What kind of changes fit in the retainer hours?

Anything that takes hours rather than weeks. Adding a field, adjusting a view, building a landing page from existing components, fixing a mobile layout issue, updating meta titles and structured data, setting up redirects for a campaign. Larger work, such as a redesign or a new integration, is scoped and priced separately so it does not eat the retainer.

How do you handle a critical security advisory?

Advisories are checked against your site's module list when they are published. If your site is affected, the fix goes to staging, gets a quick regression check and is deployed to production the same working day. You receive a message saying what was found, what was done and what to watch for.

Can the retainer cover a site you did not build?

Yes. It starts with a short onboarding review of the codebase, hosting, deployment path and known issues, so we are not learning the site during an incident. Sites in a poor state are told so in writing, with a recommendation for what to fix first.

Is there a minimum term?

No. The retainer is monthly and can be stopped at the end of any month. If you stop, you keep the repository, the runbook and the documentation we produced.

Site launched, now what?

Drupal support and maintenance

A monthly retainer that keeps Drupal 11 updated, patched and monitored, and absorbs the small content, design and SEO changes that never get scheduled.

This is for you if

your site is on Drupal 10 or 11 and updates are applied whenever someone remembers
small changes wait weeks because there is no one whose job it is to make them
you want security advisories handled the day they are published, not at the next sprint
your editors need someone to ask when the editing screen does something unexpected

What is included

Core and module updates: Drupal core minor and patch releases, contrib module updates and Composer dependency updates, applied on staging, tested and deployed on a fixed monthly cadence.
Security advisories, same day: The Drupal Security Team publishes advisories on Wednesdays. Critical ones are assessed and, where your site is affected, deployed the same day. The rest go into the monthly cycle with a note.
Monitoring and error triage: Uptime and error logs are watched. Recurring errors are traced to a cause and fixed rather than silenced.
A monthly pool of hours: Agreed in advance and used for whatever is most useful: a new content type, a form change, a layout tweak, an SEO fix, a redirect. Unused hours roll over for one month.
Editor support: Your editors can email or message a named engineer with questions about the editing interface, media, Layout Builder or CKEditor 5, and get an answer from someone who knows your site.
Monthly written report: Updates applied, advisories handled, hours used and on what, and anything we think you should plan for.

A Drupal site is a piece of software, and software that stops being maintained becomes a liability within a year. Core releases a minor version every six months. Contrib modules release fixes whenever their maintainers find time. Security advisories arrive most Wednesdays. None of this is difficult, but all of it needs someone whose job it is to do it.

How the monthly cycle runs

At an agreed point each month, usually in the first week, we update Drupal core, contrib modules and Composer dependencies on a staging copy of your site. Automated checks run, and an engineer walks through the parts of the site that updates tend to break: the editing screens, forms, search, anything with a JavaScript component. The update is then deployed to production through the same path as any other release, with a rollback ready. You receive a note listing what changed.

Security advisories run on their own track. When the Drupal Security Team publishes, we compare the affected modules against your site. If you are affected and the advisory is critical or highly critical, the fix is deployed the same day. Lower-rated ones join the monthly cycle and are recorded in the report so you can see nothing was missed.

What you decide

The size of the monthly hour pool is your call, and it can change with a month's notice. The pool covers small work, which we define as anything an engineer can finish in hours. Requests come in through a shared channel or email, are acknowledged within one working day, and are prioritised with you rather than for you. Every Friday you get a short written status if there was activity that week.

When a request is larger than the pool, we say so before starting, with a rough size and the option to scope it separately. The retainer is not a way to get projects done slowly.

What tends to come up

Most retainer months are quiet: an update, a couple of small changes, an editor question about why an image cropped the way it did. The months that are not quiet are usually caused by one of three things. A contrib module that has been abandoned by its maintainer and needs replacing. A change in an external service the site integrates with. Or performance that has drifted as content grew. Each of those is flagged in the report as soon as we see it coming, with a recommendation, so it becomes a planned change rather than an emergency.

Design and SEO tasks also land here. A section that needs restyling, a page template for a campaign, meta descriptions, structured data, redirects after a content reorganisation, fixes flagged by Search Console. These are done by the same engineer who maintains the site, which keeps the code consistent.

Combining with hosting and upgrades

Many clients pair the retainer with hosting management, in which case the report covers both, but the retainer works on any host, including the large Drupal platforms. When the next major version arrives, the retainer keeps the site in a state where the upgrade is a small project rather than a rescue. If you would like to know what onboarding an existing site involves, tell us about it.

Common questions

What kind of changes fit in the retainer hours?: Anything that takes hours rather than weeks. Adding a field, adjusting a view, building a landing page from existing components, fixing a mobile layout issue, updating meta titles and structured data, setting up redirects for a campaign. Larger work, such as a redesign or a new integration, is scoped and priced separately so it does not eat the retainer.
How do you handle a critical security advisory?: Advisories are checked against your site's module list when they are published. If your site is affected, the fix goes to staging, gets a quick regression check and is deployed to production the same working day. You receive a message saying what was found, what was done and what to watch for.
Can the retainer cover a site you did not build?: Yes. It starts with a short onboarding review of the codebase, hosting, deployment path and known issues, so we are not learning the site during an incident. Sites in a poor state are told so in writing, with a recommendation for what to fix first.
Is there a minimum term?: No. The retainer is monthly and can be stopped at the end of any month. If you stop, you keep the repository, the runbook and the documentation we produced.

Related services

Not sure which one you need?

Send us the URL and a sentence about what is bothering you. We will tell you which service fits, or whether you need one at all. The first reply is free and commits you to nothing.

Ask us