Where Acquia cost vs self-hosted Drupal actually differs
When an Acquia renewal or hosting review lands on your desk, the subscription is often the largest line item, but the software itself is not what you are paying for. Drupal and its contributed projects are licensed under GPL-2.0-or-later, and there is no paid edition of Drupal itself. The difference you are evaluating is the hosting and operations bundle: managed environments, platform tooling, backups, and the support model around them. Self-hosting usually removes the platform fee, but it moves the work of running that bundle onto your team or a partner. Before comparing totals, ask Acquia to itemize what the subscription includes and which add-ons are separate, so each item can be matched to an owner on the self-hosted side.
The cost shift is most visible in the release calendar. According to the Drupal core release schedule, bugfix releases ship on the first Wednesday of each month and security releases on the third Wednesday, so someone must watch for both, test them against your contributed modules, and deploy them on a predictable cadence. Major versions arrive about every three years. Drupal 10 reaches end of life on December 9, 2026, and Drupal 12 is scheduled for the week of December 7, 2026, so an upgrade plan is needed well before those dates. Each major version also raises the PHP floor: Drupal 10 requires PHP 8.1 or later, Drupal 11 requires PHP 8.3 or later, and Drupal 12 requires PHP 8.5 or later, according to the Drupal.org PHP requirements page. Confirm which of these tasks Acquia handles today under your contract.
Build the self-hosted estimate around people and recurring operations, not just servers. Ask your team or prospective partner to cost a named owner for patch intake, a staging environment that mirrors production, tested restores of database and file backups, CDN and WAF configuration, and an upgrade project for each major version. Confirm which Acquia add-ons you actually use, because each one needs a replacement or an explicit decision to drop it. Request written scope and fees from any partner, so the comparison reflects who is paid for what and what recurs each year. Your decision should rest on that side-by-side view, not on the headline platform fee alone.
Cost components on each side and whether they recur
This table sets each cost component of running Drupal on Acquia against the same component when self-hosted, and marks whether it is one-time or recurring. Drupal itself carries no license fee on either side, so the comparison turns on the platform, operations and people. Use it to build a quote request, not as a price comparison, because no figures are supplied for either side.
| Cost component | Acquia side | Self-hosted side | One-time or recurring |
|---|---|---|---|
| Subscription and tier | Platform subscription by tier, set in your Acquia contract | No platform fee. Drupal core and contributed modules are GPL with no paid edition | Recurring on Acquia. Not applicable self-hosted |
| Add-ons and Acquia tooling | Acquia-specific features and modules billed or bundled per contract | Replacement services or modules you select, plus the work to adopt them | Recurring on Acquia. One-time integration work self-hosted |
| Hosting compute and databases | Included in the platform tier, confirm sizing limits in writing | Cloud or data center compute and managed or self-run MariaDB, MySQL or PostgreSQL | Recurring on both sides |
| CDN and WAF | Confirm whether CDN and web application firewall are bundled or add-on | Separate CDN and WAF contracts or self-run tooling, plus configuration and tuning | Recurring on both sides |
| Backups and restore testing | Platform backups, confirm retention and restore test rights in contract | Your backup storage, schedule, and periodic restore drills you must run and document | Recurring on both sides. Restore testing effort recurs |
| Non-production environments | Dev and staging environments, confirm how many are included | Extra compute and pipelines you provision for each environment | Recurring on both sides |
| Monitoring and logging | Platform-level monitoring, confirm what application metrics you receive | Observability stack you deploy and maintain | Recurring on both sides, one-time setup self-hosted |
| Security releases | Platform patching plus your own Drupal updates on Drupal Security Team release windows | You apply Drupal core and module security releases on the same windows, plus testing | Recurring on both sides |
| Major upgrades such as Drupal 10 to 11 | Project work to upgrade code, scheduled by your team or partner | Same code work, plus any server stack changes such as PHP version | One-time per upgrade on both sides |
| Migration project | Not applicable while on Acquia | Environment build, Acquia-specific module replacement, DNS cutover and rollback plan | One-time |
| Internal or partner staff | Your team runs the site, Acquia supports the platform | Your team or a support partner runs platform operations, on-call and patching | Recurring on both sides, usually the largest line item self-hosted |
Who pays for what on Acquia and on your own infrastructure
With Acquia Cloud Platform, Acquia operates the hosting layer that your Drupal site runs on, and you pay a subscription for that service and any add-ons. Your team still owns the Drupal codebase, the contributed modules, the content model, the themes and the release process that moves changes between environments. The division of labor depends on your contract, so the list below describes typical areas rather than a guaranteed scope.
