Drupal core July security updates: what site owners should check now
Recent Drupal core security updates are not only a developer task. They reveal whether a site has a working maintenance process, staging environment and clear technical ownership.
Articles
Articles
Short practical notes about Drupal development, testing, AI-assisted work and keeping websites healthy.
All (90) Drupal (59) Development (30) Maintenance (17) Security (12) Audit (11) Migration (10) WCAG (9) AI (8) E-commerce (6) Performance (5) Testing (5) GDPR (4) UX (3)
Why does Drupal get slower over time?
Drupal does not become slow simply because it gets older. Most performance problems come from years of accumulated content, configuration, modules, media, scripts and maintenance debt.
Drupal 7 Migration Statistics in 2026: What the Numbers Really Mean
Drupal 7 is no longer a supported platform in 2026, but usage statistics show that migration debt remains a live issue for many organizations.
Drupal vs Headless CMS: which approach fits a large organization's digital platform?
Headless CMS can offer major flexibility, but for a large organization the architecture decision is not only technical. Content governance, editorial workflows, accessibility, integrations and long-term maintainability matter just as much.
Drupal admin interface as an editorial workbench
Many Drupal problems do not start on the public website. They start in the admin interface, where editors work with unclear forms, long lists and workflows that no longer match the organisation.
Drupal CMS 1 to Drupal CMS 2 upgrade
Drupal CMS is not a classic product that is simply upgraded from version 1 to version 2. An existing site needs a technical review first.
Drupal CMS 2.0 and Canvas in a client project
Drupal CMS 2.0 makes starting with Drupal easier, but it does not remove the need for architecture, maintenance and responsibility.
E-commerce accessibility after the 2025 deadline
The accessibility deadline is no longer in the future. For an online shop, the whole purchase journey must be checked.
Component-based Drupal — how it is built in practice
Component-based development is not just a frontend trend — in Drupal it is a concrete architectural choice that affects both editorial workflow and long-term maintenance costs.
Contact form without reCAPTCHA — catching bots without Google
reCAPTCHA works, but it loads scripts from Google, tracks users and requires GDPR consent. Here is an alternative you can manage yourself.
UX rules and system consistency
Why consistency is not an aesthetic preference but a functional requirement — and how to achieve it in practice.
Headless Drupal — when it actually makes sense
Headless Drupal is a powerful architectural choice — but not for every project. Here is when it genuinely helps and when it simply adds complexity.
Hiring a Drupal agency outside your country — what actually matters
The agency's country matters less than whether they work in your timezone, respond when it counts and understand what is at stake.
How to assess Drupal development quality
Drupal project quality is not visible in the design. It is visible in the code structure, tests and how changes are deployed.
How much does a Drupal website cost?
Drupal website cost is not mainly about design. The largest share of cost typically comes from functionality, integrations and ongoing maintenance.
AI builds your site and deploys it. But who's responsible?
An AI tool builds your site and puts it live. But when it breaks at 11pm, data leaks, or a client calls in a panic — who do you turn to?
Drupal CMS vs Drupal — what is the difference?
Drupal CMS is not a new product — it is the same Drupal, pre-configured so that getting started is faster and simpler.
Drupal hosting requirements — what to expect from a server
Drupal does not run well on every hosting environment. It is worth checking a few important parameters before signing a contract.
Drupal multisite — one platform, multiple websites
Drupal multisite suits organisations managing multiple sites who want shared modules, updates and maintenance processes.
Modern website checklist — security, performance, GDPR and AI readiness
A website must do more than work. It must be secure, fast, privacy-compliant, accessible and readable by machines. Some of these are recommendations — others are legal requirements.
Who builds a modern website — the skills and roles involved
A modern website requires far more than one developer. Every requirement — security, performance, accessibility, GDPR, content — needs its own set of skills.
How WebPro built its website — custom build, AI-assisted, honest review
The WebPro website is a fully custom build, written with AI assistance. No Drupal, no ready-made framework. An honest account of the decisions, difficulties and outcome.
Visual regression testing for websites
Not every defect is functional. Sometimes an update breaks layout while the form still technically works.
AI content generation for websites — where it helps and where it harms
AI generates content quickly, but speed does not mean quality. Repetitive phrases, inaccurate information and a missing voice are risks that need to be managed deliberately.
Drupal scanner: a public pre-check before maintenance or upgrades
The Drupal platform assessment gives an initial public-data-based view of whether a website may need maintenance, upgrades or a deeper audit.
EU cancel button: new requirement for online shops
From 19 June 2026, many online shops must provide a clear electronic way to withdraw from a contract.
