# Drupal security: the core, contrib modules and the end-of-life calendar.

> Drupal 9, 10 and 11 security (and end-of-life Drupal 7): core, contrib modules with advisories, files and backups, via a read-only module. Report from €129.

URL: https://webintacta.com/en/drupal-security
Language: English (Spanish version: see the hreflang alternate of the HTML page)
Last updated: 2026-10-24

**In short:** On Drupal, the risk lies in unsupported versions (Drupal 7 since January 2025, Drupal 9 since November 2023; Drupal 10 ends in December 2026) and in outdated contrib modules. At WebIntacta (Jose Soriano) I review your Drupal 9, 10 or 11 site from the inside with a read-only module: core integrity, contrib modules matched against security advisories, hidden PHP and forgotten backups. The report costs €129, excluding VAT.


Drupal has a serious security team and clear advisories, but they only protect those who update. What I see on Drupal sites of companies and organizations is almost always the same: a branch that no longer gets patches, or contrib modules nobody has touched in years.

## What I check on a Drupal site

- Core version and the end-of-support date of its branch
- Core integrity (`core/`, `index.php`, `update.php`) against the originals of your version
- Contrib modules and themes with their versions, matched against Drupal security advisories
- PHP hidden in `sites/*/files/` and `.htaccess` files that let it run
- Backups and dumps forgotten in the root, checking whether they can be downloaded from outside
- PHP error logs and exposed configuration

## How I do it

1. **Free external scan.** Drupal version, core advisories, exposed files, HTTPS, headers, email and blacklists.
2. **Read-only module.** Installed from Extend → "Install new module" or by uploading the folder to `modules/custom/`. It only answers signed requests and you can disable it whenever you like.
3. **Report and plan.** A PDF with the grade, the urgent items first and what to do with each module: update it, apply the patch or replace it.

## Drupal security: what to keep an eye on

## The release calendar

| Version | Security patches |
| --- | --- |
| Drupal 7 | Ended on January 5, 2025 |
| Drupal 8 and 9 | Ended (Drupal 9 on November 1, 2023) |
| Drupal 10 | Until December 2026 (10.6 branch) |
| Drupal 11 | Supported; each minor version has its own date |

Dates published by Drupal.org, checked on October 15, 2026.

If your site is on Drupal 10, start planning the move to Drupal 11 now, before Drupal 10 reaches end of support: migrating between modern major versions is much simpler than going from 7 to 8, but modules and theme need reviewing first. If it is on Drupal 7 or 9, the report says so on the cover page even if the site is clean.

## Contrib modules and the advisory policy

The Drupal security team publishes advisories for core and for the contrib modules covered by its policy (those with stable releases and the coverage shield on their drupal.org page). A module in alpha or beta, or one that has not opted into coverage, can have flaws without any advisory. That is why I also check whether each installed module is covered and still maintained.

## Checklist

1. **Reports → Status report** with no errors, and **Reports → Available updates** with no pending security updates.
2. **`settings.php` read-only** and `trusted_host_patterns` configured.
3. **Users with the administrator role** reviewed: remove anyone who no longer works with you.
4. **No debugging modules** (Devel and the like) enabled in production, and no errors shown to visitors.
5. **On Drupal 7**, the "PHP filter" module disabled: it lets PHP run from content.
6. **Composer patches documented**: if you apply patches through `composer.json`, write it down; in the report those files show up as modified and you need to be able to explain them.

## If your Drupal site is already hacked

In 2018, Drupalgeddon2 (CVE-2018-7600) allowed code execution on Drupal 7 and 8 without logging in, and years later it still turns up on sites that were never updated. If you see redirects, Google warnings or files you do not recognize, make a backup before touching anything and follow [how to recover a hacked website](https://webintacta.com/en/guides/recover-hacked-website). Cleaning a hacked Drupal costs from €390, with a fixed quote after the scan.

## Drupal maintenance

I do not have a fixed-price maintenance plan for Drupal: it depends on how many modules it has, how it is deployed (Composer, Git) and who maintains the code. I quote it in writing after the report.

## Price

The report is fully deducted if you order the cleanup within 30 days. The cleanup price is agreed in writing before I start.

### External scan — Free
Security grade and the problems visible from the internet, in a few minutes and with no sign-up.
- Platform and version (WordPress, PrestaShop, WooCommerce, Shopify…)
- Visible plugins and modules with published flaws
- Files that should not be public (backups, .git, configuration files)
- HTTPS, certificate and security headers
- Domain email (SPF, DKIM, DMARC) and blocklists
- AI agent readiness (scored separately)

### Security report · business website — €129 (excluding VAT)
An inside analysis with the read-only connector and a PDF with an action plan.

$129 outside the EU.
- Core integrity: every file compared with the original of your version
- Malware, backdoors and PHP where it does not belong
- Inventory of plugins or modules with versions and known flaws
- Administrator accounts, configuration and permissions
- Full PDF with fixes, plus a diagnosis-only version
- Q&A by email or chat to go through it together

> Fully credited if you hire a cleanup or maintenance within 30 days.

### Cleanup of other CMSs or custom PHP — from €390 (excluding VAT)
Joomla, Drupal, Magento or your own code: a fixed quote after the analysis.

From $390 outside the EU.
- A first analysis to define the scope
- A fixed quote before any work starts

For Drupal sites outside the EU, the report is $129 and the cleanup from $390.

## Frequently asked questions

### Which Drupal versions does the module work with?

Drupal 9, 10 and 11. There is no module for Drupal 7: I use a temporary agent uploaded by FTP that expires after 72 hours and deletes itself when the scan is delivered.

### My site is on Drupal 7 (end of life). What should I do?

Drupal 7 has had no official patches since January 5, 2025. While you plan the migration, the report tells you what is exposed and what to protect now. Migrating is a separate project, not an update.

### What happens when Drupal 10 reaches end of support?

Drupal 10 gets security patches until December 2026 (10.6 branch). After that, the core is no longer fixed, so plan the move to Drupal 11: check that your contrib modules and theme have compatible releases first.

### Do you review contrib modules?

Yes. The read-only module lists the installed contrib modules and themes with their versions, and I match them against the security advisories published by Drupal.

### How much does it cost to clean a hacked Drupal site?

It costs from €390, excluding VAT, with the price agreed in writing after the scan.

Hire or ask (email and chat): https://webintacta.com/soporte?lang=en