- Hosting and environments: Acquia provisions and runs the application environments your subscription includes, and you deploy your code to them.
- Backups: Platform-level backups are part of the managed service. Confirm retention periods, restore procedures and whether file backups are included.
- Patching: Acquia patches the platform components it manages. Drupal core and contributed module updates on your codebase remain your responsibility to test and deploy.
- Incident response: Acquia support handles platform incidents within its support tiers. Application bugs, custom code faults and content problems still route to your team.
- Add-ons: Features such as CDN, search, or additional environments may be priced separately, so these costs recur alongside the base subscription.
Confirm the current Acquia scope in writing, including what is included in each subscription tier, the support response commitments, and which add-ons are required for your traffic and compliance needs.
When you self-host Drupal with an in-house team, the software cost is zero because Drupal is GPL-2.0-or-later and has no paid edition. Your cost becomes infrastructure, tooling and staff time. Every layer that Acquia currently operates moves to your team, and the team must be able to respond to incidents at the hours your business requires.
- Infrastructure: You provision and pay for servers or Kubernetes, the web server, the database (MariaDB, MySQL, PostgreSQL or SQLite), and environments for development, staging and production.
- Patching: Your team tracks the Drupal core release schedule, applies bugfix releases on the first Wednesday of each month and security releases on the third Wednesday, and tests them before deployment.
- Backups and recovery: You design, run and test database and file backups and restore procedures. Restores must be rehearsed, not just scheduled.
- Incident response and performance: Your team owns on-call coverage, caching, CDN configuration and load testing, all of which increase in complexity with traffic.
- Staffing: Recurring cost is mostly people with Drupal, PHP, infrastructure and security skills, and that cost rises if you run more than one site.
Ask your internal team to estimate its own hours for each duty above, and set those against the subscription and add-on lines in your current Acquia quote.
A support partner can take over parts of the self-hosted model while your organization keeps the infrastructure in its own accounts or data centers. Responsibilities are split by written agreement, so the boundary between your team and the partner is the most important part of the arrangement. DeployOpen describes its work as planning, implementing, hardening, backing up, upgrading, documenting and supporting self-hosted platforms inside client infrastructure, and retainers cover ongoing support and upgrades.
- Build and hardening: A partner can plan the environments, configure the stack and document the operating procedures, usually as a fixed-scope project.
- Upgrades: A retainer can cover core and module upgrades, including future moves such as Drupal 10 to Drupal 11, but scope and timing must be agreed in writing.
- Backups and restores: Partners can set up and test backup jobs. Your organization still needs to decide retention and who approves restores.
- Incident response: Support hours, escalation paths and severity definitions must be written into the contract, since they replace the vendor's support tiers.
- Remaining in-house work: Content operations, product decisions, budget ownership and compliance evidence often stay with your staff.
Ask any partner for a written responsibility matrix, the service levels it commits to, and a quote built from the agreed scope rather than from a generic hourly rate.
What moves the Acquia vs self-hosted Drupal comparison
Acquia and a self-hosted Drupal stack price the same underlying work in different places. The drivers below decide how much of that work your team carries, so use them to scope a quote and a comparison model before you compare line items.
Traffic and peak load
Peak traffic sets how much compute, database capacity and cache you must hold ready, and how fast you can scale during a campaign or news event. On Acquia, load headroom is bought through the subscription tier. Self-hosted, you pay for capacity you provision, plus the time to load test and tune it. Ask your team for peak-to-average traffic ratios from the last twelve months before you model either option.
