How to cut a Drupal hosting bill without breaking the site

Most Drupal hosting bills are larger than the site behind them needs. Platform hosts such as Acquia and Pantheon price by tier, and tiers bundle things you may never use with things you cannot do without. Cutting the bill starts with separating the two, not with switching provider.

What platform hosts charge for

A platform invoice is rarely one number. It is a bundle, and the bundle usually has five parts.

Seats. Every person who can log into the hosting dashboard, deploy code or read logs. Agencies with rotating staff burn through these fast. Editors who only use the Drupal admin do not need a seat, but they are often given one.
Environments. Development, staging and production are standard. Extra environments for feature branches, multidev or client review are metered on top, either per environment or by tier.
Traffic tiers. Monthly visits, pageviews or requests, measured at the edge. Crossing a threshold moves you to the next tier for the rest of the contract, or triggers overage.
Support SLAs. Response time, named engineer, 24/7 phone coverage. The cheapest tier is ticket-only with a next-business-day promise. The most expensive tier is a phone number that answers at 03:00.
Overage. Traffic above the tier, storage above the quota, extra sites on a multisite plan. This is the line item that surprises people, because it is variable and it is billed after the fact.

None of these are unreasonable. The problem is that they are bought as a package sized for the worst month of the year, then paid for twelve months.

What a mid-size Drupal site actually needs

Strip the marketing away and a Drupal 11 site needs a short list of things to run well.

PHP 8.3 or newer under PHP-FPM, with OPcache on.
MariaDB or MySQL with enough memory to hold the working set of the database.
Redis as the cache backend, so cache bins do not sit in the database.
An HTTP cache in front of Drupal. Varnish on the server, Cloudflare at the edge, or both.
Cron, running on a schedule, not on page requests.
Nightly backups with a tested restore.
A staging environment that matches production closely enough that a deploy there tells you something.
A deployment path from git to production that does not involve FTP.
Somebody watching uptime, disk, PHP errors and Drupal's security advisories.

That last item is the one platform hosts sell hardest, and rightly so. It is also the item you can buy separately.

Most of the list runs comfortably on a single well-configured virtual machine, or a small pair with a managed database. Multiple web nodes, autoscaling and multi-region failover are real needs for some sites. They are not needs for a marketing site with forty editors and a busy week in October.

How to read your own invoice

Get the last twelve invoices and the contract, and answer four questions.

Which tier are we on, and what put us there? Find the traffic or site-count threshold that triggered it. Then pull the last twelve months of actual traffic from Cloudflare, Search Console or your analytics and compare. If you crossed the threshold once, during a campaign, you are paying a year for a week.
How many seats are active? Export the user list from the hosting dashboard. Count the people who have logged in during the last ninety days. The rest are paying for nothing.
Which environments exist? List them and check the last deploy date of each. Environments nobody has touched in six months are cost, not capability.
What did support actually do? Pull the ticket history. If every ticket in a year was a question about a deploy or a request for a cache clear, the SLA tier is insurance against a fire that has not happened. That may be a choice worth making. It should be a conscious one.

Then add up what is left after removing the unused parts. The honest figure is often well below the invoice, but the exact gap depends on the site, so do the exercise rather than take our word for it.

When a platform host is worth it

We are paid to optimise and manage Drupal hosting, so treat this section as us arguing against our own interest.

A platform host earns its price when at least one of these is true.

You run a portfolio. Twenty or more sites, with a multisite or a shared codebase, where consistent tooling across all of them matters more than the unit cost of any one.
You have a compliance requirement that names the host. HIPAA, FedRAMP, ISO 27001 with a scoped hosting provider, or a procurement rule that requires an audited platform. Building the evidence pack yourself costs more than the tier premium.
You have no engineering team and no partner. Somebody has to patch the operating system, rotate certificates and answer when the disk fills up. If that person does not exist, the platform is that person.
Your traffic is genuinely spiky and genuinely large. Ticket sales, exam results, product launches with press coverage. Autoscaling that you did not have to build is worth money.
Your developers rely on multidev. If every feature branch gets its own environment and the team would slow down without it, that feature is doing work.

If none of these apply, the tier is buying insurance and convenience. Both have a price. Make sure you know what it is.

A worked example: sizing a site

Take a site that we would call typical of what we see. This is a worked example, not a benchmark.

Roughly 250,000 pageviews a month, with two peaks of 600,000 during campaigns.
Forty editors, of whom about ten publish in a given week.
Mostly anonymous traffic, with a members area behind login used by a few hundred people.
One language, about 8,000 nodes, 30 GB of files.
Drupal 11, PHP 8.3, Redis, Cloudflare in front.

Start with the cache. With Cloudflare caching full pages for anonymous visitors, the origin sees a small share of those pageviews. Editors, logged-in members, form submissions and cache misses are what reach PHP. Even during a peak, that is a few requests per second, not hundreds.

For that load, a virtual machine with four virtual cores and eight gigabytes of memory, running PHP-FPM with a pool of twelve to sixteen workers, MariaDB tuned to hold the database in memory, and Redis with a few hundred megabytes, has headroom. Servers of that size are priced in the tens of euros a month at European cloud providers. Add a smaller staging machine, object storage for backups, and Cloudflare on a plan that covers the WAF rules you actually use.

Then add what the platform was really charging you for: somebody to own it. Patching, monitoring, Drupal security releases within the advisory window, restore tests, and a phone number. That is a support retainer, and it is priced by hours and response time, not by pageviews.

Put the two together and compare the total with the current invoice. The comparison is what matters, and it will be specific to your site. Sometimes the platform wins. More often the site was overbuilt for a peak that Cloudflare absorbs anyway.

If you are still on Drupal 7, hosting is only one part of the picture. Read our post on what Drupal 7 extended support covers before making a hosting decision, because the PHP version your host offers may decide it for you.

Where to start

Send us your last three hosting invoices and read access to your traffic data. We will tell you what the site needs and what it does not, with numbers you can check. That is the first step of our hosting optimisation and management service, and if the answer is that your current host is the right one, we will say so.

If you would rather have the full picture, including the state of the code and the upgrade path, ask for a free initial review. If it makes sense, a paid five-day assessment covers hosting, security and migration in one report, and its fee is deducted from any migration that follows.