Drupal Development

Drupal Development Services That Ship — and Stay Maintained

The promise of Drupal is enterprise-grade power: granular permissions, flexible content architecture, and an ecosystem that has run government portals, healthcare platforms and global media properties for two decades. The trap is everything after launch. Drupal's power is also its maintenance burden, and when nobody owns the security advisories, module deprecations and runtime migrations it demands, the platform becomes the thing your engineers dread touching. Facet has been building and running Drupal since 2014, and we operate your environment as a continuous Agent Loop — security, updates and performance as measured, closed cycles. Watching something that almost never changes is not a line item we invented to justify a retainer. It is how our own delivery stays solvent: a boutique firm cannot absorb the cost of finding out late, so we run the advisory feeds, the dependency inventory and the regression checks against our own systems daily rather than whenever someone remembers. Your environment joins a discipline we already could not afford to skip.

The loop we run on your Drupal is the loop we run on ourselves

Facet is not an agency describing agent-run operations from the outside. Our software, our research and the quality review that cleared this page all move through loops that watch their own output and escalate to a named person when something is wrong. A Drupal maintenance engagement is that same shape, pointed at your environment.

  • We met the failure modes on our own systems first. A check that reports healthy while producing nothing. A degradation that never crosses a threshold and therefore never fires an alert. A loop that confidently fills a gap a person would have flagged as a question. All three cost us before they could cost a client, which is why every non-routine Drupal decision below stops at a human.
  • It changes the commercial terms. The expensive half of a Drupal engagement has always been the reading — senior engineers going through a codebase and a module inventory by hand to establish what you actually have. Agents take that pass, which is why the technical audit is time-boxed and fixed-fee rather than an open-ended discovery phase.
  • Humans stay in command, and the standard does not move. Agents carry the watching and the staging; a Facet engineer validates every patch and decides what reaches production. Code an agent produced clears exactly the same review as code a person typed.

Why Drupal's maintenance burden breaks most engagements

Here is the pattern we see repeatedly. A company invests in a Drupal build — custom content types, complex access control, deep integrations. Launch goes well. Then the engagement ends.

Twelve months later the site is running a minor version no longer receiving security advisories. Contributed modules have updated twice. The PHP runtime is end-of-life. Nobody owns the update cycle, because it was never structured into anyone's role.

Our owned position: unmaintained Drupal is a security liability, not an asset — and organizations that treat it as a one-time build always pay more to rescue it than they would have spent running it right.

Drupal's patch cadence is a strength, but only if someone is watching, testing and applying patches in a structured way. A site that goes dark on updates for six months is not stable. It is a window waiting to be opened.

What the loop actually does

Once your site is live it enters a managed loop with four continuous streams. Each one is high-volume, clearly checkable work that almost always finds nothing — which is precisely why nobody was doing it by hand.

  • Security: automated monitoring against the Drupal Security Advisories feed, matched continuously against your actual module inventory. When a critical advisory lands, the patch is staged in a clone environment and validated against your configuration rather than applied blind.
  • Updates: core, contributed modules, PHP runtime and hosting configuration staged, tested and promoted on a defined cadence. Updates never go blind to production, and every action is logged.
  • Performance: Core Web Vitals and Time to First Byte watched against a baseline, with alerting on regression and a monthly automated report rather than a vague quarterly document.
  • Availability: uptime monitoring with defined escalation paths, so incidents surface to the Facet team before they surface to your users.
  • Inventory: the module, dependency and custom-code map kept current continuously, because an advisory feed is only useful against an accurate picture of what you are running.

What a person still decides

Every non-routine decision gates on a human. Agents surface the work with context and options; people make the call.

  • Every major version upgrade. Whether to move, when, and what the contributed module ecosystem means for your custom code. That is a planning conversation with real cost attached, not something a loop schedules.
  • Every module conflict. A loop can tell you two modules now disagree. Which one your site actually needs, and whether the answer is a patch, a replacement or removing a feature, takes an engineer who understands what the site is for.
  • Every schema change. Content architecture changes have consequences for editors, for integrations and for anything reading your data. Those are business decisions with a technical shape.
  • What is worth keeping. The most valuable finding in many audits is a subtraction — a contributed module doing one thing badly, a content type nobody has used in two years, a custom module that should be replaced by core. Deleting has consequences an agent does not carry.

What a Facet Drupal engagement includes

Custom Drupal development

Every engagement opens with a discovery phase mapping your content architecture, access model, integration requirements and performance targets before a line of custom code is written. We build on Pantheon with deployment pipelines that mirror production exactly, so there are no surprises on go-live. The practice covers:

  • Custom module development and contributed module configuration
  • Content architecture — content types, fields, taxonomies, paragraphs
  • Headless and decoupled Drupal (JSON:API, Next.js front-ends)
  • Role-based access control and complex permission modeling
  • CRM, marketing automation and data platform integrations
  • Accessibility (WCAG 2.1 AA), security hardening and performance architecture
  • Major-version migrations (Drupal 7 to 10, 9 to 10, 10 to 11)

We are an open-source-centric shop. The codebase you receive is documented, version-controlled and portable, and we do not architect dependency on proprietary tooling that forces you back to us for routine work.

The maintenance math (illustrative)

These are illustrative benchmarks, not guarantees — labeled so you can apply the logic to your own environment.

