What is Drupal maintenance & support?
Drupal maintenance is the proactive work that prevents problems: security patching, updates and monitoring. Drupal support is the reactive work that fixes them fast when they happen: incident response under a defined SLA. Metadrop delivers both under one SLA and one governance model, so there is no gap between who patches the platform and who responds when something breaks.
A live Drupal site needs this continuous care for four reasons. Each Drupal minor release gets only about 12 months of security coverage, so an unpatched site drifts into known-vulnerability territory. Compliance posture across GDPR, WCAG 2.1 AA and NIS2 degrades silently between releases. Maintenance slips down the priority list when there is no in-house time, until an incident forces it back up. And skipped minor releases compound into a costly, risky upgrade later. Metadrop keeps the platform continuously current so your internal team can focus on the business, not the patch queue.
What our Drupal maintenance covers
Metadrop's maintenance rests on three pillars, delivered as one engagement.
Preventive Maintenance
Preventive maintenance keeps problems from reaching production. Metadrop applies security patches to Drupal core, contributed modules, themes and custom code on the official release cycles, and runs regular updates, compatibility checks and vulnerability scanning before issues surface. Automated and manual testing covers security, performance and accessibility, and updates land in scheduled maintenance windows to minimize business disruption. Backups, database optimization and disaster-recovery planning round out the pillar.
Corrective Maintenance
When something does break, incident response runs under a defined SLA graded by severity, with the response and resolution numbers set out in the SLA section below. Real-time monitoring and alerting with tools such as Icinga, Jenkins, Nessus/OpenVAS and Wazuh help catch issues early, often before they affect the service. Every action, root cause and next step goes into a transparent incident log.
Evolutive Maintenance
Evolutive maintenance takes the platform beyond bug-fixing, into new features, UX/UI improvements, performance tuning and scalability. Third-party integrations across CRM, ERP and marketing automation are added as needs change, through module development & integrations. When a minor release nears end-of-life, Metadrop plans the jump rather than rebuilding from scratch, handled through upgrade to Drupal 11 or, for legacy sites, Drupal 7 support & migration.
Metadrop has maintained a multinational building-materials manufacturer's multisite corporate platform continuously since 2022, delivering successive Drupal 10 and Drupal 11 upgrades with no significant production disruption alongside ongoing feature and search development. It has also sustained an international sports federation's high-traffic Drupal platform and its embedded frontend application without interruption since 2016.
Not sure which maintenance you need? A 30-minute review gives you a clear picture of where your Drupal platform stands on security, compliance and version support.
How our Drupal maintenance works
Onboarding follows a predictable, five-step path.
Platform review and onboarding
a fixed-fee analysis phase audits security, performance, accessibility and version status, with no unexpected change orders.Continuous monitoring and alerting
automated checks watch uptime, security and performance around the clock.Preventive patching
core, module and security updates applied on release cycles within scheduled windows.Corrective response
incidents triaged and resolved within the contracted SLA by severity.Monthly written report and evolutive planning
what was done, what is pending, and what to improve next.
SLA response & resolution times
Response and resolution times are defined by severity and written into the contract, so a critical incident runs against a contractual deadline rather than a best-effort promise. Standard cover is 8x5 business hours, with extended and out-of-hours SLA tiers available for sites that need evening, weekend or holiday response.
If an agreed SLA is missed, penalties and discounts apply automatically, so the client's peace of mind is contractual rather than aspirational. Every account gets a dedicated team and a single point of contact: a named project manager and support staff who know the platform and work in the client's time zone.
The work is delivered by senior, in-house Drupal specialists with 15+ years' experience, 100+ contributed modules and hundreds of open-source credits on drupal.org.
Monthly reporting & site audits
Every month the client receives a clear written report covering packages updated, pending updates with a risk assessment, preventive and corrective actions taken, and evolutive work delivered or proposed. Automatic health scans combine industry tools (Google PageSpeed, Lighthouse, WAVE, Pa11y) with Metadrop's own scripts.
The report tracks SEO status (broken links, 404s, access-denied errors), accessibility status against WCAG checks, performance status, GDPR status, and web-sustainability or Green IT metrics. Beyond the numbers, it sets out proactive recommendations and prioritized next steps, so budget goes where it matters.
Metadrop's published engineering work on maintenance tooling and Drupal status-report requirements, including the open-source Drupal Updater CLI and status-report guidance, reflects a systematic approach to reporting.
Drupal maintenance plans & pricing
Maintenance is a managed, fixed-monthly retainer, offered in three plans, Basic, Advanced and Premium, with clear fixed pricing and scalable options. Every plan includes monthly written reporting, regular updates, proactive monitoring and expert support. Plans scale from a single site to multi-site networks under one governance model: the same SLA covers 1 site or 20+.