Number of sites and environments
Each additional Drupal site, development, staging and review environment adds build pipelines, databases, file storage and patching work. Multisite setups share code but not content, so ask whether sites share one codebase and one deployment pipeline. Self-hosted costs grow with each environment you must rebuild, monitor and refresh from production data, while Acquia's environment model is tied to your contract.
Content and asset volume
Database size, uploaded media and backup retention drive storage cost and restore time. Large media libraries also raise CDN egress and image processing load. On a self-hosted stack, object storage and backup copies recur monthly and grow with every retained snapshot. Confirm total asset size, growth per year and how long you must keep backups before pricing storage.
Availability and recovery targets
A stricter uptime target and a shorter recovery time push you toward redundant web nodes, a highly available database, tested restores and monitored failover. Acquia bundles much of this into the platform, while self-hosted redundancy is an infrastructure and staffing cost you carry. Write down the outage duration and data loss your business accepts, then ask each option to show how it meets those numbers.
Required add-ons such as CDN and WAF
A CDN, web application firewall, bot protection and managed certificates each carry a separate cost, whether bought from Acquia or from a third party. Self-hosted, you choose the provider and integrate it, so the expense shifts from a bundled fee to direct vendor contracts. List every add-on your current contract includes, then match each one to a replacement and its recurring fee before comparing totals.
Skills already in house
Your existing staff decide whether self-hosting is a modest change or a new discipline. Teams that already run PHP, Linux, containers and database operations face less onboarding, while teams without them will pay a partner or hire for patching, monitoring and on-call coverage. Drupal's security releases follow a fixed monthly schedule, so someone must own that cycle. Ask your engineers to rate each skill before you assign ownership.
How to build the cost model with your own numbers
This sequence turns the Acquia bill and your Drupal estate into a component-level model that compares the managed platform with a self-hosted run over three years. The output is one table that separates one-time migration cost from recurring run cost, and every line traces back to a figure you hold.
Pull the current Acquia contract and invoices
Gather the signed subscription agreement, the current order form and the last twelve monthly or quarterly invoices, and list each line item as written by Acquia. Finance or procurement owns this step, with the platform owner checking that every environment and hosting tier named in the contract appears in the list. It is done when every recurring charge on the invoices maps to a line in the contract, and any unexplained charge is flagged for the account team to explain in writing.
List every add-on and its actual use
Record each add-on, support tier, premium service, extra environment, CDN or security product that appears on the contract, and note which ones your team uses day to day. The platform owner and the Drupal lead should answer for each item whether a site depends on it and what it would take to replace it. This step is done when each add-on has a named owner, a usage note and a yes or no on whether it stays in the model.
Inventory environments, sites and traffic
Count production, staging, development and review environments, the number of Drupal sites in each codebase, and the monthly page views, peak traffic and storage used by the database and uploaded files. Pull these figures from your analytics, Acquia dashboards and file system reports, and record the source for each number. The step closes when a single inventory sheet lists every site, environment and traffic figure, so the infrastructure sizing in the next steps rests on measured data.
Map each Acquia service to a self-hosted component
Build a table with one row per Acquia service, such as hosting, load balancing, caching, search, backups, CDN, environment provisioning and monitoring, and name the self-hosted component that would cover it. Note where the component is an open-source project, where you would buy a managed service, and where a function moves to your own team. The platform architect owns this table, and the step is done when every row has a replacement or an explicit decision to drop the service.
Price infrastructure from your own quotes
Request written quotes from your cloud provider or data center for compute, database, object storage, CDN, backup storage, egress and network, sized from the inventory and the component map. Ask each provider to state reserved or committed pricing separately from on-demand pricing, and to list egress charges. Finance and infrastructure teams own the quotes, and the step is complete when each infrastructure line in the model cites a dated quote rather than an estimate.
Add staff hours for patching and on-call
Estimate the monthly hours your team spends on Drupal core and contributed module updates, security releases, PHP and server patching, monitoring, incident response and on-call rotation. Drupal publishes bugfix and security releases on fixed monthly schedules, so the calendar of those windows gives a predictable base load, while incidents add variable hours. The engineering manager confirms the hours with the people who do the work, and the step is done when the monthly figure is split into routine and incident time.