(Illustrative) Add up your own version of the four rows above — your recurring update hours, your advisory responses over the last year, and the amortized share of the next major upgrade. Whatever that comes to is engineering capacity spent on keeping still, and it compounds in opportunity cost. A deferred Drupal 9 to 10 migration does not get cheaper with time — by the point of forced migration the contributed module ecosystem has moved further away. Running Drupal as a continuous loop makes a major upgrade planned work rather than an emergency project.

Run it on your own numbers. Count the hours your team actually spent on Drupal maintenance last quarter, add the hours it deferred, and price both. That comparison makes this case better than any table of ours.

Built for Drupal, not just familiar with it

Facet's roots are in Drupal. Since 2014 our custom Drupal development work has covered multi-site architectures, healthcare deployments, and organizations migrating off legacy Drupal 7 environments. CIOReview named us a Top 10 Digital Transformation Services Company in 2021, as a boutique systems integrator rather than a generalist agency adding Drupal to a technology menu.

Our 500+ specialist network means we staff the right Drupal expertise for your stack rather than whoever is on the bench, and our 40-person team across 9 timezones means your environment has coverage when your own team is offline.

We practice what we preach on transparency. If we inherit an environment with architectural debt — an unsupported module, a configuration that will not survive a major upgrade — we tell you before we touch it. You get an honest assessment with prioritized remediation, not a surprise change order six weeks in.

Who this is right for

Facet's Drupal development services fit when:

  • You are building or rebuilding a business-critical Drupal site and need an engineering partner with real Drupal depth rather than a generalist web shop
  • You have an environment that has drifted — advisories piling up, modules behind, no update cadence — and need rescue followed by structured ongoing management
  • You are an engineering leader evaluating a major version migration and want a team that has run this before rather than one learning it on your site
  • You are an operations leader who needs the platform to be reliable rather than a source of unplanned engineering work

How could AI agents run your Drupal environment? Book the 30-minute Drupal consultation on your real site. You leave with your version, module health, advisory status and runtime assessed, a prioritized remediation list, an illustrative view of the maintenance hours in play, and a written recommendation — including "migrate off Drupal" when the maintenance surface no longer earns its keep.

Where Drupal work goes next

A ladder, not a bundle. A well-run Drupal environment that never needs anything else is a complete outcome.

  • AI Managed Services — the run layer in full, when the same watch-triage-patch discipline should cover the systems around your Drupal site rather than only the site.
  • Agentic Engineering — the build layer, for when the roadmap on top of Drupal needs far more software out of the team you have.
  • Agentic Operating System — the same pattern installed across every operating area, so the content platform is one loop among several rather than an island.
  • Forward Deployed Engineering — a senior Facet engineer embeds and transfers the method, if you would rather your own team ran the loops.

The loop runs between your milestones. While your team is focused on the business, ours is watching the advisories feed, staging patches and keeping your runtime on a supported version. When something needs a decision, it surfaces with context and a recommendation rather than as a surprise ticket. That is what Drupal development that stays valuable looks like: not a project with a close date, but a managed function with a continuous record of what is running and why.

Book a Drupal consultation

How could AI agents run your Drupal environment? Book a 30-minute Drupal consultation. We look at your current posture — version, module health, advisory status, runtime, update cadence — and you leave with an honest picture of what your environment actually needs, a prioritized remediation list, and an illustrative view of the maintenance hours in play, whether or not you engage Facet.

Sometimes the honest recommendation is to leave Drupal. If your requirements no longer justify the maintenance surface — if what you are running is a content-first marketing site that a lighter platform would serve at a fraction of the upkeep — that is what the assessment will say, and it costs us both the build and the ongoing arrangement. We would rather tell you that before another year of patching than after it.

How pricing works. Fixed fee, scoped and quoted after a technical audit, with no hourly billing. Major version migrations are scoped separately after that audit, because complexity varies enormously with contributed module count and custom code volume. Ongoing loop operation is a monthly arrangement priced on site complexity. We give firm estimates after the discovery call rather than vague ranges before it.

FAQ

Drupal or WordPress — which should I choose?

Drupal is right when your requirements involve complex content architecture, granular access control, high-volume workflows, or regulatory environments needing fine-grained permissions and audit trails. WordPress fits content-first marketing sites where editorial ease and plugin breadth outweigh configuration depth. Facet builds and maintains both, and recommends from your actual requirements rather than whichever platform we happen to sell more of.

Can Facet take over a Drupal site built by another team?

Yes. Rescue and stabilization are a regular part of the practice. We start with a technical audit covering codebase quality, contributed module health, advisory status, PHP runtime version and update cadence, and that audit produces a remediation roadmap with honest prioritization before we touch anything. We have inherited environments running end-of-life Drupal 7 with no documented upgrade path and sites left on an unsupported PHP version years after end-of-life. We have seen the full range.

How does Facet handle Drupal security advisories?

Drupal's security team publishes advisories on a defined schedule, with critical ones issued out of cycle when severity warrants. Under the loop, monitoring tracks advisories against your module inventory. When one applies we triage severity, stage the patch in a clone environment, validate it against your configuration and promote to production within the agreed response window. You receive a record of what was applied and why. Advisory response is a covered function, not a billable incident.

What do we own at the end of an engagement?

Everything. The codebase, the deployment pipeline configuration, the monitoring setup and the documentation are yours, version-controlled and portable to another team. Our Agent Loop arrangement is something you continue because it is worth continuing, not because leaving would strand you.