Drupal Maintenance Services, Costs, and Choosing a Provider
Last updated: April 2026
A Drupal website isn’t a project that’s finished once it’s launched. Security updates, monitoring, troubleshooting, and ongoing development—all of these require ongoing support. A maintenance contract specifies who handles these tasks, how quickly issues are addressed, and what it costs.
But: Not all maintenance contracts are created equal. The differences in scope of services, quality, and price are enormous.
This guide helps you ask the right questions, whether you’re looking for a maintenance partner for the first time or want to switch from your current provider.
1. Why Drupal Needs Ongoing Maintenance
Drupal is a powerful open-source CMS used by companies, associations, and organizations worldwide. But this very strength also comes with responsibility:
- Security updates are released regularly, sometimes several times a month. Critical vulnerabilities must be patched immediately before automated attacks exploit them.
- Drupal Core and modules continue to evolve. Those who fail to update risk incompatibilities and fall behind on new versions.
- PHP versions, server configurations, and hosting environments change. Without regular maintenance, technical debt accumulates, which becomes costly later on.
- With the end of support for Drupal 10 (mid-2026), many organizations are facing an upgrade to Drupal 11—a maintenance partner can assist with this transition.
In short: Anyone operating a Drupal website needs either an internal team with Drupal expertise or an external maintenance partner. For most organizations, the latter is more cost-effective.
2. What a Professional Maintenance Contract Should Include
A good Drupal maintenance contract is more than just installing updates. It should include the following components:
2.1 Monitoring
Your Drupal instance should be automatically monitored around the clock for availability, performance, and error conditions. Monitoring must run 24/7, even if support itself is limited to business hours. It is crucial that issues are detected before your users notice them.
2.2 Security Updates
The service provider should install security updates from the Drupal Security Team independently and promptly, without requiring your approval each time. Critical updates should be rolled out immediately, not just during the next scheduled maintenance window. Ask specifically: How soon after a critical security update is released will it be applied? Within hours? On the next business day? Or only at the next opportunity?
2.3 Error Categories and Response Times (SLA)
A professional maintenance contract defines error classes and assigns binding response times to them. A proven model:
- Fatal error (website unavailable, data breach): Response time 1–2 hours
- Severe error (sub-sections unavailable, faulty processes): Response time 2–4 hours
- Minor error (display error, workaround available): Response time 1–2 business days
Important: Response time does not mean resolution time. It defines when error analysis begins. But it gives you the assurance that your problem won’t be left unresolved for days.
2.4 Included Support Hours
Most maintenance contracts include a monthly allocation of hours for support and minor maintenance tasks, typically 3–5 hours per month. This allocation covers items such as:
- Bug fixing and troubleshooting
- Minor adjustments and configuration work
- Answering technical questions
- Coordination with your hosting provider
Any additional work, particularly further development, will be billed separately on a time-and-materials basis.
2.5 Deployment Process
Updates should be rolled out via a professional deployment process, ideally using a Git repository and a CI/CD pipeline. Service providers who upload updates directly to the live server via FTP are not working according to current industry standards. Keep this in mind: Is automated deployment already in place, or does it need to be set up first? Reputable service providers clarify this in advance and set it up as needed.
2.6 Dedicated Contact Person
You should have a dedicated contact person who is familiar with your project—you shouldn’t have to explain your system landscape to a new employee every time you call. At smaller, specialized agencies, this is usually a given.
Would you like some advice on maintenance?
Please feel free to contact me:
anja@undpaul.de
3. Ownership: Who owns the hosting, code, and tickets?
An issue that is often overlooked when choosing a maintenance partner—and one that comes back to haunt you when switching agencies—is the question of who has control over the core components of your website.
The reality we regularly encounter: A company wants to switch service providers and discovers that the website runs on the previous agency’s server, the source code is stored in their repository, and the entire ticket history is locked in their system. The switch suddenly turns into a migration project that costs time and money and keeps the company in a dependency it actually wanted to end.
3.1 Hosting
Your website should run on hosting that you own, or at least to which you have direct access. Agency hosting, where your site runs on the service provider’s infrastructure, creates a dependency that will cost you dearly if you switch.
Our recommendation: Sign the hosting contract directly with a provider (e.g., freistil, Upsun, Amazee, or a traditional managed hosting provider). Your maintenance partner gets access, but you retain control. If you switch, your website stays where it is.
3.2 Code Repository
The source code of your website belongs to you; this should be clearly stipulated in the contract. But ownership is of little use if you don’t have access.
The Git repository should be in your own account (GitHub, GitLab, Bitbucket)—not in the agency’s account. Your service provider gets write access, but you own the code. This way, you can switch service providers at any time without having to transfer the code first.
Red flag: If an agency does not grant you access to the code or claims that the code belongs to them, this is a serious issue that you must resolve before signing the contract.
3.3 Ticket System and Project History
Tickets, task descriptions, and the entire communication history constitute valuable project knowledge. If all of this is stored in the agency’s system and you are not provided with an export when switching providers, this knowledge will be lost.
Ideally, you should use your own ticket system (Jira, GitLab Issues, Linear, or similar) to which your service provider is granted access.
Alternatively: Ensure that you can obtain a complete export of your tickets and project data at any time.