Playwright tests for forms, menus and carts
The most useful UI tests cover the journeys the client immediately notices when they break.
Schema.org structured data — a practical guide for Drupal
Schema.org markup tells search engines whether a page describes a service, an article, an organisation or a product. Google uses it for rich results, AI agents for understanding content.
AI as a developer-guided assistant
How AI helps build better workflows, tests and checklists when a developer stays in control.
AI in code review: benefits, limits and responsibility
AI can find useful signals, but code review must not become blindly accepted suggestions.
Why we automate Drupal work as much as possible
Automated workflows reduce manual work, make changes traceable and help avoid breaking the public website during development.
Automated tests do not need to start big
Which Playwright and PHP tests usually bring the fastest value in a Drupal project.
Drupal go-live checklist
Going live is technical work, not only a button press. A good checklist reduces downtime and hidden errors.
Core Web Vitals in Drupal — common problems and how to fix them
LCP, CLS and INP are Google's metrics that affect search ranking. Drupal sites have specific causes and specific solutions for each.
How AI helps plan a Drupal migration
AI can speed up analysis, but migration responsibility stays with the technical team.
Drupal 11 migration: plan before code
Why the first migration task is mapping risks and dependencies, not writing code.
Multilingual Drupal website — how it works
Drupal supports multilingualism systematically — content, interface, configuration and URLs can all be language-specific. It requires planning, but the results are correct.
Website budget: work that is often missing
A cheap website quote often leaves out work the client still has to pay for later.
Website accessibility: why WCAG is not only a public-sector topic
Accessibility affects sales, service, reputation and compliance. A broken form or checkout can exclude part of the audience.
Maintenance contract or one-off fix for a Drupal site
A one-off fix solves a bug. Maintenance reduces the chance of future bugs and security risk.
GDPR on websites: why it also affects ordinary contact forms
GDPR is not only a legal document. Website forms, logs, cookies, accounts and online orders all involve personal data.
What to ask a web developer before signing
A good contract describes not only the result, but also responsibility, testing and handover.
What a good web project brief contains
A poor brief leads to wrong pricing, surprises mid-project and disputes at the end. A good brief does not need to be long — it needs to be precise.
Why an old website can be a business risk
If a website works only as long as nobody changes it, it is already a business risk.
Technical debt in web projects — how it builds and what it costs
Technical debt does not come from carelessness — it comes from decisions that were reasonable at the time. The problem is that it is not measured or managed.
Technical website audit before acquisition or provider change
Changing providers is easier when the state of code, access and hosting is known first.
Drupal security updates — why they cannot be postponed
Drupal publishes security updates through a structured process. Applying them requires Composer, testing and staged deployment — not just clicking update.
Drupal roles, permissions and editorial workflow
Permissions are not only about access. They affect content quality and security.
Drupal vs WordPress — when to use which
Drupal and WordPress suit different projects. The question is not which is better, but which fits your specific requirements.
When Drupal needs refactoring, not only an update
If the old solution blocks every change, a version upgrade alone may not solve the problem.
What happens when a Drupal site is not updated
An outdated Drupal site does not break overnight, but the risk grows every month. Security vulnerabilities, end-of-life PHP, broken modules and rising remediation costs.
Drupal cache, images and Core Web Vitals
Performance work starts with measurement, not random module installation.
Drupal migration, upgrade or maintenance — how to choose
Drupal maintenance, upgrade and migration are three different services for three different situations. The choice depends on where your site is today.
Custom module audit before Drupal migration
Migration complexity often sits in custom code, not in Drupal core.
Composer in a Drupal project: why it matters
Composer is not a convenience add-on. It is how Drupal dependencies stay repeatable and controlled.
How to check if a Drupal module is risky
One old module can keep the whole site stuck on an old version.
European Accessibility Act and online shops
An online shop must work when the customer uses a keyboard, screen reader or clear error messages.
PHP version and Drupal hosting
Drupal maintenance is not only module updates. The server PHP version must also be supported and upgradeable.
WCAG 2.2: what changed and what to check
WCAG 2.2 is not only about contrast. Many issues appear in forms, menus and keyboard navigation.
Drupal audit checklist before development
An audit shows where the risks are before development starts and what work is actually needed.
How to choose a Drupal maintenance partner
A good maintenance partner does not only react to bugs. They reduce the chance of bugs reaching production.
How much does a Drupal upgrade cost
Drupal upgrade cost is not defined by the version number alone, but by what the system actually contains.
