What a customized Drupal implementation involves
Drupal is a PHP content management framework built on Symfony components, managed with Composer and licensed under the GNU GPL version 2 or later. Content is stored as entities with bundles and fields, Views turns them into listings, feeds or API output, and site structure lives in configuration exported to YAML and deployed like code.
Sites with several content teams usually need a shared content model, editorial review, multiple languages, connections to identity and business systems, and a codebase that survives major-version upgrades. Most of the effort sits in modeling, custom code decisions and migration.
There are two starting points. Drupal core is the framework plus modules the team selects. Drupal CMS is a packaged product on core with recipes, Project Browser and automatic updates; version 2.0, released in January 2026 on Drupal core 11.3, made Drupal Canvas the default visual page editor. Custom modules and themes work the same way on either.
Discovery covers the content inventory, audiences, editorial roles and approvals, languages, integrations, the accessibility target, hosting constraints and ownership after launch. It produces a content model, an integration list and a decision record that places each requirement in configuration, a contributed module or custom code.
Model content before building pages
Templates, search, APIs and migration all depend on the content model.
Content types and fields
Define each type by its fields, cardinality and validation, and reuse a field only where it means the same thing. A few well-defined types are easier to template, search and migrate than one generic page type.
Taxonomy and references
Vocabularies hold topics, audiences or departments, and entity reference fields link content. Decide which relationships drive navigation, listings and search facets.
Media
The core Media module stores images, documents and remote video as reusable entities with fields for alt text and rights. Where assets live in a DAM, a media source plugin can reference them.
Page composition
Layout Builder, the contributed Paragraphs module and Drupal Canvas each store layout differently, which affects training, API output and the next migration. Pick one primary approach per site.
Workflow and languages
Core Content Moderation adds draft, review and published states with permissions per transition. Core multilingual modules translate content, interface and configuration; decide per field what is translated.
Configuration, contributed modules or custom code
Every requirement lands in one of these layers. Lower rows cost more to carry through upgrades.
| Layer | Typical use | Upgrade cost |
|---|---|---|
| Configuration and recipes | Content types, fields, Views, menus, roles and workflows, exported as YAML or applied from recipes. | Low. Review configuration changes in pull requests like code. |
| Contributed modules | Community modules for SSO, search, redirects, metadata, forms and layout. | Moderate. Each has its own maintainers and major-version support. Check security advisory coverage and recent maintenance first. |
| Custom modules | Business rules, integrations, custom entities, plugins and event subscribers. | Highest. Your team carries the code through each major. Upgrade Status and Drupal Rector find and fix deprecated APIs. |
| Custom theme | Twig templates, CSS and JavaScript, often as single-directory components. | Moderate. Base theme and component changes can require template updates. |
Integrations to scope early
Editors sign in through SAML or OpenID Connect using contributed modules. Map identity provider groups to Drupal roles, require multi-factor authentication at the provider, and keep one local administrator account sealed for recovery.
The contributed Webform module sends submissions to a CRM. Route them through the Queue API so a slow CRM never blocks the form, and record failures for retry.
The contributed Search API module indexes entities into a database, Solr or OpenSearch backend with facets and boosting. Decide which content each audience may find.
The core JSON:API module exposes entities and has a read-only mode; keep it on unless a client must write. A decoupled front end is a second application to build, host and secure.
Migrate from Drupal 7 and other platforms
Drupal 7 reached end of life on January 5, 2025, and does not upgrade in place. The new site gets its own content model, and content moves through the Migrate API: source plugins read old data, process plugins transform it, and destination plugins write entities.
The core Migrate Drupal modules that read Drupal 6 and 7 sources are deprecated in Drupal 11 and will not be included in Drupal 12. Plan Drupal 7 migrations onto Drupal 11, in a custom module that can be removed after launch.
WordPress or custom databases use SQL, CSV, JSON or XML sources the same way. Run, review with owners, roll back and rerun until the output is accepted, then do a final delta run. Retire content nobody owns, and map old URLs with the Redirect module.
Accessibility, performance and rollout
Accessibility
Drupal core targets WCAG 2.2 level AA. Custom themes and components need automated scans plus keyboard and screen reader checks, and editors need guidance on headings and alt text.
Caching
Cache tags invalidate only the pages a change affects. Custom code must declare correct cache metadata, or pages go stale or stop caching.
Testing
PHPUnit unit, kernel and functional tests for custom modules, end-to-end tests for editorial journeys and forms, and static analysis in CI.
Training and launch
Train editors on staging with their own migrated content. Launch one section first where the structure allows, and keep a short guide per content type.
Hosting, security and upgrades
Dates are from the drupal.org release schedule as of October 2026.
| Area | Practice | Check |
|---|---|---|
| Hosting | PHP behind nginx or Apache with MySQL, MariaDB or PostgreSQL. drupal.org lists PHP 8.3 to 8.5 for Drupal 11.3 and later, and PHP 8.5 for Drupal 12.0. | Deploys come from Composer and committed configuration only. |
| Caching and CDN | A reverse proxy or CDN for anonymous traffic with cache-tag purging, and Redis or Memcache for cache bins. | Signed-in pages are never cached publicly. |
| Security releases | The Drupal Security Team publishes advisories for core and covered contributed projects. Contributed windows are every Wednesday; core usually uses the third Wednesday. | A named person reviews each advisory against your patch policy. |
| Backups | Database, public and private files and settings together, with configuration also in Git. | A restore into a clean environment passes a smoke test. |
| Version policy | Minors ship in June and December with about a year of security fixes. Drupal 12 is scheduled for the week of December 7, 2026, and Drupal 10 reaches end of life on December 9, 2026. | No site runs an unsupported minor, and Drupal 10 sites have a dated upgrade plan. |
Drupal operating ownership
Name the owners for the platform, the custom code and the content before launch.
Platform team
- Applies core and contributed updates.
- Runs backups, restore tests and monitoring.
Developers
- Maintain custom modules, the theme and tests.
- Remove deprecated APIs before each major.
Content owners
- Own sections and content type guides.
- Review editor roles on a schedule.
Security
- Decides patch timing for each advisory.
- Keeps patching and access review records.
Drupal implementation questions
Should we start from Drupal CMS or Drupal core?
Drupal CMS gives editors Canvas, curated modules and recipes from the start. Core suits teams with a defined content model who want only the modules they choose.
Does the GPL require us to publish our custom code?
The drupal.org licensing FAQ says modules and themes must be licensed under GPL version 2 or later if you distribute them. Code kept for your own site does not have to be published. Check edge cases with counsel.
What drives the effort of a Drupal 7 migration?
Content types and fields, custom modules without a Drupal 11 equivalent, content quality, languages and design changes. A pilot migration of one content type is a better basis for an estimate than a page count.
Scope and handover
DeployOpen runs discovery, designs the content model, builds configuration, custom modules and the theme, integrates SSO, search and business systems, migrates content, and sets up hosting, caching and backups in your infrastructure. It also tests custom code and access controls and prepares patching and access records for SOC 2, ISO 27001 or NIS2 readiness; audit reports come from your auditor.
Handover includes the Composer and configuration repository, the content model and decision record, the module inventory, migration acceptance results, backup test results, the next upgrade plan and editor guides.
