Drupal PHP Security Updates
Drupal sites need both PHP and Drupal core and contrib modules kept current. We patch PHP, update core and modules together where safe, and test the full site on staging first.
PHP upgrades · Core & contrib updates · Staging QA
Core and Modules Together
We check Drupal core and every contrib module against the target PHP version, so the site doesn't end up half-upgraded.
Staging First
The full site is tested on a staging copy, including content types, forms, search and user flows, before go-live.
Documented Change
You get a written record of what was updated, to the version, so your next audit is straightforward.
What's Included
Common Scenarios
Old Drupal Release
Your site is several versions behind and runs an older PHP. We bring both up to supported releases in controlled steps.
Security Advisory Due
A Drupal or module security release is out and needs applying quickly alongside any PHP change.
Custom Module Blocker
An in-house module breaks on the newer PHP version. We refactor the affected code and test it.
How a Drupal PHP Update Runs
£149 Check and Module Audit
We confirm the PHP version, patch level and CVE exposure, then audit the module list — contributed and custom — against the target PHP version and Drupal core compatibility matrix.
Staging Replica
The site is cloned with its database and files directory onto staging running the target PHP version. settings.php and services.yml differences are handled explicitly — they're a common break point.
Upgrade and Module Repair
PHP moves to the target release, core is stepped to a compatible version where needed, and up to 5 broken items are repaired in scope. Views, fields and entity forms are exercised, not just front-end pages.
Cutover and Cache Rebuild
Production switches with a tested rollback, caches are rebuilt and cron is verified running on the new PHP. You get a written record of changes and any modules flagged for future work.
Pricing
Transparent, scope-based pricing. Every job includes a backup, a staging test and a post-change check.
Emergency Patch
£999
Same or next day
- ✓Safe PHP patch to a supported release
- ✓Backup before change
- ✓Staging check
- ✓Post-patch verification
Managed Maintenance
£349 / month
£3,499 billed annually
- ✓Ongoing PHP and dependency patching
- ✓Advisory monitoring
- ✓Monthly report
- ✓Backups and uptime checks
- ✓The £149 PHP check included to start
- ✓Framework and composer dependency updates
Version Upgrade
£4,999
1–3 weeks
- ✓Move off end-of-life PHP
- ✓Compatibility testing
- ✓Staging QA
- ✓Rollback plan and post-upgrade support
Prices are indicative ranges based on project scope. Contact us for a tailored quote.
Frequently Asked Questions
Should I update Drupal and PHP at the same time?+
Often yes, but we check compatibility first. If a module blocks one of them, we agree a sequence with you rather than forcing both changes at once.
Will you handle my custom modules?+
We review them for PHP compatibility and fix what's needed. Larger custom work is scoped and quoted separately.
Is Drupal affected by the PHP release?+
Drupal runs on PHP, so any site on an affected PHP version is in scope. The fix is to run a patched PHP version, and we can confirm which one your site needs.
Which Drupal versions do you support?+
Drupal 8 through 11, including sites on end-of-life core that need intermediate hops before the PHP upgrade. Very old 7.x sites are scoped as a migration project rather than a PHP job — we'll say so plainly.
What about contrib modules that are abandoned?+
Abandoned modules are the usual blocker on Drupal PHP upgrades. We patch them where a community fix exists, replace them with maintained equivalents where it doesn't, and quote replacements before doing them.
Start With the £149 PHP Check
Tell us which application you run and which PHP version it's on. You get a written report of your exposure and the recommended next step.