One maintenance governance model runs across a 10+ site specialty-chemicals network in 23 languages and, separately, a 19-site workplace-products network spanning 42 countries in 18 languages, a single SLA serving many brands and countries.
| Coverage | Basic (security only) | Advanced | Premium |
|---|---|---|---|
| Critical security response | Max 3 working days | Max 2 working days | Max 1 working day |
| Regular (low-severity) updates | Once per month | Twice per month | Weekly |
| Contrib patch & minor updates | Not included | Once per month | Weekly |
| Core patch & minor updates | Not included | Once per month | Weekly |
| Code compatibility & bug-fixing (Metadrop-developed code) | Not included | Up to 5 to 15h per month by site count | Up to 8 to 20h per month by site count |
| Extra support (testing, releases, meetings, reporting) | Not included | Included within tier hours | Included within tier hours |
Multisite hour bands (2 to 10, 11 to 20, and 21 to 30 sites) scale within the Advanced and Premium tiers. Monthly hours are not cumulative, and major-version upgrades are scoped separately (see the upgrade page).
For plan fit, choose Basic for security-only cover, Advanced for regular updates plus a bug-fix budget, and Premium for a weekly cadence with evolutive headroom.
Why choose Metadrop as your Drupal maintenance partner
Metadrop brings 15+ years of Drupal-only expertise, with upgrades shipped on every Drupal major since Drupal 6. It is a Drupal Silver Certified Partner with 100+ contributed modules and 500+ open-source contributions.
Its model is independent technical governance: a strategic partner aligned with the client's goals, rather than a vendor selling licences or hosting. Delivery is EU-based, GDPR-aligned by default and prepared for NIS2 requirements, and ENS certified for Spanish public-sector and regulated-supplier work, with a compliance track record across ENS, GDPR, WCAG 2.1 AA, NIS2 and ISO 27001/27002 alignment.
Metadrop also maintains regulated government and humanitarian platforms with strict privacy, accessibility and continuity requirements. That includes ongoing preventive and corrective maintenance for a global humanitarian organization's donation and member platform, covering bot-attack hardening, Salesforce synchronization and multilingual rollout under continuous care. It also includes foundational maintenance for an energy-sector multisite network, where database and search-platform migrations driven by hosting end-of-life kept the sites secure and compatible with their infrastructure.
Metadrop supports 30+ languages across 50+ countries, running one governance model from a single site to multi-site networks (see Drupal Multisite). The relationship can extend beyond maintenance: independent architecture review and long-term strategy through Drupal consulting, AI woven into the maintenance ecosystem through AI-powered Drupal, and infrastructure and DevOps through Drupal hosting & DevOps.
They've Trusted Metadrop
From industrial manufacturing to humanitarian and public-sector organizations, teams across 50+ countries have relied on Metadrop to keep their Drupal platforms secure, compliant and evolving.
Frequently Asked Questions
What are Drupal maintenance & support services?
Drupal maintenance and support services are ongoing, SLA-backed care that keeps a live Drupal site secure, compliant and current. They cover preventive patching, corrective incident response and evolutive feature development, delivered as a managed monthly retainer with written reporting.
What is the difference between Drupal maintenance and support?
Maintenance is proactive: scheduled patching, updates and monitoring that prevent problems. Support is reactive: incident response under a defined SLA that fixes issues fast. Metadrop provides both under one agreement.
How often should Drupal security updates be applied?
Security updates should be applied as soon as the Drupal Security Team publishes them. Critical patches go in on release, not in a monthly batch. Because each Drupal minor carries about 12 months of security coverage, version planning is part of the service.
How much does Drupal maintenance cost?
Drupal maintenance is a fixed monthly retainer, scaled to the plan (Basic, Advanced or Premium), the number of sites and the SLA tier. Covered work sits inside the fixed fee with no per-incident surprises, and major-version upgrades are scoped separately. The free platform review returns a plan and a fixed price.
How fast do you respond to critical issues?
Response and resolution times are defined by severity and written into the SLA, for example a critical response within one working day on Premium. Extended and out-of-hours tiers add evening, weekend and holiday cover, and penalties and discounts apply automatically if an SLA is missed.
Can you maintain a Drupal multisite network under one plan?
Yes. One governance model and one SLA cover a single site or a 20+ site network, with hour bands scaling by site count.
What happens to my site's compliance (GDPR, WCAG, NIS2, ENS)?
Every monthly report includes GDPR, accessibility (WCAG 2.1 AA) and security-posture checks. Metadrop is ENS certified and prepared for NIS2 requirements, with EU-based delivery aligned to public-sector and regulated-supplier requirements.
What if we need to move providers later?
All maintenance activity, customizations and processes are **documented for a clean handover**, so switching providers later stays straightforward. Independent governance means the platform, code and knowledge remain the client's.
Get your free Drupal maintenance review
Book a free, no-obligation platform review: Metadrop audits your Drupal site's security, performance, accessibility and version status and returns a maintenance plan with a fixed monthly price. A senior Drupal specialist replies within one working day, and the analysis phase is fixed-fee with no commitment and no unexpected change orders.