Drupal 10 end of life and Drupal 11 readiness
Drupal 10 end of life is not a reason to panic, but it is a reason to check readiness before the final month.
Drupal 7 in 2026: what to do with an old site
A Drupal 7 site may still run, but technical and security risk grows every month.
Drupal performance optimization — practical steps
A slow Drupal site is not Drupal's fault — most performance issues come from misconfigured caching, unoptimized queries or a poorly set up server.
Drupal Commerce vs WooCommerce — which fits your online store?
WooCommerce suits a simple product-based store that needs to launch quickly. Drupal Commerce suits complex business logic or a site that does more than just sell.
Drupal Search API — search that actually works
Drupal Core search works for a small site. When content volume is high and search needs to be fast and accurate, Search API + Solr is the standard solution.
Drupal Paragraphs module — flexible content builder
Paragraphs is one of the most widely used Drupal modules. It gives editors a flexible content builder without needing a developer for every change.
Why Drupal suits the public sector
Public sector websites must be secure, accessible and maintainable for years. Drupal meets these requirements better than most alternative CMS platforms.
Website speed and conversion — the measurable connection
Every second of load time reduces conversions by roughly 7%. This is not a hypothesis — it is a measured result from multiple large-scale platforms.
How to evaluate whether your Drupal partner is doing good work
Clients see the result — whether the site works and looks good. Technical quality is hidden. Here are the questions and signals that help evaluate it.
European Accessibility Act 2025 — what it means for online stores
From June 2025, the EAA is mandatory for all online stores selling to EU consumers. Non-compliance means fines and legal action.
Drupal AI modules — what they actually do
AI modules for Drupal are no longer experimental — several have reached stable status and are in use on production sites.
Drupal security in practice — what actually happens when you skip updates
Drupalgeddon, SA-CORE-2018-002, CVE-2020-13671 — these are not abstract code numbers. They are vulnerabilities that were exploited at scale. Here is what actually happens.
Drupal security incident plan — what to do when your site is compromised
You cannot plan a security incident — but you can plan your response. Here is a clear plan for what to do when a Drupal site is compromised.
Drupal backup restore test — why "backup exists" is not enough
Many organisations have a backup. Fewer have checked whether it actually works. Here is why a restore test is mandatory.
Drupal Layout Builder vs Paragraphs — when to use which
Layout Builder is built into Drupal core, Paragraphs is a module. Both let editors control page structure — but the right choice depends on your project's needs.
Drupal Views — what it is and when it falls short
Views lets you display, filter and sort Drupal content without writing code. But in more complex scenarios it hits its limits. Here is when.
Drupal Migrate API — how to bring content from another system
Migrate API is Drupal's built-in migration framework. It lets you map, transform and import content from practically any source.
Drupal configuration management — why config sync matters
Without config sync, Drupal configuration lives only in the database — invisible, unversioned, unrecoverable. Config sync makes it visible.
Drupal custom module development — when it makes sense and what it costs
A custom module is the answer when existing modules do not cover the need. Here is when it is the sensible choice and what to budget for.
How long does a Drupal project take — realistic timelines
"3 months" is a common answer — but is it realistic? Here are honest timelines for different Drupal projects and what actually drives the schedule.
What to do when the previous developer is gone — taking over a Drupal project
The previous developer has left a Drupal site behind with incomplete documentation. Here is how to handle the situation without losing anything important.
Fixed price vs hourly rate — which suits a Drupal project
Both pricing models are valid — but for different types of projects. Here is what to watch out for with each.
How Drupal projects stall — and how to avoid it
Most projects do not stall because of bad code. They stall because of poor communication, unclear requirements, and unmet expectations.
Screen reader testing — how to check accessibility in practice
Automated tests find about 30% of accessibility issues. The rest can only be found by testing with a real screen reader. Here is how to get started.
Accessibility audit — what it covers and what you get
An accessibility audit is not just an automated scan. It is a systematic assessment that finds issues tools cannot see.
Colour contrast and font choice — a practical accessibility guide
A poor colour combination means some users cannot read the text. WCAG sets clear minimum requirements — here is how to check them.
Estonian businesses and GDPR — what the real requirements are
GDPR has been in force for several years but many Estonian websites still do not comply. Here is where to start practically.
Which CMS platforms Estonian businesses use — and why Drupal stands out
Most Estonian websites use WordPress. More complex platforms often choose Drupal. Here is why and when that choice is justified.
Kaido Toomingas WebPro Company OÜNeed Drupal help?
If the article describes your situation, you do not have to read everything first. A real person will help you choose the next step.