Drupal is widely adopted in security-sensitive sectors such as government, higher education, and financial services. In these environments, the quality of maintenance and support directly impacts the quality of compliance and risk management.
⁃ Because Drupal receives updates on a regular basis, the ability to efficiently perform regression testing after each update has become a key factor in controlling long-term maintenance costs.

TTV’s actual Drupal maintenance system
At TTV, we have delivered and maintained more than 10 Drupal websites across a wide range of industries, including eCommerce, corporate websites, healthcare, and hospitality management systems.
In addition, our Drupal specialists have contributed 20 Contrib modules to the Drupal community based on real-world project requirements. Two representative examples are shown below.
· Context Breadcrumb – A module that enables Drupal breadcrumbs to be dynamically generated based on the current context.
· Node Preview Context – A module that resolves issues where node context conditions are not evaluated correctly in preview mode
> Published module list: ：[drupal.org/u/zipme_hkt](https://www.drupal.org/u/zipme_hkt)
Being a contributor to Drupal modules provides practical advantages in maintenance and support. When a Security Advisory (SA) is released, it allows us to assess the scope and potential impact much more quickly.

Supported SLA

All updates are first validated in a staging environment before being deployed to production.
—
Summary
Theme: Maintenance Does Not Mean Doing Nothing

⁃ Failing to update a website is a risk in itself, as security vulnerabilities are publicly disclosed through Security Advisories (SAs).
⁃ The four highest maintenance priorities are:
⁃ Security Advisory (SA) monitoring for Drupal core and all modules
⁃ Disaster recovery and restoration testing
⁃ Keeping up with minor version updates
⁃ PHP compatibility management
⁃ “Having backups” and “being able to restore from backups” are two different things.
⁃ Even after the end-of-life (EOL) of Drupal 7, approximately 40% of sites remain unaddressed. Leaving a site unattended allows risks to accumulate quietly over time.
We have built and maintained more than 10 Drupal websites, and we respond to Critical issues within 24 hours.
We also offer maintenance health checks for your existing website. Support is available even for websites built by other vendors.

If you are interested in Drupal maintenance and operations, please feel free to contact us.

Source
Drupal Security Advisories: https://www.drupal.org/security
Drupal 7 Support End Announcement: https://www.drupal.org/about/announcements/blog/drupal-7-has-reached-end-of-life-psa-2025-01-06
Drupal usage statistics: https://webtechsurvey.com/technology/drupal
Drupal.org User Profile: https://www.drupal.org/u/zipme_hkt