Schedule the Drupal upgrade path
Identify the Drupal major version each site runs today and plot the move to Drupal 11 or Drupal 12 against the Drupal core release schedule. Check the PHP version each target needs, the contributed modules and themes that must be upgraded or replaced, and whether a site needs a rebuild instead of an in-place upgrade. The development lead owns this plan, and the step closes with a dated upgrade schedule and a one-time cost line for each site or group of sites.
Build a three-year model with one-time and recurring costs
Place the one-time migration costs, such as the export, the rebuild of Acquia-specific settings, testing, cutover and the upgrade work, in a separate block from recurring run costs for infrastructure, licensing if any, support retainers and staff time. Model three years for both options, then run the difference with the current Acquia contract as the baseline, and test how the result changes if traffic or environment count moves up or down. The finance lead and platform owner sign off the model, and it is complete when each figure traces to a source document, a quote or a stated assumption.
What Drupal security releases and upgrades add to the run cost
Security and bugfix work recurs on every host. Drupal core ships bugfix releases on the first Wednesday of each month and security releases on the third Wednesday, and new major versions arrive roughly every three years. Whether Acquia or your own team applies those updates, someone must test each release against your contributed modules, custom code and themes, then deploy it through your pipeline. Ask Acquia exactly which of these steps its subscription covers, which environments it patches, and whether custom code or contributed module conflicts are your responsibility. In a self-hosted model, budget a named owner and a standing test environment for that monthly cycle, and confirm the staffing with your partner in the written scope rather than assuming it is absorbed into the hosting line.
The next major upgrades have fixed dates. According to the Drupal core release schedule, Drupal 10 reaches end of life on December 9, 2026, and Drupal 12 is scheduled for the week of December 7, 2026. Drupal 12 requires PHP 8.5 or later, while Drupal 11 requires PHP 8.3 or later, so the move from Drupal 11 to 12 can also force a PHP and server image upgrade. Check every contributed module against the target version, because a module that lags behind may block the move. Drupal 6 and 7 sites are a separate case: they cannot simply be updated to Drupal 10 or later. They must be migrated into a new site with the core Migrate modules or Drush, and themes must be rebuilt because they cannot be migrated.
Extended support for Drupal 7 is a stopgap with an open price. Drupal 7 security support ended on January 5, 2025. The Drupal Association's Extended Security Support Provider Program lists HeroDevs and Tag1 Consulting as certified vendors for sites that cannot migrate yet. Those contracts are priced by each vendor, so the only reliable figure is the one in a written quote, which should state coverage period, patch turnaround, scope of modules covered and what happens at renewal. Treat that cost as a bridge to a migration budget, not a substitute for one, and ask any vendor how it handles the Drupal 7 modules your site depends on.
Questions buyers ask before comparing Acquia with self-hosting
How much effort does self-hosting Drupal take compared with Acquia?
Self-hosting moves work that Acquia currently does for you onto your own team or a support partner, so the effort depends on how much of the platform you already run. Acquia's subscription covers hosting, environments, and platform tooling, and the exact scope is in your contract. When you run Drupal yourself, you must provide the web tier, database, caching, file storage, CDN, backups, monitoring, deployment pipelines, and patching. Effort rises with the number of environments, the traffic profile, and the number of Acquia-specific features your site uses. Ask Acquia for a written list of what the subscription includes, then map each item to an owner in your organization.
Can an internal team run self-hosted Drupal without an outside partner?
Many internal teams can run Drupal alone, but the question is whether they have depth in each operational area at the same time. Drupal runs on Apache or Nginx with MariaDB, MySQL, PostgreSQL or SQLite, so the stack is familiar to most platform teams. The harder parts are security response, PHP version management, and coverage for Drupal's release cycle. Bugfix releases arrive on the first Wednesday of each month and security releases on the third Wednesday, so someone must watch for them every month. A common model is to keep content, configuration, and daily operations in-house while a partner handles upgrades, hardening, or on-call cover under a fixed-scope or retainer agreement.
How long does a migration off Acquia take, and what drives the timeline?