Make sure that decisions and architecture documentation are not just stored in Slack messages or emails, but are documented in a traceable manner.
3.4 The Basic Rule
A good maintenance partner does not make itself more irreplaceable than it needs to be. It ensures that you always have control over your own website: hosting, code, tickets, documentation. Because professional collaboration on equal terms means exactly that.
When choosing a service provider, ask specific questions: Where is my code? Where is my hosting? Who has access to what? And what happens if we part ways?
4. How Much Should Drupal Maintenance Cost? Realistic Prices
The cost of Drupal maintenance varies widely, and unfortunately, figures circulating online often paint a misleading picture.
Hobby Segment: 50–150 EUR/month
For simple Drupal sites with no special requirements, no SLA, and no guaranteed response times. Suitable for small websites with low risk. Not suitable for business-critical platforms.
Professional segment: 500–1,500 EUR/month
For companies with one or more Drupal instances that expect reliable operation. Services typically include:
- 24/7 monitoring
- Security updates with immediate response
- 3–5 hours of support per month included
- Defined error categories and response times
- Personal contact person
In addition, there are variable costs for further development and major customizations, which are billed on a time-and-materials basis, typically at daily rates between 800 and 1,200 EUR.
Enterprise segment: starting at 1,500 EUR/month
For complex platforms with high availability requirements, multiple instances, multilingual support, interfaces to third-party systems, and an extended SLA (e.g., response times even on weekends).
Rule of thumb: If your Drupal website is critical to your business—if downtime costs revenue, upsets customers, or damages your brand—then 50 EUR/month is not a maintenance contract, but an illusion.
5. Changing Agencies: What to Look Out For
A common reason for seeking a new maintenance partner: The current service provider is no longer available, is no longer delivering satisfactory results, or the project has been handed over internally. Changing agencies isn’t a big deal if it’s handled systematically.
5.1 Site Audit as a Starting Point
A reputable new service provider will first conduct an assessment:
- Drupal version and update status
- Code quality and architecture
- Security status
- Hosting setup and deployment process
- Existing documentation
- Technical debt and risks
Based on this audit, a realistic roadmap is developed: What needs to happen immediately? What can wait? What will the handover cost?
5.2 Prerequisites for a Smooth Handover
Make sure you have or can obtain the following (see also Section 3 – Ownership):
- Access to the Git repository (in your own account)
- Access to hosting / server (your own contract with the provider)
- Access to the database
- Export of ticket history and project documentation
- Documentation of existing interfaces and integrations
- Contact information for the hosting provider
The more of these points you control yourself, the easier and more cost-effective the transition will be. If you find that your current service provider controls everything, plan for additional time and budget for the migration.
Would you like some advice on maintenance?
Please feel free to contact me:
anja@undpaul.de
6. Checklist: Finding the Right Drupal Maintenance Partner
Use this checklist to compare quotes and find the right partner:
- Technical Expertise
- Does the agency specialize in Drupal, or is Drupal just one of many CMS platforms they work with?
- How long has the team been working with Drupal?
- Do they hold any certifications or have partner status (e.g., Acquia Partner)?
- Can the agency provide references for comparable projects?
Contractual Clarity
- Are services clearly defined (not just “maintenance as needed”)?
- Is there an SLA with error categories and response times?
- How many support hours are included?
- How is additional work billed?
- How are contract terms and notice periods defined?
Ownership and Control
- Is the hosting on your own contract or on the agency’s infrastructure?
- Is the code in your own repository?
- Do you have access to the ticket system and project history?
- What happens to your data and access credentials if you switch service providers?
Workflow
- Do they use Git and automated deployment?
- Is there a dedicated point of contact?
- How does communication take place (ticket system, email, phone)?
- How are major further developments planned and implemented?
Team Stability
- Is a dedicated team working on your project, or do they use rotating freelancers?
- How large is the team? Are there arrangements for coverage?
- How long has the agency been in business?
7. Maintenance vs. Development: What’s the Difference?
A common misconception: Maintenance and development are not the same thing.
Maintenance covers everything needed to keep your existing website running securely and reliably: monitoring, security updates, troubleshooting, and performance monitoring.
Further development encompasses everything that improves your website: new features, redesigns of individual sections, integrations with new systems, and upgrades to a new Drupal version.
A good maintenance contract covers maintenance and provides a clear framework for further development, e.g., through sprint-based collaboration with a backlog and prioritization. This ensures that both remain predictable and transparent.
8. Conclusion: What Really Matters
A Drupal maintenance contract is your guarantee that your digital platform will run reliably. The key points:
- Choose a service provider that specializes in Drupal, not a generalist who occasionally works with Drupal.
- Insist on an SLA with defined error categories and response times.
- Make sure you control hosting, code, and tickets yourself—not your service provider.
- Don’t be blinded by unrealistically low prices. Professional maintenance for business-critical websites starts at around 500 EUR/month and up.
- Start with a site audit before signing a contract, especially when switching agencies.
- Look for team stability, professional processes (Git, CI/CD), and a dedicated point of contact.
Would you like some advice on maintenance?
Please feel free to contact me:
anja@undpaul.de
Curious?
Please contact us.
undpaul GmbH
Eleonorenstraße 18
30449 Hannover
Germany