Running Drupal Properly
Drupal is a serious platform that demands serious operations. Security advisories, contributed module patching, PHP and Drupal core upgrades, Composer dependency management. The operational requirements are specific and non-negotiable. Yet most Drupal support contracts measure success by ticket counts rather than platform health. Here is what proper Drupal operations look like.
The Run Layer: Security and Stability
Running Drupal properly starts with the fundamentals. Security advisories from the Drupal Security Team need applying within the published advisory window, not whenever someone gets around to it. Contributed module updates need reviewing and deploying on a defined schedule. PHP version upgrades need planning before the current version reaches end of life, not after. Composer dependency management needs to be clean, with a locked dependency tree that produces identical builds across environments. Database updates, configuration imports, cache rebuilds: these are not optional maintenance tasks. They are the operational baseline. Proactive monitoring means watching application logs, not just uptime pings. It means tracking error rates, slow queries and memory consumption. It means knowing that the Drupal cron is running, that the search index is current and that the cache hit ratio is healthy. This is not glamorous work. But when the Run layer is neglected, everything else falls apart.
The Improve Layer: Analytics-Driven UX
Improvement on a Drupal site means using data to drive decisions, not opinion. Which content types are your users actually engaging with? Where do they drop off in key journeys? Which Views pages have poor engagement despite high traffic? Are your Drupal search results helping people find what they need, or pushing them to Google? Every month we review the analytics and translate findings into prioritised enhancements. That might mean restructuring a taxonomy that is confusing users. It might mean optimising a Views display that loads too slowly. It might mean adding structured data to content types that should be performing better in search. It might mean reworking a webform that has a high abandonment rate. The point is that improvement is systematic and evidence-based. It is driven by what users actually do on your site, not by what stakeholders assume they do. Every enhancement has a measurable objective and a defined success criterion.
The Govern Layer: Platform Health Reporting
Governance is where most Drupal operations fall short. Traditional support contracts report on ticket volumes and response times. These metrics tell you how busy the support team is. They tell you nothing about the health of the platform or the quality of the user experience. Proper governance for Drupal means monthly reporting on metrics that matter. Core and contrib currency: how many versions behind is the site, and what is the plan to close the gap? Security posture: are all advisories addressed within the defined window? Performance baselines: are page load times trending in the right direction? Accessibility compliance: what is the current WCAG conformance level, and where are the gaps? Content freshness: how much content is stale, orphaned or underperforming? These metrics provide an honest picture of platform health. They drive informed conversations about investment priorities. And they ensure that when budget discussions happen, the team can demonstrate the value of operational discipline rather than simply counting tickets.
Why Discipline Matters on Drupal
Drupal rewards disciplined operations and punishes neglect. A well-maintained Drupal site is secure, performant and stable. A neglected one accumulates technical debt at an alarming rate. Modules fall behind. Configuration drifts between environments. Custom code that nobody documented becomes impossible to maintain. The gap between the current version and the latest release widens until upgrading feels impossible. The Run, Improve, Govern model prevents this decay. Run keeps the platform current and secure. Improve ensures the site gets better every month based on real evidence. Govern provides the visibility and accountability that keeps the whole operation honest. This is not a philosophy. It is a delivery model with defined activities, measurable outcomes and regular reporting. For any organisation that depends on Drupal, this is what proper operations look like. Not a ticket queue. Not a retainer you forget about. A managed, improving, governed digital platform.