The timeline depends mainly on site complexity, the number of integrations, and how much Acquia-specific configuration must be replaced. Start with the number of content types, custom modules, theme work, redirects, and third-party services such as search, forms, and single sign-on. A site on a current Drupal version moves more quickly than one that needs a major upgrade first. Drupal 10 reaches end of life on December 9, 2026, and Drupal 12 is scheduled for the week of December 7, 2026, so teams planning a move should check which major version they will run before they set a date. Ask any provider for a written plan with phases, test cycles, and a cutover window, rather than a single overall estimate.
What recurring costs remain after a self-hosted Drupal site goes live?
After launch, the recurring costs are infrastructure, CDN, backups, monitoring, staff time, and support. Drupal itself has no license fee, so the recurring costs are the components you pay for directly: compute, database hosting, storage, bandwidth, and CDN service. Security maintenance is the largest ongoing effort because each monthly release window requires review, testing, and deployment. Major upgrades come roughly every three years for new Drupal versions, and each one requires testing custom code and contributed modules. Budget for these as recurring line items, and ask for a breakdown that separates one-time setup from monthly operations.
Does Drupal itself cost money to use or self-host?
Drupal core has no paid edition and no per-site license fee. Drupal and contributed projects on Drupal.org are licensed under GPL-2.0-or-later, which allows you to run, modify, and host the software yourself. The GPL does not require you to share code that is only used to run a website, so an internal site does not trigger source disclosure. Costs appear in the surrounding services, such as hosting, staff, support contracts, and any commercial modules you choose to buy. Check the license of each contributed module and any third-party theme before you assume it is free to use in your context.
What should I ask a partner to include in a fixed-scope quote?
A useful quote lists scope, deliverables, environments, and the assumptions behind them, in writing before work starts. DeployOpen plans, implements, integrates, hardens, backs up, upgrades, and documents self-hosted platforms in your own infrastructure, and most engagements are fixed-scope with agreed deliverables and timelines. Ask for the environment list, the hosting target, the backup and restore test plan, the upgrade path for your current Drupal version, the security patch process, and the handover documentation. Ask what is excluded, how changes are priced, and what ongoing support looks like as a separate retainer. DeployOpen does not publish a price list, so a quote follows from the written scope.
Are there open-source replacements for Acquia add-ons?
Many Acquia-related functions have open-source equivalents, but each replacement needs confirmation against your site. Single sign-on can often be handled with the contributed SAML Authentication module (samlauth), which lets Drupal act as a SAML service provider and whose latest stable release 8.x-3.14 supports Drupal 10.3 and later and Drupal 11. The OpenID Connect module covers external identity providers, including generic OAuth 2.0, GitHub, Google, LinkedIn, Facebook, and Okta. Search, monitoring, CDN, and backup features need separate assessment because the right tool depends on your traffic, compliance needs, and hosting target. List every Acquia feature you use today and confirm each replacement in a test environment before cutover.
How DeployOpen scopes a fixed-price Drupal self-hosting project
DeployOpen plans, implements, hardens, backs up, upgrades and documents self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For Acquia cost vs self-hosted Drupal, we start by putting each Acquia line item and each replacement component into one written scope before any work begins.
How we scope
- Inventory current Acquia subscription tiers, add-ons, environments and the services each one provides today
- Map each component to an owner: your team, a hosting provider, or a support partner such as DeployOpen
- Agree scope, deliverables and timelines in writing before work starts, since most engagements are fixed-scope
How we build
- Build the Drupal hosting stack on your chosen infrastructure, covering web server, database, cache, CDN and backups
- Set up a pipeline that applies Drupal security releases on the third Wednesday of each month, with a tested rollback path
- Test performance and failover against the agreed scope, and document results in your own environment
How we hand over
- Deliver architecture, runbooks, backup and restore procedures, and an itemized cost model for the running environment
- Run a restore test with your team so the recovery steps are proven before you depend on them
- Provide a handover session that covers patching, upgrade planning and the Drupal 10 to 11 path
How we support
- Ongoing support, upgrades and continuous security testing are available as retainers after handover
- Retainers can cover monthly security patching, major version upgrades and incident response for your environment
- Ask any quote to state which items are one-time setup and which recur each month or year
